Curriculum: SSH
This curriculum structures an SSH workshop from the first safe login to advanced operations with bastion hosts, certificates, hardening and incident response.
Curriculum Goal
After the full series you can read OpenSSH configurations, design safe access paths, manage keys and certificates, analyze failures and justify SSH risks in operations.
Teaching Model
The workshop follows a repeating cycle:
Understand -> Connect -> Verify -> Debug -> Harden -> Document
| Step | Goal | Typical Activity |
|---|---|---|
| Concept | understand protocol layer and trust boundary | transport, auth, connection, host key |
| Connection | select client config and key | ssh -G, Host block, IdentityFile |
| Verification | check fingerprint, known_hosts or CA | ssh-keygen -lf, known-hosts review |
| Diagnosis | classify auth and network errors | ssh -vvv, log analysis, permissions |
| Hardening | reduce attack surface | PasswordAuthentication, PermitRootLogin, forwarding rules |
| Documentation | record operations and recovery | runbook, rotation, KRL, break glass |
Level Structure
| Level | Focus | Outcome |
|---|---|---|
| Fundamentals | Protokollmodell, erster Login, Host Keys, Public Keys, Dateirechte und sichere Grundbefehle | You can explain, locally check and operationally review the included SSH patterns. |
| Intermediate | Client- und Serverkonfiguration, Agent, Debugging, Forwarding, SFTP und Auth-Fehler | You can explain, locally check and operationally review the included SSH patterns. |
| Professional | Bastion Hosts, ProxyJump, Multiplexing, SSH-Zertifikate, Git/CI und Betriebsmodelle | You can explain, locally check and operationally review the included SSH patterns. |
| Advanced Security | Hardening, Algorithmuspflege, FIDO2, KRL, Forensik, Logging und Incident Response | You can explain, locally check and operationally review the included SSH patterns. |
Roles and Learning Paths
- Developers focus on Git over SSH, client configuration, deploy keys and CI.
- Administrators focus on sshd, user access, permissions, logs and rotation.
- DevOps and SRE roles focus on bastions, break glass, automation and observability.
- Security engineers focus on host-key trust, agent risks, certificates, KRL and incident response.
Lab Strategy
All labs run locally without production credentials and without real remote connections. They generate test keys, sample configurations, fingerprints, certificates and evidence files below work/.
Assessment Rubric
| Criterion | Basic | Good | Excellent |
|---|---|---|---|
| Correctness | configuration is syntactically understandable | fingerprints and options are checked | error and recovery paths are documented |
| Security | no private keys in repo | host-key and agent risks are reviewed | rotation, KRL or CA process is described |
| Operations | manual use is possible | logs and runbooks exist | automation has clear boundaries |
| Architecture | single-host connection is understood | bastion and forwarding are separated | CA and break-glass model is reviewable |
Sources and References
Review Checklist for Curriculum
- 01. document host-key trust: Record the affected host, user, key, configuration and risk.
- 02. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
- 03. check permissions for keys and
.ssh: Record the affected host, user, key, configuration and risk. - 04. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
- 05. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
- 06. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
- 07. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
- 08. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
- 09. keep certificate validity short: Record the affected host, user, key, configuration and risk.
- 10. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
- 11. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
- 12. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
- 13. document host-key trust: Record the affected host, user, key, configuration and risk.
- 14. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
- 15. check permissions for keys and
.ssh: Record the affected host, user, key, configuration and risk. - 16. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
- 17. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
- 18. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
- 19. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
- 20. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
- 21. keep certificate validity short: Record the affected host, user, key, configuration and risk.
- 22. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
- 23. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
- 24. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
- 25. document host-key trust: Record the affected host, user, key, configuration and risk.
- 26. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
- 27. check permissions for keys and
.ssh: Record the affected host, user, key, configuration and risk. - 28. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
- 29. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
- 30. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
- 31. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
- 32. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
- 33. keep certificate validity short: Record the affected host, user, key, configuration and risk.
- 34. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
- 35. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
- 36. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
- 37. document host-key trust: Record the affected host, user, key, configuration and risk.
- 38. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
- 39. check permissions for keys and
.ssh: Record the affected host, user, key, configuration and risk. - 40. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
- 41. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
- 42. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
- 43. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
- 44. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
- 45. keep certificate validity short: Record the affected host, user, key, configuration and risk.
- 46. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
- 47. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
- 48. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
- 49. document host-key trust: Record the affected host, user, key, configuration and risk.
