Diagrams: SSH
This document belongs to the SSH workshop and describes diagrams as training material, reference documentation and review basis.
Target State
You should not treat SSH as a mere login command, but as a trust, authentication and transport model. Host-key verification, private-key protection, clear client and server configuration, controlled forwarding and auditable operations decisions are the core concerns.
Focus
- Handshake
- Trust
- Bastion
- Forwarding
- Incident Response
Core Terms
| Term | Meaning |
|---|---|
SSH |
Secure Shell Protocol for secure remote login and other network services over insecure networks. |
OpenSSH |
Free SSH implementation with client, server, key tools, agent, SFTP and configuration formats. |
ssh |
Client program for login, remote commands, port forwarding and configuration evaluation. |
sshd |
Server daemon that accepts connections and handles key exchange, authentication, commands and data channels. |
Host Key |
Server key identity; clients verify it through known_hosts or host certificates. |
User Key |
User key pair for public-key authentication. |
known_hosts |
Client-side trust database for host keys and CA entries. |
authorized_keys |
Server-side list of allowed public keys, optionally with per-key restrictions. |
ssh_config |
Client configuration with Host blocks, identities, ProxyJump, forwarding and security options. |
sshd_config |
Server configuration with authentication, host keys, subsystems, Match blocks and access rules. |
Trust on First Use |
Trust model where a host key is consciously verified on first contact and stored afterwards. |
Fingerprint |
Short representation of a public key used for verification, inventory and rotation. |
ssh-agent |
Local agent that holds decrypted keys and performs signatures without exposing private keys. |
Agent Forwarding |
Forwarding of the agent socket to a remote host; useful but high-risk. |
ProxyJump |
OpenSSH mechanism for connections through a bastion host without copying private keys onto the jump host. |
Port Forwarding |
Forwarding local, remote or dynamic TCP ports through the SSH channel. |
SFTP |
SSH-based file transfer protocol and OpenSSH subsystem. |
SSH Certificate |
OpenSSH certificate for user or host keys, signed by an SSH CA with principals, validity and options. |
KRL |
Key revocation list for revoked keys or certificates. |
FIDO2/Security Key |
Hardware-backed key type in OpenSSH, dependent on client, token and platform support. |
Reference Commands
# Version and effective client config
ssh -V
ssh -G -F ./client/ssh_config lab-target
# Key generation and inspection
ssh-keygen -t ed25519 -a 64 -f ./work/keys/user_ed25519 -C workshop@example.invalid
ssh-keygen -y -f ./work/keys/user_ed25519 > ./work/keys/user_ed25519.pub
ssh-keygen -lf ./work/keys/user_ed25519.pub
# Host-key and known_hosts work
ssh-keygen -F example.internal -f ./known_hosts
ssh-keygen -R example.internal -f ./known_hosts
ssh-keygen -H -f ./known_hosts
# Certificate model
ssh-keygen -t ed25519 -f ./work/ca/user_ca -C user-ca@example.invalid
ssh-keygen -s ./work/ca/user_ca -I lab-user -n workshop -V +1d ./work/keys/user_ed25519.pub
ssh-keygen -Lf ./work/keys/user_ed25519-cert.pub
# Debug commands for real labs
ssh -vvv lab-target true
sftp lab-target
ssh -N -L 127.0.0.1:15432:db.internal:5432 bastion
Working Model
- Define target host, user, trust model and authentication method.
- Verify host-key trust through fingerprint,
known_hosts, host certificate or CA entry. - Protect private keys with permissions, passphrase, agent lifetime and secret rules.
- Separate client configuration, server configuration, bastion paths and forwarding rules.
- Support changes with
ssh -G,ssh-keygen -l/-L, test configurations and log analysis. - Document recovery: key rotation, known-hosts repair, KRL, CA rotation, break glass and incident response.
Typical Decisions
| Decision | Review Question | Risk if Wrong |
|---|---|---|
| Host-key model | Is TOFU, pinning or host CA used? | man-in-the-middle is not detected |
| User key | Which key type, passphrase and rotation are required? | key leakage grants persistent access |
| Agent | Is agent lifetime or forwarding allowed? | remote system can abuse signatures |
| Bastion | Do private keys stay on the client? | key copies on jump hosts increase impact |
| Forwarding | Which ports, bind addresses and targets are allowed? | tunnels bypass segmentation and controls |
| Certificates | Who signs, for how long and with which principals? | access rights are too broad or too long-lived |
Diagrams and Models
The diagrams are text-based so they remain versionable and reviewable without extra tooling.
