Classification

This document does not invent an official OpenSSH or SSH core certificate. SSH skill is relevant in Linux, cloud, DevOps, SRE and security exams, but this workshop treats SSH as a practical core capability and not as a replacement for vendor material.

Important for this workshop:

• OpenSSH manpages and RFC 4251 through 4254 form the technical foundation.
• OpenSSH certificates are technical authentication artifacts, not vendor certificates for people.
• Exam alignment comes through tasks about keys, host-key trust, configuration, debugging, bastions, forwarding and security.

Competency Mapping

Preparation Without Certification Claims

1. Read OpenSSH manpages for ssh, sshd, ssh_config, sshd_config and ssh-keygen.
2. Practice test keys, fingerprints, known_hosts, CA signing, KRL and configuration evaluation locally.
3. Support decisions with commands and logs, not assertions only.
4. Check vendor exams separately against their current objectives.

Sources and References

• OpenSSH Manual Pages
• OpenSSH Release Notes
• ssh(1) OpenBSD Manual
• sshd(8) OpenBSD Manual
• ssh_config(5) OpenBSD Manual
• sshd_config(5) OpenBSD Manual
• ssh-keygen(1) OpenBSD Manual
• RFC 4251 SSH Protocol Architecture
• RFC 4252 SSH Authentication Protocol
• RFC 4253 SSH Transport Layer Protocol

Review Checklist for Certificate Preparation

• 01. document host-key trust: Record the affected host, user, key, configuration and risk.
• 02. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 03. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 04. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 05. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 06. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 07. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 08. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 09. keep certificate validity short: Record the affected host, user, key, configuration and risk.
• 10. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
• 11. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
• 12. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
• 13. document host-key trust: Record the affected host, user, key, configuration and risk.
• 14. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 15. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 16. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 17. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 18. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 19. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 20. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 21. keep certificate validity short: Record the affected host, user, key, configuration and risk.
• 22. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
• 23. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
• 24. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
• 25. document host-key trust: Record the affected host, user, key, configuration and risk.
• 26. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 27. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 28. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 29. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 30. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 31. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 32. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 33. keep certificate validity short: Record the affected host, user, key, configuration and risk.
• 34. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
• 35. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
• 36. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
• 37. document host-key trust: Record the affected host, user, key, configuration and risk.
• 38. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 39. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 40. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.

Practice Appendix: Certificate Preparation

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSH client tools, test keys and sample configurations.

A001. OpenSSH

• Task: verify fingerprint and connect the observation explicitly to OpenSSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A002. RFC

• Task: evaluate configuration and connect the observation explicitly to RFC.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A003. Host Keys

• Task: justify risk and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A004. Certificates

• Task: explain error path and connect the observation explicitly to Certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A005. Security

• Task: classify log line and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A006. OpenSSH

• Task: document trust model and connect the observation explicitly to OpenSSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A007. RFC

• Task: plan rotation and connect the observation explicitly to RFC.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A008. Host Keys

• Task: restrict access and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A009. Certificates

• Task: review forwarding and connect the observation explicitly to Certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A010. Security

• Task: describe recovery path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A011. OpenSSH

• Task: verify fingerprint and connect the observation explicitly to OpenSSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A012. RFC

• Task: evaluate configuration and connect the observation explicitly to RFC.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A013. Host Keys

• Task: justify risk and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A014. Certificates

• Task: explain error path and connect the observation explicitly to Certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A015. Security

• Task: classify log line and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A016. OpenSSH

• Task: document trust model and connect the observation explicitly to OpenSSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A017. RFC

• Task: plan rotation and connect the observation explicitly to RFC.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A018. Host Keys

• Task: restrict access and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A019. Certificates

• Task: review forwarding and connect the observation explicitly to Certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A020. Security

• Task: describe recovery path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A021. OpenSSH

• Task: verify fingerprint and connect the observation explicitly to OpenSSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A022. RFC

• Task: evaluate configuration and connect the observation explicitly to RFC.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A023. Host Keys

