Orthevs Orthevs Fathom new horizons
Menü

Workshop-Wiki · Englisch

SSH Exercises: Advanced Security (EN)

These exercises deepen Hardening, Algorithmuspflege, FIDO2, KRL, Forensik, Logging und Incident Response. Every task requires reproducible evidence instead of description only.

Inhaltssprache · EnglischGröße · 66.0 KBexercises/04-advanced-security-exercises-ssh-EN.md
Workshop-Beispiele als ZIP
Lernstand in der Web-App

Kapitel als gelesen markieren, Lesefortschritt sehen und Praxismodule abhaken: Diese Funktionen stehen nach Aktivierung der optionalen Web-App zur Verfügung. Der Workshop-Fortschritt ergibt sich automatisch aus den Kapiteln aller Dokumentseiten. Deine Auswahl bleibt auf diesem Gerät; es gibt kein Konto und keinen Serverabgleich. Eine Installation ist nicht erforderlich. Beim Widerruf in den Datenschutz-Einstellungen wird der Lernstand gelöscht.

Lesefortschritt0%
0%
0 / 5 Kapitel gelesen
Weitere SprachfassungDeutsch ↗Griechisch ↗

SSH Exercises: Advanced Security (EN)

These exercises deepen Hardening, Algorithmuspflege, FIDO2, KRL, Forensik, Logging und Incident Response. Every task requires reproducible evidence instead of description only.

Submission Format

  • configuration file or patch
  • test keys only from work/
  • commands executed
  • fingerprints or ssh -G excerpt
  • short risk and recovery note
01 / 05

Tasks

Task 01: Host Keys

Build or improve an SSH artifact focused on Host Keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 02: User Keys

Build or improve an SSH artifact focused on User Keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 03: known_hosts

Build or improve an SSH artifact focused on known_hosts.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 04: authorized_keys

Build or improve an SSH artifact focused on authorized_keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 05: ssh_config

Build or improve an SSH artifact focused on ssh_config.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 06: sshd_config

Build or improve an SSH artifact focused on sshd_config.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 07: ProxyJump

Build or improve an SSH artifact focused on ProxyJump.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 08: Forwarding

Build or improve an SSH artifact focused on Forwarding.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 09: CA

Build or improve an SSH artifact focused on CA.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 10: KRL

Build or improve an SSH artifact focused on KRL.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 11: Host Keys

Build or improve an SSH artifact focused on Host Keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 12: User Keys

Build or improve an SSH artifact focused on User Keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 13: known_hosts

Build or improve an SSH artifact focused on known_hosts.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 14: authorized_keys

Build or improve an SSH artifact focused on authorized_keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 15: ssh_config

Build or improve an SSH artifact focused on ssh_config.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 16: sshd_config

Build or improve an SSH artifact focused on sshd_config.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 17: ProxyJump

Build or improve an SSH artifact focused on ProxyJump.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 18: Forwarding

Build or improve an SSH artifact focused on Forwarding.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 19: CA

Build or improve an SSH artifact focused on CA.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 20: KRL

Build or improve an SSH artifact focused on KRL.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 21: Host Keys

Build or improve an SSH artifact focused on Host Keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 22: User Keys

Build or improve an SSH artifact focused on User Keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 23: known_hosts

Build or improve an SSH artifact focused on known_hosts.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 24: authorized_keys

Build or improve an SSH artifact focused on authorized_keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 25: ssh_config

Build or improve an SSH artifact focused on ssh_config.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 26: sshd_config

Build or improve an SSH artifact focused on sshd_config.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 27: ProxyJump

Build or improve an SSH artifact focused on ProxyJump.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 28: Forwarding

Build or improve an SSH artifact focused on Forwarding.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 29: CA

Build or improve an SSH artifact focused on CA.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 30: KRL

Build or improve an SSH artifact focused on KRL.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 31: Host Keys

Build or improve an SSH artifact focused on Host Keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 32: User Keys

Build or improve an SSH artifact focused on User Keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 33: known_hosts

Build or improve an SSH artifact focused on known_hosts.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 34: authorized_keys

Build or improve an SSH artifact focused on authorized_keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 35: ssh_config

Build or improve an SSH artifact focused on ssh_config.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 36: sshd_config

Build or improve an SSH artifact focused on sshd_config.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub
02 / 05

Solution Notes

Use test keys, sample hosts and local configuration evaluation. Do not check production hosts without authorization. Document whether an option is client-side or server-side.