- 50. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
- 51. check permissions for keys and
.ssh: Record the affected host, user, key, configuration and risk. - 52. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
- 53. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
- 54. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
- 55. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
- 56. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
- 57. keep certificate validity short: Record the affected host, user, key, configuration and risk.
- 58. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
- 59. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
- 60. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
- 61. document host-key trust: Record the affected host, user, key, configuration and risk.
- 62. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
- 63. check permissions for keys and
.ssh: Record the affected host, user, key, configuration and risk. - 64. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
Practice Appendix: Curriculum
This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSH client tools, test keys and sample configurations.
A001. Protocol
- Task: verify fingerprint and connect the observation explicitly to
Protocol. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A002. Host Keys
- Task: evaluate configuration and connect the observation explicitly to
Host Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A003. User Keys
- Task: justify risk and connect the observation explicitly to
User Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A004. Bastion
- Task: explain error path and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A005. Forwarding
- Task: classify log line and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A006. Certificates
- Task: document trust model and connect the observation explicitly to
Certificates. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A007. Logging
- Task: plan rotation and connect the observation explicitly to
Logging. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A008. Security
- Task: restrict access and connect the observation explicitly to
Security. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A009. Protocol
- Task: review forwarding and connect the observation explicitly to
Protocol. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A010. Host Keys
- Task: describe recovery path and connect the observation explicitly to
Host Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A011. User Keys
- Task: verify fingerprint and connect the observation explicitly to
User Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A012. Bastion
- Task: evaluate configuration and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A013. Forwarding
- Task: justify risk and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A014. Certificates
- Task: explain error path and connect the observation explicitly to
Certificates. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A015. Logging
- Task: classify log line and connect the observation explicitly to
Logging. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A016. Security
- Task: document trust model and connect the observation explicitly to
Security. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A017. Protocol
- Task: plan rotation and connect the observation explicitly to
Protocol. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A018. Host Keys
- Task: restrict access and connect the observation explicitly to
Host Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A019. User Keys
- Task: review forwarding and connect the observation explicitly to
User Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A020. Bastion
- Task: describe recovery path and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A021. Forwarding
- Task: verify fingerprint and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A022. Certificates
- Task: evaluate configuration and connect the observation explicitly to
Certificates. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A023. Logging
- Task: justify risk and connect the observation explicitly to
Logging. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A024. Security
- Task: explain error path and connect the observation explicitly to
Security. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A025. Protocol
- Task: classify log line and connect the observation explicitly to
Protocol. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A026. Host Keys
- Task: document trust model and connect the observation explicitly to
Host Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A027. User Keys
- Task: plan rotation and connect the observation explicitly to
User Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A028. Bastion
- Task: restrict access and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A029. Forwarding
- Task: review forwarding and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A030. Certificates
- Task: describe recovery path and connect the observation explicitly to
Certificates. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A031. Logging
- Task: verify fingerprint and connect the observation explicitly to
Logging. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A032. Security
- Task: evaluate configuration and connect the observation explicitly to
Security. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A033. Protocol
- Task: justify risk and connect the observation explicitly to
Protocol. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A034. Host Keys
- Task: explain error path and connect the observation explicitly to
Host Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A035. User Keys
- Task: classify log line and connect the observation explicitly to
User Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A036. Bastion
- Task: document trust model and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A037. Forwarding
- Task: plan rotation and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A038. Certificates
- Task: restrict access and connect the observation explicitly to
Certificates. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A039. Logging
- Task: review forwarding and connect the observation explicitly to
Logging. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A040. Security
- Task: describe recovery path and connect the observation explicitly to
Security. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A041. Protocol
- Task: verify fingerprint and connect the observation explicitly to
Protocol. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A042. Host Keys
- Task: evaluate configuration and connect the observation explicitly to
Host Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A043. User Keys
- Task: justify risk and connect the observation explicitly to
User Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A044. Bastion
- Task: explain error path and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A045. Forwarding
- Task: classify log line and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A046. Certificates
- Task: document trust model and connect the observation explicitly to
Certificates. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A047. Logging
- Task: plan rotation and connect the observation explicitly to
Logging. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A048. Security
- Task: restrict access and connect the observation explicitly to
Security. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A049. Protocol
- Task: review forwarding and connect the observation explicitly to
Protocol. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A050. Host Keys
- Task: describe recovery path and connect the observation explicitly to
Host Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A051. User Keys
- Task: verify fingerprint and connect the observation explicitly to
User Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A052. Bastion