• Task: justify risk and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A024. Certificates

• Task: explain error path and connect the observation explicitly to Certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A025. Security

• Task: classify log line and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A026. OpenSSH

• Task: document trust model and connect the observation explicitly to OpenSSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A027. RFC

• Task: plan rotation and connect the observation explicitly to RFC.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A028. Host Keys

• Task: restrict access and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A029. Certificates

• Task: review forwarding and connect the observation explicitly to Certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A030. Security

• Task: describe recovery path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A031. OpenSSH

• Task: verify fingerprint and connect the observation explicitly to OpenSSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A032. RFC

• Task: evaluate configuration and connect the observation explicitly to RFC.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A033. Host Keys

• Task: justify risk and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A034. Certificates

• Task: explain error path and connect the observation explicitly to Certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A035. Security

• Task: classify log line and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A036. OpenSSH

• Task: document trust model and connect the observation explicitly to OpenSSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A037. RFC

• Task: plan rotation and connect the observation explicitly to RFC.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A038. Host Keys

• Task: restrict access and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A039. Certificates

• Task: review forwarding and connect the observation explicitly to Certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A040. Security

• Task: describe recovery path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A041. OpenSSH

• Task: verify fingerprint and connect the observation explicitly to OpenSSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A042. RFC

• Task: evaluate configuration and connect the observation explicitly to RFC.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A043. Host Keys

• Task: justify risk and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A044. Certificates

• Task: explain error path and connect the observation explicitly to Certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A045. Security

• Task: classify log line and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A046. OpenSSH

• Task: document trust model and connect the observation explicitly to OpenSSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A047. RFC

• Task: plan rotation and connect the observation explicitly to RFC.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A048. Host Keys

• Task: restrict access and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A049. Certificates

• Task: review forwarding and connect the observation explicitly to Certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A050. Security

• Task: describe recovery path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A051. OpenSSH

• Task: verify fingerprint and connect the observation explicitly to OpenSSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A052. RFC

• Task: evaluate configuration and connect the observation explicitly to RFC.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A053. Host Keys

• Task: justify risk and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A054. Certificates

• Task: explain error path and connect the observation explicitly to Certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A055. Security

• Task: classify log line and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A056. OpenSSH

• Task: document trust model and connect the observation explicitly to OpenSSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A057. RFC

• Task: plan rotation and connect the observation explicitly to RFC.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A058. Host Keys

• Task: restrict access and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A059. Certificates

• Task: review forwarding and connect the observation explicitly to Certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A060. Security

• Task: describe recovery path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A061. OpenSSH

• Task: verify fingerprint and connect the observation explicitly to OpenSSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A062. RFC

• Task: evaluate configuration and connect the observation explicitly to RFC.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A063. Host Keys

• Task: justify risk and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A064. Certificates

• Task: explain error path and connect the observation explicitly to Certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A065. Security

• Task: classify log line and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A066. OpenSSH

• Task: document trust model and connect the observation explicitly to OpenSSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A067. RFC

• Task: plan rotation and connect the observation explicitly to RFC.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A068. Host Keys

• Task: restrict access and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A069. Certificates

• Task: review forwarding and connect the observation explicitly to Certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A070. Security

• Task: describe recovery path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A071. OpenSSH

• Task: verify fingerprint and connect the observation explicitly to OpenSSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A072. RFC

• Task: evaluate configuration and connect the observation explicitly to RFC.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A073. Host Keys

• Task: justify risk and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A074. Certificates

• Task: explain error path and connect the observation explicitly to Certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A075. Security

• Task: classify log line and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A076. OpenSSH

• Task: document trust model and connect the observation explicitly to OpenSSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A077. RFC

• Task: plan rotation and connect the observation explicitly to RFC.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A078. Host Keys

• Task: restrict access and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A079. Certificates

• Task: review forwarding and connect the observation explicitly to Certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A080. Security

• Task: describe recovery path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.