Client ssh(1) -> TCP -> sshd(8)
| |
| transport KEX | host key proves server identity
| user auth | public key, certificate or other method
| connection | session, command, sftp, forwarding channels
Trust Chain
user private key -> public key / user certificate -> authorized_keys or TrustedUserCAKeys
host private key -> host public key / host certificate -> known_hosts or @cert-authority
Bastion Path
laptop --ssh--> bastion --direct tcp forwarding--> target
private key stays on laptop; ProxyJump carries bytes, not key material
Operations Notes
- OpenSSH options differ between client, server and distributions; check local manpages and release notes.
- Host-key verification is not a convenience detail, but the foundation against man-in-the-middle attacks.
- New designs should consciously compare
scpwith SFTP or rsync; OpenSSH itself documents limitations of the old scp protocol. - Agent forwarding is not a default for bastions, but an exception that must be documented deliberately.
- SSH certificates do not replace clean CA processes, short validity, revocation and logging.
Sources and References
Review Checklist for Diagrams
- 01. document host-key trust: Record the affected host, user, key, configuration and risk.
- 02. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
- 03. check permissions for keys and
.ssh: Record the affected host, user, key, configuration and risk. - 04. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
- 05. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
- 06. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
- 07. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
- 08. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
- 09. keep certificate validity short: Record the affected host, user, key, configuration and risk.
- 10. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
- 11. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
- 12. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
- 13. document host-key trust: Record the affected host, user, key, configuration and risk.
- 14. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
- 15. check permissions for keys and
.ssh: Record the affected host, user, key, configuration and risk. - 16. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
- 17. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
- 18. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
- 19. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
- 20. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
- 21. keep certificate validity short: Record the affected host, user, key, configuration and risk.
- 22. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
- 23. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
- 24. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
- 25. document host-key trust: Record the affected host, user, key, configuration and risk.
- 26. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
- 27. check permissions for keys and
.ssh: Record the affected host, user, key, configuration and risk. - 28. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
- 29. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
- 30. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
- 31. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
- 32. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
- 33. keep certificate validity short: Record the affected host, user, key, configuration and risk.
- 34. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
- 35. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
- 36. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
- 37. document host-key trust: Record the affected host, user, key, configuration and risk.
- 38. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
- 39. check permissions for keys and
.ssh: Record the affected host, user, key, configuration and risk. - 40. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
- 41. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
- 42. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
- 43. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
- 44. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
- 45. keep certificate validity short: Record the affected host, user, key, configuration and risk.
- 46. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
- 47. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
- 48. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
- 49. document host-key trust: Record the affected host, user, key, configuration and risk.
- 50. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
- 51. check permissions for keys and
.ssh: Record the affected host, user, key, configuration and risk. - 52. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
Practice Appendix: Diagrams
This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSH client tools, test keys and sample configurations.
A001. Handshake
- Task: verify fingerprint and connect the observation explicitly to
Handshake. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A002. Trust
- Task: evaluate configuration and connect the observation explicitly to
Trust. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A003. Bastion
- Task: justify risk and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A004. Forwarding
- Task: explain error path and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A005. Incident Response
- Task: classify log line and connect the observation explicitly to
Incident Response. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A006. Handshake
- Task: document trust model and connect the observation explicitly to
Handshake. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A007. Trust
- Task: plan rotation and connect the observation explicitly to
Trust. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A008. Bastion
- Task: restrict access and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A009. Forwarding
- Task: review forwarding and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A010. Incident Response
- Task: describe recovery path and connect the observation explicitly to
Incident Response. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A011. Handshake
- Task: verify fingerprint and connect the observation explicitly to
Handshake. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A012. Trust
- Task: evaluate configuration and connect the observation explicitly to
Trust. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A013. Bastion
- Task: justify risk and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A014. Forwarding
- Task: explain error path and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A015. Incident Response
- Task: classify log line and connect the observation explicitly to
Incident Response. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A016. Handshake
- Task: document trust model and connect the observation explicitly to
Handshake. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A017. Trust
- Task: plan rotation and connect the observation explicitly to
Trust. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A018. Bastion
- Task: restrict access and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A019. Forwarding
- Task: review forwarding and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A020. Incident Response
- Task: describe recovery path and connect the observation explicitly to
Incident Response. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A021. Handshake
- Task: verify fingerprint and connect the observation explicitly to
Handshake. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A022. Trust
- Task: evaluate configuration and connect the observation explicitly to
Trust. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A023. Bastion
- Task: justify risk and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A024. Forwarding
- Task: explain error path and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A025. Incident Response
- Task: classify log line and connect the observation explicitly to
Incident Response. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A026. Handshake
- Task: document trust model and connect the observation explicitly to
Handshake. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A027. Trust
- Task: plan rotation and connect the observation explicitly to
Trust. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A028. Bastion
- Task: restrict access and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A029. Forwarding