03 / 05

Review Checklist for Exercises Advanced Security

  • 01. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 02. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
  • 03. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
  • 04. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
  • 05. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
  • 06. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
  • 07. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
  • 08. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
  • 09. keep certificate validity short: Record the affected host, user, key, configuration and risk.
  • 10. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
  • 11. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
  • 12. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
  • 13. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 14. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
  • 15. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
  • 16. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
  • 17. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
  • 18. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
  • 19. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
  • 20. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
  • 21. keep certificate validity short: Record the affected host, user, key, configuration and risk.
  • 22. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
  • 23. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
  • 24. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
  • 25. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 26. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
  • 27. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
  • 28. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
  • 29. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
  • 30. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
  • 31. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
  • 32. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
  • 33. keep certificate validity short: Record the affected host, user, key, configuration and risk.
  • 34. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
  • 35. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
  • 36. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
  • 37. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 38. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
  • 39. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
  • 40. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
  • 41. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
  • 42. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
  • 43. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
  • 44. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
  • 45. keep certificate validity short: Record the affected host, user, key, configuration and risk.
  • 46. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
  • 47. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
  • 48. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
  • 49. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 50. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
04 / 05

Practice Appendix: Exercises Advanced Security

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSH client tools, test keys and sample configurations.

A001. Host Keys

  • Task: verify fingerprint and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A002. User Keys

  • Task: evaluate configuration and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A003. known_hosts

  • Task: justify risk and connect the observation explicitly to known_hosts.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A004. authorized_keys

  • Task: explain error path and connect the observation explicitly to authorized_keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A005. ssh_config

  • Task: classify log line and connect the observation explicitly to ssh_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A006. sshd_config

  • Task: document trust model and connect the observation explicitly to sshd_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A007. ProxyJump

  • Task: plan rotation and connect the observation explicitly to ProxyJump.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A008. Forwarding

  • Task: restrict access and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A009. CA

  • Task: review forwarding and connect the observation explicitly to CA.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A010. KRL

  • Task: describe recovery path and connect the observation explicitly to KRL.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A011. Host Keys

  • Task: verify fingerprint and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A012. User Keys

  • Task: evaluate configuration and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A013. known_hosts

  • Task: justify risk and connect the observation explicitly to known_hosts.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A014. authorized_keys

  • Task: explain error path and connect the observation explicitly to authorized_keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A015. ssh_config

  • Task: classify log line and connect the observation explicitly to ssh_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A016. sshd_config

  • Task: document trust model and connect the observation explicitly to sshd_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A017. ProxyJump

  • Task: plan rotation and connect the observation explicitly to ProxyJump.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A018. Forwarding

  • Task: restrict access and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A019. CA

  • Task: review forwarding and connect the observation explicitly to CA.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A020. KRL

  • Task: describe recovery path and connect the observation explicitly to KRL.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A021. Host Keys

  • Task: verify fingerprint and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A022. User Keys

  • Task: evaluate configuration and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A023. known_hosts

  • Task: justify risk and connect the observation explicitly to known_hosts.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A024. authorized_keys

  • Task: explain error path and connect the observation explicitly to authorized_keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A025. ssh_config

  • Task: classify log line and connect the observation explicitly to ssh_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A026. sshd_config

  • Task: document trust model and connect the observation explicitly to sshd_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A027. ProxyJump

  • Task: plan rotation and connect the observation explicitly to ProxyJump.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A028. Forwarding

  • Task: restrict access and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A029. CA

  • Task: review forwarding and connect the observation explicitly to CA.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A030. KRL

  • Task: describe recovery path and connect the observation explicitly to KRL.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A031. Host Keys

  • Task: verify fingerprint and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A032. User Keys

  • Task: evaluate configuration and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A033. known_hosts

  • Task: justify risk and connect the observation explicitly to known_hosts.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A034. authorized_keys

  • Task: explain error path and connect the observation explicitly to authorized_keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A035. ssh_config

  • Task: classify log line and connect the observation explicitly to ssh_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A036. sshd_config

  • Task: document trust model and connect the observation explicitly to sshd_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A037. ProxyJump

  • Task: plan rotation and connect the observation explicitly to ProxyJump.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A038. Forwarding

  • Task: restrict access and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A039. CA

  • Task: review forwarding and connect the observation explicitly to CA.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A040. KRL

  • Task: describe recovery path and connect the observation explicitly to KRL.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A041. Host Keys

  • Task: verify fingerprint and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A042. User Keys

  • Task: evaluate configuration and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A043. known_hosts

  • Task: justify risk and connect the observation explicitly to known_hosts.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A044. authorized_keys

  • Task: explain error path and connect the observation explicitly to authorized_keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A045. ssh_config

  • Task: classify log line and connect the observation explicitly to ssh_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A046. sshd_config

  • Task: document trust model and connect the observation explicitly to sshd_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A047. ProxyJump

  • Task: plan rotation and connect the observation explicitly to ProxyJump.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A048. Forwarding

