Orthevs Orthevs Fathom new horizons
Menu

Workshop wiki · English

Curriculum: SSH

This curriculum structures an SSH workshop from the first safe login to advanced operations with bastion hosts, certificates, hardening and incident response.

Content language · EnglishSize · 69.9 KBdocs/curriculum-ssh-EN.md
Workshop examples as ZIP files
Learning progress in the web app

Mark chapters as read, view reading progress and check off practice modules after enabling the optional web app. Workshop progress is calculated from chapters across all document pages. Your choices stay on this device; there is no account or server sync. Installation is not required. Withdrawing your choice in Privacy settings deletes the progress.

Reading progress0%
0%
0 / 9 chapters read
Other language versionGerman ↗Greek ↗

Curriculum: SSH

This curriculum structures an SSH workshop from the first safe login to advanced operations with bastion hosts, certificates, hardening and incident response.

Curriculum Goal

After the full series you can read OpenSSH configurations, design safe access paths, manage keys and certificates, analyze failures and justify SSH risks in operations.

01 / 09

Teaching Model

The workshop follows a repeating cycle:

text
Understand -> Connect -> Verify -> Debug -> Harden -> Document
Step Goal Typical Activity
Concept understand protocol layer and trust boundary transport, auth, connection, host key
Connection select client config and key ssh -G, Host block, IdentityFile
Verification check fingerprint, known_hosts or CA ssh-keygen -lf, known-hosts review
Diagnosis classify auth and network errors ssh -vvv, log analysis, permissions
Hardening reduce attack surface PasswordAuthentication, PermitRootLogin, forwarding rules
Documentation record operations and recovery runbook, rotation, KRL, break glass
02 / 09

Level Structure

Level Focus Outcome
Fundamentals Protokollmodell, erster Login, Host Keys, Public Keys, Dateirechte und sichere Grundbefehle You can explain, locally check and operationally review the included SSH patterns.
Intermediate Client- und Serverkonfiguration, Agent, Debugging, Forwarding, SFTP und Auth-Fehler You can explain, locally check and operationally review the included SSH patterns.
Professional Bastion Hosts, ProxyJump, Multiplexing, SSH-Zertifikate, Git/CI und Betriebsmodelle You can explain, locally check and operationally review the included SSH patterns.
Advanced Security Hardening, Algorithmuspflege, FIDO2, KRL, Forensik, Logging und Incident Response You can explain, locally check and operationally review the included SSH patterns.
03 / 09

Roles and Learning Paths

  • Developers focus on Git over SSH, client configuration, deploy keys and CI.
  • Administrators focus on sshd, user access, permissions, logs and rotation.
  • DevOps and SRE roles focus on bastions, break glass, automation and observability.
  • Security engineers focus on host-key trust, agent risks, certificates, KRL and incident response.
04 / 09

Lab Strategy

All labs run locally without production credentials and without real remote connections. They generate test keys, sample configurations, fingerprints, certificates and evidence files below work/.

05 / 09

Assessment Rubric

Criterion Basic Good Excellent
Correctness configuration is syntactically understandable fingerprints and options are checked error and recovery paths are documented
Security no private keys in repo host-key and agent risks are reviewed rotation, KRL or CA process is described
Operations manual use is possible logs and runbooks exist automation has clear boundaries
Architecture single-host connection is understood bastion and forwarding are separated CA and break-glass model is reviewable
06 / 09

Sources and References

07 / 09

Review Checklist for Curriculum

  • 01. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 02. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
  • 03. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
  • 04. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
  • 05. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
  • 06. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
  • 07. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
  • 08. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
  • 09. keep certificate validity short: Record the affected host, user, key, configuration and risk.
  • 10. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
  • 11. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
  • 12. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
  • 13. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 14. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
  • 15. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
  • 16. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
  • 17. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
  • 18. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
  • 19. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
  • 20. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
  • 21. keep certificate validity short: Record the affected host, user, key, configuration and risk.
  • 22. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
  • 23. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
  • 24. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
  • 25. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 26. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
  • 27. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
  • 28. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
  • 29. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
  • 30. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
  • 31. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
  • 32. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
  • 33. keep certificate validity short: Record the affected host, user, key, configuration and risk.
  • 34. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
  • 35. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
  • 36. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
  • 37. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 38. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
  • 39. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
  • 40. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
  • 41. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
  • 42. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
  • 43. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
  • 44. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
  • 45. keep certificate validity short: Record the affected host, user, key, configuration and risk.
  • 46. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
  • 47. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
  • 48. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
  • 49. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 50. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
  • 51. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
  • 52. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
  • 53. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
  • 54. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
  • 55. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
  • 56. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
  • 57. keep certificate validity short: Record the affected host, user, key, configuration and risk.
  • 58. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
  • 59. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
  • 60. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
  • 61. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 62. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
  • 63. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
  • 64. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
08 / 09

Practice Appendix: Curriculum

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSH client tools, test keys and sample configurations.

