Orthevs Orthevs Fathom new horizons
Menu

Workshop wiki · English

SSH Advanced Security: Solution (EN)

Scope: Hardening, Algorithmuspflege, FIDO2, KRL, Forensik, Logging und Incident Response.

Content language · EnglishSize · 56.6 KBassessments/04-advanced-security-ssh-solution-EN.md
Workshop examples as ZIP files
Learning progress in the web app

Mark chapters as read, view reading progress and check off practice modules after enabling the optional web app. Workshop progress is calculated from chapters across all document pages. Your choices stay on this device; there is no account or server sync. Installation is not required. Withdrawing your choice in Privacy settings deletes the progress.

Reading progress0%
0%
0 / 6 chapters read
Other language versionGerman ↗Greek ↗

SSH Advanced Security: Solution (EN)

Scope: Hardening, Algorithmuspflege, FIDO2, KRL, Forensik, Logging und Incident Response.

Format

  • written questions
  • practical configuration task
  • review of a risky SSH scenario
  • short operations and security assessment
01 / 06

Expected Answer Profile

A good answer explains trust, authentication, file and agent risks with concrete commands, fingerprints and configuration excerpts.

02 / 06

Questions

Solution 01

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for explain SSH protocol layers.

Solution 02

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for distinguish OpenSSH client and server.

Solution 03

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for verify host-key trust.

Solution 04

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for generate and protect user keys.

Solution 05

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for review permissions for .ssh``.

Solution 06

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for debug public-key authentication.

Solution 07

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for structure ssh_config with Host blocks.

Solution 08

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for review sshd_config safely.

Solution 09

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for design ProxyJump and bastion paths.

Solution 10

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for control port forwarding.

Solution 11

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for classify SFTP and safe file transfer.

Solution 12

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for use ssh-agent safely.

Solution 13

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for justify or reject agent forwarding.

Solution 14

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for model OpenSSH certificates and CA trust.

Solution 15

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for explain KRL and revocation.

Solution 16

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for classify FIDO2 keys.

Solution 17

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for analyze logging and auth events.

Solution 18

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for weigh hardening options.

Solution 19

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for run incident response for key leakage.

Solution 20

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for test client and server configuration.

Solution 21

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for plan recovery for host-key rotation.

Solution 22

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for explain SSH protocol layers.

Solution 23

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for distinguish OpenSSH client and server.

Solution 24

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for verify host-key trust.

Solution 25

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for generate and protect user keys.

Solution 26

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for review permissions for .ssh``.

Solution 27

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for debug public-key authentication.

Solution 28

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for structure ssh_config with Host blocks.

Solution 29

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for review sshd_config safely.

Solution 30

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for design ProxyJump and bastion paths.

Solution 31

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for control port forwarding.

Solution 32

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for classify SFTP and safe file transfer.

Solution 33

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for use ssh-agent safely.

Solution 34

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for justify or reject agent forwarding.

Solution 35

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for model OpenSSH certificates and CA trust.

Solution 36

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for explain KRL and revocation.

Solution 37

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for classify FIDO2 keys.

Solution 38

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for analyze logging and auth events.

Solution 39

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for weigh hardening options.

Solution 40

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for run incident response for key leakage.

Solution 41

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for test client and server configuration.

Solution 42

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for plan recovery for host-key rotation.

Solution 43

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for explain SSH protocol layers.

Solution 44

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for distinguish OpenSSH client and server.

Solution 45

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for verify host-key trust.

Solution 46

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for generate and protect user keys.

Solution 47

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for review permissions for .ssh``.

Solution 48

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for debug public-key authentication.

03 / 06

Practical Task

Create an SSH client configuration with bastion alias, IdentityFile, known-hosts file and controlled forwarding. Add a hardening review for a server-side sample configuration.

04 / 06

Review Checklist for Advanced Security

  • 01. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 02. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
  • 03. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
  • 04. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
  • 05. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
  • 06. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
  • 07. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
  • 08. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
  • 09. keep certificate validity short: Record the affected host, user, key, configuration and risk.
  • 10. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
  • 11. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
  • 12. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
  • 13. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 14. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
  • 15. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
  • 16. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
  • 17. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
  • 18. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
  • 19. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
  • 20. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
  • 21. keep certificate validity short: Record the affected host, user, key, configuration and risk.
  • 22. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
  • 23. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
  • 24. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
  • 25. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 26. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
  • 27. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
  • 28. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
  • 29. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
  • 30. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
  • 31. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
  • 32. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
  • 33. keep certificate validity short: Record the affected host, user, key, configuration and risk.
  • 34. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
  • 35. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
  • 36. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
  • 37. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 38. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
  • 39. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
  • 40. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
  • 41. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
  • 42. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
  • 43. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
  • 44. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
  • 45. keep certificate validity short: Record the affected host, user, key, configuration and risk.
05 / 06

Practice Appendix: Advanced Security

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSH client tools, test keys and sample configurations.

