Submission Format

• configuration file or patch
• test keys only from work/
• commands executed
• fingerprints or ssh -G excerpt
• short risk and recovery note

Tasks

Task 01: Host Keys

Build or improve an SSH artifact focused on Host Keys.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 02: User Keys

Build or improve an SSH artifact focused on User Keys.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 03: known_hosts

Build or improve an SSH artifact focused on known_hosts.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 04: authorized_keys

Build or improve an SSH artifact focused on authorized_keys.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 05: ssh_config

Build or improve an SSH artifact focused on ssh_config.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 06: sshd_config

Build or improve an SSH artifact focused on sshd_config.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 07: ProxyJump

Build or improve an SSH artifact focused on ProxyJump.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 08: Forwarding

Build or improve an SSH artifact focused on Forwarding.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 09: CA

Build or improve an SSH artifact focused on CA.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 10: KRL

Build or improve an SSH artifact focused on KRL.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 11: Host Keys

Build or improve an SSH artifact focused on Host Keys.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 12: User Keys

Build or improve an SSH artifact focused on User Keys.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 13: known_hosts

Build or improve an SSH artifact focused on known_hosts.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 14: authorized_keys

Build or improve an SSH artifact focused on authorized_keys.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 15: ssh_config

Build or improve an SSH artifact focused on ssh_config.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 16: sshd_config

Build or improve an SSH artifact focused on sshd_config.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 17: ProxyJump

Build or improve an SSH artifact focused on ProxyJump.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 18: Forwarding

Build or improve an SSH artifact focused on Forwarding.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 19: CA

Build or improve an SSH artifact focused on CA.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 20: KRL

Build or improve an SSH artifact focused on KRL.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 21: Host Keys

Build or improve an SSH artifact focused on Host Keys.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 22: User Keys

Build or improve an SSH artifact focused on User Keys.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 23: known_hosts

Build or improve an SSH artifact focused on known_hosts.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 24: authorized_keys

Build or improve an SSH artifact focused on authorized_keys.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 25: ssh_config

Build or improve an SSH artifact focused on ssh_config.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 26: sshd_config

Build or improve an SSH artifact focused on sshd_config.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 27: ProxyJump

Build or improve an SSH artifact focused on ProxyJump.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 28: Forwarding

Build or improve an SSH artifact focused on Forwarding.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 29: CA

Build or improve an SSH artifact focused on CA.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 30: KRL

Build or improve an SSH artifact focused on KRL.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 31: Host Keys

Build or improve an SSH artifact focused on Host Keys.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 32: User Keys

Build or improve an SSH artifact focused on User Keys.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 33: known_hosts

Build or improve an SSH artifact focused on known_hosts.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 34: authorized_keys

Build or improve an SSH artifact focused on authorized_keys.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 35: ssh_config

Build or improve an SSH artifact focused on ssh_config.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 36: sshd_config

Build or improve an SSH artifact focused on sshd_config.

Requirements:

• do not use production keys
• do not commit private keys
• document host-key trust
• name an error or abuse path

Evidence:

ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Solution Notes

Use test keys, sample hosts and local configuration evaluation. Do not check production hosts without authorization. Document whether an option is client-side or server-side.

Review Checklist for Exercises Advanced Security

• 01. document host-key trust: Record the affected host, user, key, configuration and risk.
• 02. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 03. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 04. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 05. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 06. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 07. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 08. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 09. keep certificate validity short: Record the affected host, user, key, configuration and risk.
• 10. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
• 11. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
• 12. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
• 13. document host-key trust: Record the affected host, user, key, configuration and risk.
• 14. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 15. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 16. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 17. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 18. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 19. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 20. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 21. keep certificate validity short: Record the affected host, user, key, configuration and risk.
• 22. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
• 23. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
• 24. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
• 25. document host-key trust: Record the affected host, user, key, configuration and risk.
• 26. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 27. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 28. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 29. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 30. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 31. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 32. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 33. keep certificate validity short: Record the affected host, user, key, configuration and risk.
• 34. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
• 35. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
• 36. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
• 37. document host-key trust: Record the affected host, user, key, configuration and risk.
• 38. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 39. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 40. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 41. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 42. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 43. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 44. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 45. keep certificate validity short: Record the affected host, user, key, configuration and risk.
• 46. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
• 47. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
• 48. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
• 49. document host-key trust: Record the affected host, user, key, configuration and risk.
• 50. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.