A001. Protocol

  • Task: verify fingerprint and connect the observation explicitly to Protocol.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A002. Host Keys

  • Task: evaluate configuration and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A003. User Keys

  • Task: justify risk and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A004. Bastion

  • Task: explain error path and connect the observation explicitly to Bastion.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A005. Forwarding

  • Task: classify log line and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A006. Certificates

  • Task: document trust model and connect the observation explicitly to Certificates.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A007. Logging

  • Task: plan rotation and connect the observation explicitly to Logging.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A008. Security

  • Task: restrict access and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A009. Protocol

  • Task: review forwarding and connect the observation explicitly to Protocol.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A010. Host Keys

  • Task: describe recovery path and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A011. User Keys

  • Task: verify fingerprint and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A012. Bastion

  • Task: evaluate configuration and connect the observation explicitly to Bastion.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A013. Forwarding

  • Task: justify risk and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A014. Certificates

  • Task: explain error path and connect the observation explicitly to Certificates.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A015. Logging

  • Task: classify log line and connect the observation explicitly to Logging.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A016. Security

  • Task: document trust model and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A017. Protocol

  • Task: plan rotation and connect the observation explicitly to Protocol.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A018. Host Keys

  • Task: restrict access and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A019. User Keys

  • Task: review forwarding and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A020. Bastion

  • Task: describe recovery path and connect the observation explicitly to Bastion.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A021. Forwarding

  • Task: verify fingerprint and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A022. Certificates

  • Task: evaluate configuration and connect the observation explicitly to Certificates.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A023. Logging

  • Task: justify risk and connect the observation explicitly to Logging.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A024. Security

  • Task: explain error path and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A025. Protocol

  • Task: classify log line and connect the observation explicitly to Protocol.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A026. Host Keys

  • Task: document trust model and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A027. User Keys

  • Task: plan rotation and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A028. Bastion

  • Task: restrict access and connect the observation explicitly to Bastion.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A029. Forwarding

  • Task: review forwarding and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A030. Certificates

  • Task: describe recovery path and connect the observation explicitly to Certificates.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A031. Logging

  • Task: verify fingerprint and connect the observation explicitly to Logging.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A032. Security

  • Task: evaluate configuration and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A033. Protocol

  • Task: justify risk and connect the observation explicitly to Protocol.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A034. Host Keys

  • Task: explain error path and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A035. User Keys

  • Task: classify log line and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A036. Bastion

  • Task: document trust model and connect the observation explicitly to Bastion.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A037. Forwarding

  • Task: plan rotation and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A038. Certificates

  • Task: restrict access and connect the observation explicitly to Certificates.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A039. Logging

  • Task: review forwarding and connect the observation explicitly to Logging.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A040. Security

  • Task: describe recovery path and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A041. Protocol

  • Task: verify fingerprint and connect the observation explicitly to Protocol.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A042. Host Keys

  • Task: evaluate configuration and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A043. User Keys

  • Task: justify risk and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A044. Bastion

  • Task: explain error path and connect the observation explicitly to Bastion.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A045. Forwarding

  • Task: classify log line and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A046. Certificates

  • Task: document trust model and connect the observation explicitly to Certificates.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A047. Logging

  • Task: plan rotation and connect the observation explicitly to Logging.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A048. Security

  • Task: restrict access and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A049. Protocol

  • Task: review forwarding and connect the observation explicitly to Protocol.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A050. Host Keys

  • Task: describe recovery path and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A051. User Keys

  • Task: verify fingerprint and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A052. Bastion

  • Task: evaluate configuration and connect the observation explicitly to Bastion.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A053. Forwarding

  • Task: justify risk and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A054. Certificates

  • Task: explain error path and connect the observation explicitly to Certificates.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A055. Logging

  • Task: classify log line and connect the observation explicitly to Logging.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A056. Security

  • Task: document trust model and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A057. Protocol

  • Task: plan rotation and connect the observation explicitly to Protocol.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A058. Host Keys

  • Task: restrict access and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A059. User Keys