- Task: review forwarding and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A030. Incident Response
- Task: describe recovery path and connect the observation explicitly to
Incident Response. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A031. Handshake
- Task: verify fingerprint and connect the observation explicitly to
Handshake. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A032. Trust
- Task: evaluate configuration and connect the observation explicitly to
Trust. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A033. Bastion
- Task: justify risk and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A034. Forwarding
- Task: explain error path and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A035. Incident Response
- Task: classify log line and connect the observation explicitly to
Incident Response. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A036. Handshake
- Task: document trust model and connect the observation explicitly to
Handshake. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A037. Trust
- Task: plan rotation and connect the observation explicitly to
Trust. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A038. Bastion
- Task: restrict access and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A039. Forwarding
- Task: review forwarding and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A040. Incident Response
- Task: describe recovery path and connect the observation explicitly to
Incident Response. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A041. Handshake
- Task: verify fingerprint and connect the observation explicitly to
Handshake. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A042. Trust
- Task: evaluate configuration and connect the observation explicitly to
Trust. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A043. Bastion
- Task: justify risk and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A044. Forwarding
- Task: explain error path and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A045. Incident Response
- Task: classify log line and connect the observation explicitly to
Incident Response. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A046. Handshake
- Task: document trust model and connect the observation explicitly to
Handshake. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A047. Trust
- Task: plan rotation and connect the observation explicitly to
Trust. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A048. Bastion
- Task: restrict access and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A049. Forwarding
- Task: review forwarding and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A050. Incident Response
- Task: describe recovery path and connect the observation explicitly to
Incident Response. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A051. Handshake
- Task: verify fingerprint and connect the observation explicitly to
Handshake. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A052. Trust
- Task: evaluate configuration and connect the observation explicitly to
Trust. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A053. Bastion
- Task: justify risk and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A054. Forwarding
- Task: explain error path and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A055. Incident Response
- Task: classify log line and connect the observation explicitly to
Incident Response. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A056. Handshake
- Task: document trust model and connect the observation explicitly to
Handshake. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A057. Trust
- Task: plan rotation and connect the observation explicitly to
Trust. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A058. Bastion
- Task: restrict access and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A059. Forwarding
- Task: review forwarding and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A060. Incident Response
- Task: describe recovery path and connect the observation explicitly to
Incident Response. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A061. Handshake
- Task: verify fingerprint and connect the observation explicitly to
Handshake. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A062. Trust
- Task: evaluate configuration and connect the observation explicitly to
Trust. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A063. Bastion
- Task: justify risk and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A064. Forwarding
- Task: explain error path and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A065. Incident Response
- Task: classify log line and connect the observation explicitly to
Incident Response. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A066. Handshake
- Task: document trust model and connect the observation explicitly to
Handshake. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A067. Trust
- Task: plan rotation and connect the observation explicitly to
Trust. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A068. Bastion
- Task: restrict access and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A069. Forwarding
- Task: review forwarding and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A070. Incident Response
- Task: describe recovery path and connect the observation explicitly to
Incident Response. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A071. Handshake
- Task: verify fingerprint and connect the observation explicitly to
Handshake. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A072. Trust
- Task: evaluate configuration and connect the observation explicitly to
Trust. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A073. Bastion
- Task: justify risk and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A074. Forwarding
- Task: explain error path and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A075. Incident Response
- Task: classify log line and connect the observation explicitly to
Incident Response. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A076. Handshake
- Task: document trust model and connect the observation explicitly to
Handshake. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A077. Trust
- Task: plan rotation and connect the observation explicitly to
Trust. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A078. Bastion
- Task: restrict access and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A079. Forwarding
- Task: review forwarding and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A080. Incident Response
- Task: describe recovery path and connect the observation explicitly to
Incident Response. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A081. Handshake
- Task: verify fingerprint and connect the observation explicitly to
Handshake. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A082. Trust
- Task: evaluate configuration and connect the observation explicitly to
Trust. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A083. Bastion
- Task: justify risk and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A084. Forwarding
- Task: explain error path and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A085. Incident Response
- Task: classify log line and connect the observation explicitly to
Incident Response. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A086. Handshake
- Task: document trust model and connect the observation explicitly to
Handshake. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A087. Trust
- Task: plan rotation and connect the observation explicitly to
Trust. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A088. Bastion
- Task: restrict access and connect the observation explicitly to
Bastion. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A089. Forwarding
- Task: review forwarding and connect the observation explicitly to
Forwarding. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A090. Incident Response
- Task: describe recovery path and connect the observation explicitly to
Incident Response. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A091. Handshake
- Task: verify fingerprint and connect the observation explicitly to
Handshake. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
A092. Trust
- Task: evaluate configuration and connect the observation explicitly to
Trust. - Evidence: Record command, expected output, actual output, fingerprint or configuration line.
- Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
- Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
- Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.