Practice Appendix: Exercises Advanced Security

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSH client tools, test keys and sample configurations.

A001. Host Keys

• Task: verify fingerprint and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A002. User Keys

• Task: evaluate configuration and connect the observation explicitly to User Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A003. known_hosts

• Task: justify risk and connect the observation explicitly to known_hosts.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A004. authorized_keys

• Task: explain error path and connect the observation explicitly to authorized_keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A005. ssh_config

• Task: classify log line and connect the observation explicitly to ssh_config.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A006. sshd_config

• Task: document trust model and connect the observation explicitly to sshd_config.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A007. ProxyJump

• Task: plan rotation and connect the observation explicitly to ProxyJump.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A008. Forwarding

• Task: restrict access and connect the observation explicitly to Forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A009. CA

• Task: review forwarding and connect the observation explicitly to CA.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A010. KRL

• Task: describe recovery path and connect the observation explicitly to KRL.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A011. Host Keys

• Task: verify fingerprint and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A012. User Keys

• Task: evaluate configuration and connect the observation explicitly to User Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A013. known_hosts

• Task: justify risk and connect the observation explicitly to known_hosts.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A014. authorized_keys

• Task: explain error path and connect the observation explicitly to authorized_keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A015. ssh_config

• Task: classify log line and connect the observation explicitly to ssh_config.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A016. sshd_config

• Task: document trust model and connect the observation explicitly to sshd_config.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A017. ProxyJump

• Task: plan rotation and connect the observation explicitly to ProxyJump.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A018. Forwarding

• Task: restrict access and connect the observation explicitly to Forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A019. CA

• Task: review forwarding and connect the observation explicitly to CA.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A020. KRL

• Task: describe recovery path and connect the observation explicitly to KRL.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A021. Host Keys

• Task: verify fingerprint and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A022. User Keys

• Task: evaluate configuration and connect the observation explicitly to User Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A023. known_hosts

• Task: justify risk and connect the observation explicitly to known_hosts.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A024. authorized_keys

• Task: explain error path and connect the observation explicitly to authorized_keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A025. ssh_config

• Task: classify log line and connect the observation explicitly to ssh_config.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A026. sshd_config

• Task: document trust model and connect the observation explicitly to sshd_config.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A027. ProxyJump

• Task: plan rotation and connect the observation explicitly to ProxyJump.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A028. Forwarding

• Task: restrict access and connect the observation explicitly to Forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A029. CA

• Task: review forwarding and connect the observation explicitly to CA.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A030. KRL

• Task: describe recovery path and connect the observation explicitly to KRL.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A031. Host Keys

• Task: verify fingerprint and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A032. User Keys

• Task: evaluate configuration and connect the observation explicitly to User Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A033. known_hosts

• Task: justify risk and connect the observation explicitly to known_hosts.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A034. authorized_keys

• Task: explain error path and connect the observation explicitly to authorized_keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A035. ssh_config

• Task: classify log line and connect the observation explicitly to ssh_config.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A036. sshd_config

• Task: document trust model and connect the observation explicitly to sshd_config.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A037. ProxyJump

• Task: plan rotation and connect the observation explicitly to ProxyJump.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A038. Forwarding

• Task: restrict access and connect the observation explicitly to Forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A039. CA

• Task: review forwarding and connect the observation explicitly to CA.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A040. KRL

• Task: describe recovery path and connect the observation explicitly to KRL.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A041. Host Keys

• Task: verify fingerprint and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A042. User Keys

• Task: evaluate configuration and connect the observation explicitly to User Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A043. known_hosts