  • Task: restrict access and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A049. CA

  • Task: review forwarding and connect the observation explicitly to CA.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A050. KRL

  • Task: describe recovery path and connect the observation explicitly to KRL.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A051. Host Keys

  • Task: verify fingerprint and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A052. User Keys

  • Task: evaluate configuration and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A053. known_hosts

  • Task: justify risk and connect the observation explicitly to known_hosts.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A054. authorized_keys

  • Task: explain error path and connect the observation explicitly to authorized_keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A055. ssh_config

  • Task: classify log line and connect the observation explicitly to ssh_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A056. sshd_config

  • Task: document trust model and connect the observation explicitly to sshd_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A057. ProxyJump

  • Task: plan rotation and connect the observation explicitly to ProxyJump.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A058. Forwarding

  • Task: restrict access and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A059. CA

  • Task: review forwarding and connect the observation explicitly to CA.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A060. KRL

  • Task: describe recovery path and connect the observation explicitly to KRL.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A061. Host Keys

  • Task: verify fingerprint and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A062. User Keys

  • Task: evaluate configuration and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A063. known_hosts

  • Task: justify risk and connect the observation explicitly to known_hosts.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A064. authorized_keys

  • Task: explain error path and connect the observation explicitly to authorized_keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A065. ssh_config

  • Task: classify log line and connect the observation explicitly to ssh_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A066. sshd_config

  • Task: document trust model and connect the observation explicitly to sshd_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A067. ProxyJump

  • Task: plan rotation and connect the observation explicitly to ProxyJump.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A068. Forwarding

  • Task: restrict access and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A069. CA

  • Task: review forwarding and connect the observation explicitly to CA.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A070. KRL

  • Task: describe recovery path and connect the observation explicitly to KRL.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A071. Host Keys

  • Task: verify fingerprint and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A072. User Keys

  • Task: evaluate configuration and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A073. known_hosts

  • Task: justify risk and connect the observation explicitly to known_hosts.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A074. authorized_keys

  • Task: explain error path and connect the observation explicitly to authorized_keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A075. ssh_config

  • Task: classify log line and connect the observation explicitly to ssh_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A076. sshd_config

  • Task: document trust model and connect the observation explicitly to sshd_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A077. ProxyJump

  • Task: plan rotation and connect the observation explicitly to ProxyJump.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A078. Forwarding

  • Task: restrict access and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A079. CA

  • Task: review forwarding and connect the observation explicitly to CA.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A080. KRL

  • Task: describe recovery path and connect the observation explicitly to KRL.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A081. Host Keys

  • Task: verify fingerprint and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A082. User Keys

  • Task: evaluate configuration and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A083. known_hosts

  • Task: justify risk and connect the observation explicitly to known_hosts.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A084. authorized_keys

  • Task: explain error path and connect the observation explicitly to authorized_keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A085. ssh_config

  • Task: classify log line and connect the observation explicitly to ssh_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A086. sshd_config

  • Task: document trust model and connect the observation explicitly to sshd_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A087. ProxyJump

  • Task: plan rotation and connect the observation explicitly to ProxyJump.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A088. Forwarding

  • Task: restrict access and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A089. CA

  • Task: review forwarding and connect the observation explicitly to CA.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A090. KRL

  • Task: describe recovery path and connect the observation explicitly to KRL.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
05 / 05

SSH · Orthevs Academy

31 Module als durchgängiger Lernpfad.

Die Reihenfolge bleibt unverändert: von der Laborgrundstruktur über fachliche Grundlagen und Betriebsmodelle bis zum abschließenden Troubleshooting. Die technischen Verzeichnisnamen werden bewusst beibehalten.

Praxismodule

Orthevs als App

Orthevs installieren

Die Orthevs Web-App kann auf unterstützten Mobilgeräten und Desktop-Browsern installiert werden.

iPhone und iPad

Öffnen Sie Orthevs in Safari. Tippen Sie auf Teilen, dann auf ‚Zum Home-Bildschirm‘. Aktivieren Sie gegebenenfalls ‚Als Web-App öffnen‘ und tippen Sie auf ‚Hinzufügen‘.

Android

Für die Web-App öffnen Sie das Browsermenü und wählen ‚App installieren‘ oder ‚Zum Startbildschirm hinzufügen‘. Bestätigen Sie die Installation.

Desktop-Browser

Öffnen Sie das Browsermenü oder das Installationssymbol in der Adressleiste und wählen Sie ‚App installieren‘ beziehungsweise ‚Zum Dock hinzufügen‘.

Die Web-App-Installation hängt vom Browser ab. Falls kein Installationsdialog erscheint, nutzen Sie die angezeigten Schritte im Browser.