A001. SSH

  • Task: verify fingerprint and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A002. Review

  • Task: evaluate configuration and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A003. Trust

  • Task: justify risk and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A004. Security

  • Task: explain error path and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A005. SSH

  • Task: classify log line and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A006. Review

  • Task: document trust model and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A007. Trust

  • Task: plan rotation and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A008. Security

  • Task: restrict access and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A009. SSH

  • Task: review forwarding and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A010. Review

  • Task: describe recovery path and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A011. Trust

  • Task: verify fingerprint and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A012. Security

  • Task: evaluate configuration and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A013. SSH

  • Task: justify risk and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A014. Review

  • Task: explain error path and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A015. Trust

  • Task: classify log line and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A016. Security

  • Task: document trust model and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A017. SSH

  • Task: plan rotation and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A018. Review

  • Task: restrict access and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A019. Trust

  • Task: review forwarding and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A020. Security

  • Task: describe recovery path and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A021. SSH

  • Task: verify fingerprint and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A022. Review

  • Task: evaluate configuration and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A023. Trust

  • Task: justify risk and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A024. Security

  • Task: explain error path and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A025. SSH

  • Task: classify log line and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A026. Review

  • Task: document trust model and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A027. Trust

  • Task: plan rotation and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A028. Security

  • Task: restrict access and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A029. SSH

  • Task: review forwarding and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A030. Review

  • Task: describe recovery path and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A031. Trust

  • Task: verify fingerprint and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A032. Security

  • Task: evaluate configuration and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A033. SSH

  • Task: justify risk and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A034. Review

  • Task: explain error path and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A035. Trust

  • Task: classify log line and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A036. Security

  • Task: document trust model and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A037. SSH

  • Task: plan rotation and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A038. Review

  • Task: restrict access and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A039. Trust

  • Task: review forwarding and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A040. Security

  • Task: describe recovery path and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A041. SSH

  • Task: verify fingerprint and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A042. Review

  • Task: evaluate configuration and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A043. Trust

  • Task: justify risk and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A044. Security

  • Task: explain error path and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A045. SSH

  • Task: classify log line and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A046. Review

  • Task: document trust model and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A047. Trust

  • Task: plan rotation and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A048. Security

  • Task: restrict access and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A049. SSH

  • Task: review forwarding and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A050. Review

  • Task: describe recovery path and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A051. Trust

  • Task: verify fingerprint and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A052. Security

  • Task: evaluate configuration and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A053. SSH

  • Task: justify risk and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A054. Review

  • Task: explain error path and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A055. Trust

  • Task: classify log line and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A056. Security

  • Task: document trust model and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A057. SSH

  • Task: plan rotation and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A058. Review

  • Task: restrict access and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A059. Trust

  • Task: review forwarding and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A060. Security

  • Task: describe recovery path and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A061. SSH

  • Task: verify fingerprint and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A062. Review

  • Task: evaluate configuration and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A063. Trust

  • Task: justify risk and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A064. Security

  • Task: explain error path and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A065. SSH

  • Task: classify log line and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A066. Review

  • Task: document trust model and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A067. Trust

  • Task: plan rotation and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A068. Security

  • Task: restrict access and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A069. SSH

  • Task: review forwarding and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A070. Review

  • Task: describe recovery path and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A071. Trust

  • Task: verify fingerprint and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A072. Security

  • Task: evaluate configuration and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A073. SSH

  • Task: justify risk and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A074. Review

  • Task: explain error path and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A075. Trust

  • Task: classify log line and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A076. Security

  • Task: document trust model and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A077. SSH

  • Task: plan rotation and connect the observation explicitly to SSH.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A078. Review

  • Task: restrict access and connect the observation explicitly to Review.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A079. Trust

  • Task: review forwarding and connect the observation explicitly to Trust.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A080. Security

  • Task: describe recovery path and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
06 / 06

SSH · Orthevs Academy

31 modules as one continuous learning path.

The sequence remains unchanged: from the lab skeleton through technical foundations and operating models to final troubleshooting. The technical directory names are deliberately preserved.

Practice modules

Orthevs as an app

Install Orthevs

The Orthevs web app can be installed on supported mobile devices and desktop browsers.

iPhone and iPad

Open Orthevs in Safari. Tap Share, then Add to Home Screen. Enable Open as Web App if offered, then tap Add.

Android

For the web app, open the browser menu and choose Install app or Add to Home screen. Confirm the installation.

Desktop browser

Open the browser menu or the install icon in the address bar, then choose Install app or Add to Dock.

Web app installation depends on your browser. If no install prompt appears, follow the browser steps shown above.