Concepts: SSH · SSH · Orthevs Wiki

Target State

You should not treat SSH as a mere login command, but as a trust, authentication and transport model. Host-key verification, private-key protection, clear client and server configuration, controlled forwarding and auditable operations decisions are the core concerns.

Focus

Host Keys
User Keys
CA
Certificates
Agent
Forwarding
TOFU

Core Terms

Term	Meaning
`SSH`	Secure Shell Protocol for secure remote login and other network services over insecure networks.
`OpenSSH`	Free SSH implementation with client, server, key tools, agent, SFTP and configuration formats.
`ssh`	Client program for login, remote commands, port forwarding and configuration evaluation.
`sshd`	Server daemon that accepts connections and handles key exchange, authentication, commands and data channels.
`Host Key`	Server key identity; clients verify it through `known_hosts` or host certificates.
`User Key`	User key pair for public-key authentication.
`known_hosts`	Client-side trust database for host keys and CA entries.
`authorized_keys`	Server-side list of allowed public keys, optionally with per-key restrictions.
`ssh_config`	Client configuration with Host blocks, identities, ProxyJump, forwarding and security options.
`sshd_config`	Server configuration with authentication, host keys, subsystems, Match blocks and access rules.
`Trust on First Use`	Trust model where a host key is consciously verified on first contact and stored afterwards.
`Fingerprint`	Short representation of a public key used for verification, inventory and rotation.
`ssh-agent`	Local agent that holds decrypted keys and performs signatures without exposing private keys.
`Agent Forwarding`	Forwarding of the agent socket to a remote host; useful but high-risk.
`ProxyJump`	OpenSSH mechanism for connections through a bastion host without copying private keys onto the jump host.
`Port Forwarding`	Forwarding local, remote or dynamic TCP ports through the SSH channel.
`SFTP`	SSH-based file transfer protocol and OpenSSH subsystem.
`SSH Certificate`	OpenSSH certificate for user or host keys, signed by an SSH CA with principals, validity and options.
`KRL`	Key revocation list for revoked keys or certificates.
`FIDO2/Security Key`	Hardware-backed key type in OpenSSH, dependent on client, token and platform support.

Reference Commands

# Version and effective client config
ssh -V
ssh -G -F ./client/ssh_config lab-target

# Key generation and inspection
ssh-keygen -t ed25519 -a 64 -f ./work/keys/user_ed25519 -C workshop@example.invalid
ssh-keygen -y -f ./work/keys/user_ed25519 > ./work/keys/user_ed25519.pub
ssh-keygen -lf ./work/keys/user_ed25519.pub

# Host-key and known_hosts work
ssh-keygen -F example.internal -f ./known_hosts
ssh-keygen -R example.internal -f ./known_hosts
ssh-keygen -H -f ./known_hosts

# Certificate model
ssh-keygen -t ed25519 -f ./work/ca/user_ca -C user-ca@example.invalid
ssh-keygen -s ./work/ca/user_ca -I lab-user -n workshop -V +1d ./work/keys/user_ed25519.pub
ssh-keygen -Lf ./work/keys/user_ed25519-cert.pub

# Debug commands for real labs
ssh -vvv lab-target true
sftp lab-target
ssh -N -L 127.0.0.1:15432:db.internal:5432 bastion

Working Model

Define target host, user, trust model and authentication method.
Verify host-key trust through fingerprint, known_hosts, host certificate or CA entry.
Protect private keys with permissions, passphrase, agent lifetime and secret rules.
Separate client configuration, server configuration, bastion paths and forwarding rules.
Support changes with ssh -G, ssh-keygen -l/-L, test configurations and log analysis.
Document recovery: key rotation, known-hosts repair, KRL, CA rotation, break glass and incident response.

Typical Decisions

Decision	Review Question	Risk if Wrong
Host-key model	Is TOFU, pinning or host CA used?	man-in-the-middle is not detected
User key	Which key type, passphrase and rotation are required?	key leakage grants persistent access
Agent	Is agent lifetime or forwarding allowed?	remote system can abuse signatures
Bastion	Do private keys stay on the client?	key copies on jump hosts increase impact
Forwarding	Which ports, bind addresses and targets are allowed?	tunnels bypass segmentation and controls
Certificates	Who signs, for how long and with which principals?	access rights are too broad or too long-lived

Diagrams and Models

The diagrams are text-based so they remain versionable and reviewable without extra tooling.

