Format

• written questions
• practical configuration task
• review of a risky SSH scenario
• short operations and security assessment

Notes

Work without production hosts and without real secrets. If sshd is missing locally, use client tools, ssh-keygen and static review rules.

Questions

Question 01

Explain how you explain SSH protocol layers. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 02

Explain how you distinguish OpenSSH client and server. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 03

Explain how you verify host-key trust. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 04

Explain how you generate and protect user keys. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 05

Explain how you review permissions for .ssh. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 06

Explain how you debug public-key authentication. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 07

Explain how you structure ssh_config with Host blocks. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 08

Explain how you review sshd_config safely. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 09

Explain how you design ProxyJump and bastion paths. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 10

Explain how you control port forwarding. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 11

Explain how you classify SFTP and safe file transfer. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 12

Explain how you use ssh-agent safely. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 13

Explain how you justify or reject agent forwarding. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 14

Explain how you model OpenSSH certificates and CA trust. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 15

Explain how you explain KRL and revocation. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 16

Explain how you classify FIDO2 keys. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 17

Explain how you analyze logging and auth events. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 18

Explain how you weigh hardening options. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 19

Explain how you run incident response for key leakage. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 20

Explain how you test client and server configuration. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 21

Explain how you plan recovery for host-key rotation. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 22

Explain how you explain SSH protocol layers. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 23

Explain how you distinguish OpenSSH client and server. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 24

Explain how you verify host-key trust. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 25

Explain how you generate and protect user keys. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 26

Explain how you review permissions for .ssh. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 27

Explain how you debug public-key authentication. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 28

Explain how you structure ssh_config with Host blocks. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 29

Explain how you review sshd_config safely. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 30

Explain how you design ProxyJump and bastion paths. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 31

Explain how you control port forwarding. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 32

Explain how you classify SFTP and safe file transfer. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 33

Explain how you use ssh-agent safely. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 34

Explain how you justify or reject agent forwarding. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 35

Explain how you model OpenSSH certificates and CA trust. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 36

Explain how you explain KRL and revocation. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 37

Explain how you classify FIDO2 keys. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 38

Explain how you analyze logging and auth events. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 39

Explain how you weigh hardening options. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 40

Explain how you run incident response for key leakage. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 41

Explain how you test client and server configuration. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 42

Explain how you plan recovery for host-key rotation. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 43

Explain how you explain SSH protocol layers. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 44

Explain how you distinguish OpenSSH client and server. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 45

Explain how you verify host-key trust. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 46

Explain how you generate and protect user keys. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 47

Explain how you review permissions for .ssh. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Question 48

Explain how you debug public-key authentication. Name at least one command, one error case, one fingerprint or log evidence item and one security risk.

Practical Task

Create an SSH client configuration with bastion alias, IdentityFile, known-hosts file and controlled forwarding. Add a hardening review for a server-side sample configuration.

Review Checklist for Intermediate

• 01. document host-key trust: Record the affected host, user, key, configuration and risk.
• 02. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 03. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 04. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 05. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 06. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 07. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 08. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 09. keep certificate validity short: Record the affected host, user, key, configuration and risk.
• 10. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
• 11. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
• 12. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
• 13. document host-key trust: Record the affected host, user, key, configuration and risk.
• 14. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 15. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 16. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 17. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 18. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 19. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 20. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 21. keep certificate validity short: Record the affected host, user, key, configuration and risk.
• 22. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
• 23. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
• 24. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
• 25. document host-key trust: Record the affected host, user, key, configuration and risk.
• 26. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 27. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 28. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 29. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 30. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 31. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 32. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 33. keep certificate validity short: Record the affected host, user, key, configuration and risk.
• 34. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
• 35. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
• 36. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
• 37. document host-key trust: Record the affected host, user, key, configuration and risk.
• 38. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 39. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 40. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 41. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 42. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 43. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 44. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 45. keep certificate validity short: Record the affected host, user, key, configuration and risk.

Practice Appendix: Intermediate

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSH client tools, test keys and sample configurations.

A001. SSH

• Task: verify fingerprint and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A002. Review

• Task: evaluate configuration and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A003. Trust

• Task: justify risk and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A004. Security

• Task: explain error path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A005. SSH

• Task: classify log line and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A006. Review

• Task: document trust model and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A007. Trust

• Task: plan rotation and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A008. Security

• Task: restrict access and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A009. SSH

• Task: review forwarding and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A010. Review

• Task: describe recovery path and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A011. Trust

• Task: verify fingerprint and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A012. Security

• Task: evaluate configuration and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A013. SSH

• Task: justify risk and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A014. Review

• Task: explain error path and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A015. Trust

• Task: classify log line and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A016. Security

• Task: document trust model and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A017. SSH

• Task: plan rotation and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A018. Review

• Task: restrict access and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A019. Trust

• Task: review forwarding and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A020. Security

• Task: describe recovery path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A021. SSH

• Task: verify fingerprint and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A022. Review

• Task: evaluate configuration and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A023. Trust

• Task: justify risk and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A024. Security

• Task: explain error path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A025. SSH

• Task: classify log line and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A026. Review

• Task: document trust model and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A027. Trust

• Task: plan rotation and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A028. Security

• Task: restrict access and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A029. SSH

• Task: review forwarding and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A030. Review

• Task: describe recovery path and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A031. Trust

• Task: verify fingerprint and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A032. Security

• Task: evaluate configuration and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A033. SSH

• Task: justify risk and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A034. Review

• Task: explain error path and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A035. Trust

• Task: classify log line and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A036. Security

• Task: document trust model and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A037. SSH

• Task: plan rotation and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A038. Review

• Task: restrict access and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A039. Trust

• Task: review forwarding and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A040. Security

• Task: describe recovery path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A041. SSH

• Task: verify fingerprint and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A042. Review

• Task: evaluate configuration and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A043. Trust

• Task: justify risk and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A044. Security

• Task: explain error path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A045. SSH

• Task: classify log line and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A046. Review

• Task: document trust model and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A047. Trust

• Task: plan rotation and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A048. Security

• Task: restrict access and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A049. SSH

• Task: review forwarding and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A050. Review

• Task: describe recovery path and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A051. Trust

• Task: verify fingerprint and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A052. Security

• Task: evaluate configuration and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A053. SSH

• Task: justify risk and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A054. Review

• Task: explain error path and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A055. Trust

• Task: classify log line and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A056. Security

• Task: document trust model and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A057. SSH

• Task: plan rotation and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A058. Review

• Task: restrict access and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A059. Trust

• Task: review forwarding and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A060. Security

• Task: describe recovery path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A061. SSH

• Task: verify fingerprint and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A062. Review

• Task: evaluate configuration and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A063. Trust

• Task: justify risk and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A064. Security

• Task: explain error path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A065. SSH

• Task: classify log line and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A066. Review

• Task: document trust model and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A067. Trust

• Task: plan rotation and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A068. Security

• Task: restrict access and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A069. SSH

• Task: review forwarding and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A070. Review

• Task: describe recovery path and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A071. Trust

• Task: verify fingerprint and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A072. Security

• Task: evaluate configuration and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A073. SSH

• Task: justify risk and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A074. Review

• Task: explain error path and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A075. Trust

• Task: classify log line and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A076. Security

• Task: document trust model and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A077. SSH

• Task: plan rotation and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A078. Review

• Task: restrict access and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A079. Trust

• Task: review forwarding and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A080. Security

• Task: describe recovery path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.