- Task: evaluate configuration and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A053. Forwarding
- Task: justify risk and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A054. Certificates
- Task: explain error path and connect the observation explicitly to
Certificates. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A055. Logging
- Task: classify log line and connect the observation explicitly to
Logging. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A056. Security
- Task: document trust model and connect the observation explicitly to
Security. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A057. Protocol
- Task: plan rotation and connect the observation explicitly to
Protocol. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A058. Host Keys
- Task: restrict access and connect the observation explicitly to
Host Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A059. User Keys
- Task: review forwarding and connect the observation explicitly to
User Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A060. Bastion
- Task: describe recovery path and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A061. Forwarding
- Task: verify fingerprint and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A062. Certificates
- Task: evaluate configuration and connect the observation explicitly to
Certificates. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A063. Logging
- Task: justify risk and connect the observation explicitly to
Logging. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A064. Security
- Task: explain error path and connect the observation explicitly to
Security. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A065. Protocol
- Task: classify log line and connect the observation explicitly to
Protocol. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A066. Host Keys
- Task: document trust model and connect the observation explicitly to
Host Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A067. User Keys
- Task: plan rotation and connect the observation explicitly to
User Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A068. Bastion
- Task: restrict access and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A069. Forwarding
- Task: review forwarding and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A070. Certificates
- Task: describe recovery path and connect the observation explicitly to
Certificates. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A071. Logging
- Task: verify fingerprint and connect the observation explicitly to
Logging. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A072. Security
- Task: evaluate configuration and connect the observation explicitly to
Security. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A073. Protocol
- Task: justify risk and connect the observation explicitly to
Protocol. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A074. Host Keys
- Task: explain error path and connect the observation explicitly to
Host Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A075. User Keys
- Task: classify log line and connect the observation explicitly to
User Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A076. Bastion
- Task: document trust model and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A077. Forwarding
- Task: plan rotation and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A078. Certificates
- Task: restrict access and connect the observation explicitly to
Certificates. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A079. Logging
- Task: review forwarding and connect the observation explicitly to
Logging. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A080. Security
- Task: describe recovery path and connect the observation explicitly to
Security. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A081. Protocol
- Task: verify fingerprint and connect the observation explicitly to
Protocol. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A082. Host Keys
- Task: evaluate configuration and connect the observation explicitly to
Host Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A083. User Keys
- Task: justify risk and connect the observation explicitly to
User Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A084. Bastion
- Task: explain error path and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A085. Forwarding
- Task: classify log line and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A086. Certificates
- Task: document trust model and connect the observation explicitly to
Certificates. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A087. Logging
- Task: plan rotation and connect the observation explicitly to
Logging. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A088. Security
- Task: restrict access and connect the observation explicitly to
Security. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A089. Protocol
- Task: review forwarding and connect the observation explicitly to
Protocol. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A090. Host Keys
- Task: describe recovery path and connect the observation explicitly to
Host Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A091. User Keys
- Task: verify fingerprint and connect the observation explicitly to
User Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A092. Bastion
- Task: evaluate configuration and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A093. Forwarding
- Task: justify risk and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A094. Certificates
- Task: explain error path and connect the observation explicitly to
Certificates. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A095. Logging
- Task: classify log line and connect the observation explicitly to
Logging. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A096. Security
- Task: document trust model and connect the observation explicitly to
Security. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A097. Protocol
- Task: plan rotation and connect the observation explicitly to
Protocol. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A098. Host Keys
- Task: restrict access and connect the observation explicitly to
Host Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A099. User Keys
- Task: review forwarding and connect the observation explicitly to
User Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A100. Bastion
- Task: describe recovery path and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A101. Forwarding
- Task: verify fingerprint and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A102. Certificates
- Task: evaluate configuration and connect the observation explicitly to
Certificates. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A103. Logging
- Task: justify risk and connect the observation explicitly to
Logging. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A104. Security
- Task: explain error path and connect the observation explicitly to
Security. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A105. Protocol
- Task: classify log line and connect the observation explicitly to
Protocol. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A106. Host Keys
- Task: document trust model and connect the observation explicitly to
Host Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A107. User Keys
- Task: plan rotation and connect the observation explicitly to
User Keys. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A108. Bastion
- Task: restrict access and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A109. Forwarding
- Task: review forwarding and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A110. Certificates
- Task: describe recovery path and connect the observation explicitly to
Certificates. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A111. Logging
- Task: verify fingerprint and connect the observation explicitly to
Logging. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A112. Security
- Task: evaluate configuration and connect the observation explicitly to
Security. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.