Client ssh(1) -> TCP -> sshd(8)
     |                 |
     | transport KEX   | host key proves server identity
     | user auth       | public key, certificate or other method
     | connection      | session, command, sftp, forwarding channels

Trust Chain
  user private key -> public key / user certificate -> authorized_keys or TrustedUserCAKeys
  host private key -> host public key / host certificate -> known_hosts or @cert-authority

Bastion Path
  laptop --ssh--> bastion --direct tcp forwarding--> target
  private key stays on laptop; ProxyJump carries bytes, not key material

Operations Notes

OpenSSH options differ between client, server and distributions; check local manpages and release notes.
Host-key verification is not a convenience detail, but the foundation against man-in-the-middle attacks.
New designs should consciously compare scp with SFTP or rsync; OpenSSH itself documents limitations of the old scp protocol.
Agent forwarding is not a default for bastions, but an exception that must be documented deliberately.
SSH certificates do not replace clean CA processes, short validity, revocation and logging.

Sources and References

Review Checklist for Concepts

01. document host-key trust: Record the affected host, user, key, configuration and risk.
02. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
03. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
04. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
05. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
06. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
07. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
08. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
09. keep certificate validity short: Record the affected host, user, key, configuration and risk.
10. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
11. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
12. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
13. document host-key trust: Record the affected host, user, key, configuration and risk.
14. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
15. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
16. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
17. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
18. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
19. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
20. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
21. keep certificate validity short: Record the affected host, user, key, configuration and risk.
22. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
23. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
24. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
25. document host-key trust: Record the affected host, user, key, configuration and risk.
26. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
27. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
28. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
29. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
30. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
31. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
32. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
33. keep certificate validity short: Record the affected host, user, key, configuration and risk.
34. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
35. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
36. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
37. document host-key trust: Record the affected host, user, key, configuration and risk.
38. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
39. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
40. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
41. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
42. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
43. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
44. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
45. keep certificate validity short: Record the affected host, user, key, configuration and risk.
46. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
47. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
48. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
49. document host-key trust: Record the affected host, user, key, configuration and risk.
50. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
51. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
52. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.

Practice Appendix: Concepts

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSH client tools, test keys and sample configurations.

A001. Host Keys

Task: verify fingerprint and connect the observation explicitly to Host Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A002. User Keys

Task: evaluate configuration and connect the observation explicitly to User Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A003. CA

Task: justify risk and connect the observation explicitly to CA.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A004. Certificates

Task: explain error path and connect the observation explicitly to Certificates.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A005. Agent

Task: classify log line and connect the observation explicitly to Agent.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A006. Forwarding

Task: document trust model and connect the observation explicitly to Forwarding.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A007. TOFU

Task: plan rotation and connect the observation explicitly to TOFU.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A008. Host Keys

Task: restrict access and connect the observation explicitly to Host Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A009. User Keys

Task: review forwarding and connect the observation explicitly to User Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A010. CA

Task: describe recovery path and connect the observation explicitly to CA.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A011. Certificates

Task: verify fingerprint and connect the observation explicitly to Certificates.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A012. Agent

Task: evaluate configuration and connect the observation explicitly to Agent.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A013. Forwarding

Task: justify risk and connect the observation explicitly to Forwarding.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A014. TOFU

Task: explain error path and connect the observation explicitly to TOFU.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A015. Host Keys

Task: classify log line and connect the observation explicitly to Host Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A016. User Keys

Task: document trust model and connect the observation explicitly to User Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A017. CA

Task: plan rotation and connect the observation explicitly to CA.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A018. Certificates

Task: restrict access and connect the observation explicitly to Certificates.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A019. Agent

Task: review forwarding and connect the observation explicitly to Agent.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A020. Forwarding

Task: describe recovery path and connect the observation explicitly to Forwarding.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A021. TOFU

Task: verify fingerprint and connect the observation explicitly to TOFU.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A022. Host Keys

Task: evaluate configuration and connect the observation explicitly to Host Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A023. User Keys

Task: justify risk and connect the observation explicitly to User Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A024. CA

Task: explain error path and connect the observation explicitly to CA.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A025. Certificates

Task: classify log line and connect the observation explicitly to Certificates.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A026. Agent

Task: document trust model and connect the observation explicitly to Agent.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A027. Forwarding

Task: plan rotation and connect the observation explicitly to Forwarding.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A028. TOFU

Task: restrict access and connect the observation explicitly to TOFU.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A029. Host Keys

Task: review forwarding and connect the observation explicitly to Host Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A030. User Keys

Task: describe recovery path and connect the observation explicitly to User Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A031. CA

Task: verify fingerprint and connect the observation explicitly to CA.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A032. Certificates

Task: evaluate configuration and connect the observation explicitly to Certificates.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A033. Agent

Task: justify risk and connect the observation explicitly to Agent.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A034. Forwarding

Task: explain error path and connect the observation explicitly to Forwarding.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A035. TOFU