• Task: justify risk and connect the observation explicitly to known_hosts.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A044. authorized_keys

• Task: explain error path and connect the observation explicitly to authorized_keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A045. ssh_config

• Task: classify log line and connect the observation explicitly to ssh_config.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A046. sshd_config

• Task: document trust model and connect the observation explicitly to sshd_config.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A047. ProxyJump

• Task: plan rotation and connect the observation explicitly to ProxyJump.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A048. Forwarding

• Task: restrict access and connect the observation explicitly to Forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A049. CA

• Task: review forwarding and connect the observation explicitly to CA.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A050. KRL

• Task: describe recovery path and connect the observation explicitly to KRL.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A051. Host Keys

• Task: verify fingerprint and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A052. User Keys

• Task: evaluate configuration and connect the observation explicitly to User Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A053. known_hosts

• Task: justify risk and connect the observation explicitly to known_hosts.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A054. authorized_keys

• Task: explain error path and connect the observation explicitly to authorized_keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A055. ssh_config

• Task: classify log line and connect the observation explicitly to ssh_config.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A056. sshd_config

• Task: document trust model and connect the observation explicitly to sshd_config.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A057. ProxyJump

• Task: plan rotation and connect the observation explicitly to ProxyJump.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A058. Forwarding

• Task: restrict access and connect the observation explicitly to Forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A059. CA

• Task: review forwarding and connect the observation explicitly to CA.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A060. KRL

• Task: describe recovery path and connect the observation explicitly to KRL.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A061. Host Keys

• Task: verify fingerprint and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A062. User Keys

• Task: evaluate configuration and connect the observation explicitly to User Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A063. known_hosts

• Task: justify risk and connect the observation explicitly to known_hosts.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A064. authorized_keys

• Task: explain error path and connect the observation explicitly to authorized_keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A065. ssh_config

• Task: classify log line and connect the observation explicitly to ssh_config.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A066. sshd_config

• Task: document trust model and connect the observation explicitly to sshd_config.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A067. ProxyJump

• Task: plan rotation and connect the observation explicitly to ProxyJump.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A068. Forwarding

• Task: restrict access and connect the observation explicitly to Forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A069. CA

• Task: review forwarding and connect the observation explicitly to CA.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A070. KRL

• Task: describe recovery path and connect the observation explicitly to KRL.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A071. Host Keys

• Task: verify fingerprint and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A072. User Keys

• Task: evaluate configuration and connect the observation explicitly to User Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A073. known_hosts

• Task: justify risk and connect the observation explicitly to known_hosts.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A074. authorized_keys

• Task: explain error path and connect the observation explicitly to authorized_keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A075. ssh_config

• Task: classify log line and connect the observation explicitly to ssh_config.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A076. sshd_config

• Task: document trust model and connect the observation explicitly to sshd_config.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A077. ProxyJump

• Task: plan rotation and connect the observation explicitly to ProxyJump.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A078. Forwarding

• Task: restrict access and connect the observation explicitly to Forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A079. CA

• Task: review forwarding and connect the observation explicitly to CA.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A080. KRL

• Task: describe recovery path and connect the observation explicitly to KRL.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A081. Host Keys

• Task: verify fingerprint and connect the observation explicitly to Host Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A082. User Keys

• Task: evaluate configuration and connect the observation explicitly to User Keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A083. known_hosts

• Task: justify risk and connect the observation explicitly to known_hosts.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A084. authorized_keys

• Task: explain error path and connect the observation explicitly to authorized_keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A085. ssh_config

• Task: classify log line and connect the observation explicitly to ssh_config.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A086. sshd_config

• Task: document trust model and connect the observation explicitly to sshd_config.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A087. ProxyJump

• Task: plan rotation and connect the observation explicitly to ProxyJump.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A088. Forwarding

• Task: restrict access and connect the observation explicitly to Forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A089. CA

• Task: review forwarding and connect the observation explicitly to CA.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A090. KRL

• Task: describe recovery path and connect the observation explicitly to KRL.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.