  • Task: review forwarding and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A060. Bastion

  • Task: describe recovery path and connect the observation explicitly to Bastion.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A061. Forwarding

  • Task: verify fingerprint and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A062. Certificates

  • Task: evaluate configuration and connect the observation explicitly to Certificates.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A063. Logging

  • Task: justify risk and connect the observation explicitly to Logging.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A064. Security

  • Task: explain error path and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A065. Protocol

  • Task: classify log line and connect the observation explicitly to Protocol.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A066. Host Keys

  • Task: document trust model and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A067. User Keys

  • Task: plan rotation and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A068. Bastion

  • Task: restrict access and connect the observation explicitly to Bastion.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A069. Forwarding

  • Task: review forwarding and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A070. Certificates

  • Task: describe recovery path and connect the observation explicitly to Certificates.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A071. Logging

  • Task: verify fingerprint and connect the observation explicitly to Logging.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A072. Security

  • Task: evaluate configuration and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A073. Protocol

  • Task: justify risk and connect the observation explicitly to Protocol.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A074. Host Keys

  • Task: explain error path and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A075. User Keys

  • Task: classify log line and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A076. Bastion

  • Task: document trust model and connect the observation explicitly to Bastion.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A077. Forwarding

  • Task: plan rotation and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A078. Certificates

  • Task: restrict access and connect the observation explicitly to Certificates.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A079. Logging

  • Task: review forwarding and connect the observation explicitly to Logging.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A080. Security

  • Task: describe recovery path and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A081. Protocol

  • Task: verify fingerprint and connect the observation explicitly to Protocol.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A082. Host Keys

  • Task: evaluate configuration and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A083. User Keys

  • Task: justify risk and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A084. Bastion

  • Task: explain error path and connect the observation explicitly to Bastion.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A085. Forwarding

  • Task: classify log line and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A086. Certificates

  • Task: document trust model and connect the observation explicitly to Certificates.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A087. Logging

  • Task: plan rotation and connect the observation explicitly to Logging.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A088. Security

  • Task: restrict access and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A089. Protocol

  • Task: review forwarding and connect the observation explicitly to Protocol.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A090. Host Keys

  • Task: describe recovery path and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A091. User Keys

  • Task: verify fingerprint and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A092. Bastion

  • Task: evaluate configuration and connect the observation explicitly to Bastion.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A093. Forwarding

  • Task: justify risk and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A094. Certificates

  • Task: explain error path and connect the observation explicitly to Certificates.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A095. Logging

  • Task: classify log line and connect the observation explicitly to Logging.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A096. Security

  • Task: document trust model and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A097. Protocol

  • Task: plan rotation and connect the observation explicitly to Protocol.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A098. Host Keys

  • Task: restrict access and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A099. User Keys

  • Task: review forwarding and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A100. Bastion

  • Task: describe recovery path and connect the observation explicitly to Bastion.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A101. Forwarding

  • Task: verify fingerprint and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A102. Certificates

  • Task: evaluate configuration and connect the observation explicitly to Certificates.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A103. Logging

  • Task: justify risk and connect the observation explicitly to Logging.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A104. Security

  • Task: explain error path and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A105. Protocol

  • Task: classify log line and connect the observation explicitly to Protocol.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A106. Host Keys

  • Task: document trust model and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A107. User Keys

  • Task: plan rotation and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A108. Bastion

  • Task: restrict access and connect the observation explicitly to Bastion.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A109. Forwarding

  • Task: review forwarding and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A110. Certificates

  • Task: describe recovery path and connect the observation explicitly to Certificates.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A111. Logging

  • Task: verify fingerprint and connect the observation explicitly to Logging.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A112. Security

  • Task: evaluate configuration and connect the observation explicitly to Security.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
09 / 09

SSH · Orthevs Academy

31 modules as one continuous learning path.

The sequence remains unchanged: from the lab skeleton through technical foundations and operating models to final troubleshooting. The technical directory names are deliberately preserved.

Practice modules

Orthevs as an app

Install Orthevs

The Orthevs web app can be installed on supported mobile devices and desktop browsers.

iPhone and iPad

Open Orthevs in Safari. Tap Share, then Add to Home Screen. Enable Open as Web App if offered, then tap Add.

Android

For the web app, open the browser menu and choose Install app or Add to Home screen. Confirm the installation.

Desktop browser

Open the browser menu or the install icon in the address bar, then choose Install app or Add to Dock.

Web app installation depends on your browser. If no install prompt appears, follow the browser steps shown above.