Task: classify log line and connect the observation explicitly to TOFU.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A036. Host Keys

Task: document trust model and connect the observation explicitly to Host Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A037. User Keys

Task: plan rotation and connect the observation explicitly to User Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A038. CA

Task: restrict access and connect the observation explicitly to CA.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A039. Certificates

Task: review forwarding and connect the observation explicitly to Certificates.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A040. Agent

Task: describe recovery path and connect the observation explicitly to Agent.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A041. Forwarding

Task: verify fingerprint and connect the observation explicitly to Forwarding.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A042. TOFU

Task: evaluate configuration and connect the observation explicitly to TOFU.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A043. Host Keys

Task: justify risk and connect the observation explicitly to Host Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A044. User Keys

Task: explain error path and connect the observation explicitly to User Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A045. CA

Task: classify log line and connect the observation explicitly to CA.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A046. Certificates

Task: document trust model and connect the observation explicitly to Certificates.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A047. Agent

Task: plan rotation and connect the observation explicitly to Agent.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A048. Forwarding

Task: restrict access and connect the observation explicitly to Forwarding.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A049. TOFU

Task: review forwarding and connect the observation explicitly to TOFU.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A050. Host Keys

Task: describe recovery path and connect the observation explicitly to Host Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A051. User Keys

Task: verify fingerprint and connect the observation explicitly to User Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A052. CA

Task: evaluate configuration and connect the observation explicitly to CA.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A053. Certificates

Task: justify risk and connect the observation explicitly to Certificates.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A054. Agent

Task: explain error path and connect the observation explicitly to Agent.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A055. Forwarding

Task: classify log line and connect the observation explicitly to Forwarding.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A056. TOFU

Task: document trust model and connect the observation explicitly to TOFU.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A057. Host Keys

Task: plan rotation and connect the observation explicitly to Host Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A058. User Keys

Task: restrict access and connect the observation explicitly to User Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A059. CA

Task: review forwarding and connect the observation explicitly to CA.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A060. Certificates

Task: describe recovery path and connect the observation explicitly to Certificates.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A061. Agent

Task: verify fingerprint and connect the observation explicitly to Agent.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A062. Forwarding

Task: evaluate configuration and connect the observation explicitly to Forwarding.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A063. TOFU

Task: justify risk and connect the observation explicitly to TOFU.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A064. Host Keys

Task: explain error path and connect the observation explicitly to Host Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A065. User Keys

Task: classify log line and connect the observation explicitly to User Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A066. CA

Task: document trust model and connect the observation explicitly to CA.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A067. Certificates

Task: plan rotation and connect the observation explicitly to Certificates.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A068. Agent

Task: restrict access and connect the observation explicitly to Agent.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A069. Forwarding

Task: review forwarding and connect the observation explicitly to Forwarding.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A070. TOFU

Task: describe recovery path and connect the observation explicitly to TOFU.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A071. Host Keys

Task: verify fingerprint and connect the observation explicitly to Host Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A072. User Keys

Task: evaluate configuration and connect the observation explicitly to User Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A073. CA

Task: justify risk and connect the observation explicitly to CA.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A074. Certificates

Task: explain error path and connect the observation explicitly to Certificates.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A075. Agent

Task: classify log line and connect the observation explicitly to Agent.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A076. Forwarding

Task: document trust model and connect the observation explicitly to Forwarding.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A077. TOFU

Task: plan rotation and connect the observation explicitly to TOFU.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A078. Host Keys

Task: restrict access and connect the observation explicitly to Host Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A079. User Keys

Task: review forwarding and connect the observation explicitly to User Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A080. CA

Task: describe recovery path and connect the observation explicitly to CA.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A081. Certificates

Task: verify fingerprint and connect the observation explicitly to Certificates.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A082. Agent

Task: evaluate configuration and connect the observation explicitly to Agent.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A083. Forwarding

Task: justify risk and connect the observation explicitly to Forwarding.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A084. TOFU

Task: explain error path and connect the observation explicitly to TOFU.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A085. Host Keys

Task: classify log line and connect the observation explicitly to Host Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A086. User Keys

Task: document trust model and connect the observation explicitly to User Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A087. CA

Task: plan rotation and connect the observation explicitly to CA.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A088. Certificates

Task: restrict access and connect the observation explicitly to Certificates.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A089. Agent

Task: review forwarding and connect the observation explicitly to Agent.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A090. Forwarding

Task: describe recovery path and connect the observation explicitly to Forwarding.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A091. TOFU

Task: verify fingerprint and connect the observation explicitly to TOFU.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A092. Host Keys

Task: evaluate configuration and connect the observation explicitly to Host Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.