Orthevs Orthevs Fathom new horizons
Menu

Workshop wiki · English

SSH Exercises: Advanced Security (EN)

These exercises deepen Hardening, Algorithmuspflege, FIDO2, KRL, Forensik, Logging und Incident Response. Every task requires reproducible evidence instead of description only.

Content language · EnglishSize · 66.0 KBexercises/04-advanced-security-exercises-ssh-EN.md
Workshop examples as ZIP files
Learning progress in the web app

Mark chapters as read, view reading progress and check off practice modules after enabling the optional web app. Workshop progress is calculated from chapters across all document pages. Your choices stay on this device; there is no account or server sync. Installation is not required. Withdrawing your choice in Privacy settings deletes the progress.

Reading progress0%
0%
0 / 5 chapters read
Other language versionGerman ↗Greek ↗

SSH Exercises: Advanced Security (EN)

These exercises deepen Hardening, Algorithmuspflege, FIDO2, KRL, Forensik, Logging und Incident Response. Every task requires reproducible evidence instead of description only.

Submission Format

  • configuration file or patch
  • test keys only from work/
  • commands executed
  • fingerprints or ssh -G excerpt
  • short risk and recovery note
01 / 05

Tasks

Task 01: Host Keys

Build or improve an SSH artifact focused on Host Keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 02: User Keys

Build or improve an SSH artifact focused on User Keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 03: known_hosts

Build or improve an SSH artifact focused on known_hosts.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 04: authorized_keys

Build or improve an SSH artifact focused on authorized_keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 05: ssh_config

Build or improve an SSH artifact focused on ssh_config.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 06: sshd_config

Build or improve an SSH artifact focused on sshd_config.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 07: ProxyJump

Build or improve an SSH artifact focused on ProxyJump.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 08: Forwarding

Build or improve an SSH artifact focused on Forwarding.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 09: CA

Build or improve an SSH artifact focused on CA.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 10: KRL

Build or improve an SSH artifact focused on KRL.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 11: Host Keys

Build or improve an SSH artifact focused on Host Keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 12: User Keys

Build or improve an SSH artifact focused on User Keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 13: known_hosts

Build or improve an SSH artifact focused on known_hosts.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 14: authorized_keys

Build or improve an SSH artifact focused on authorized_keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 15: ssh_config

Build or improve an SSH artifact focused on ssh_config.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 16: sshd_config

Build or improve an SSH artifact focused on sshd_config.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 17: ProxyJump

Build or improve an SSH artifact focused on ProxyJump.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 18: Forwarding

Build or improve an SSH artifact focused on Forwarding.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 19: CA

Build or improve an SSH artifact focused on CA.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 20: KRL

Build or improve an SSH artifact focused on KRL.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 21: Host Keys

Build or improve an SSH artifact focused on Host Keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 22: User Keys

Build or improve an SSH artifact focused on User Keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 23: known_hosts

Build or improve an SSH artifact focused on known_hosts.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 24: authorized_keys

Build or improve an SSH artifact focused on authorized_keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 25: ssh_config

Build or improve an SSH artifact focused on ssh_config.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 26: sshd_config

Build or improve an SSH artifact focused on sshd_config.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 27: ProxyJump

Build or improve an SSH artifact focused on ProxyJump.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 28: Forwarding

Build or improve an SSH artifact focused on Forwarding.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 29: CA

Build or improve an SSH artifact focused on CA.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 30: KRL

Build or improve an SSH artifact focused on KRL.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 31: Host Keys

Build or improve an SSH artifact focused on Host Keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 32: User Keys

Build or improve an SSH artifact focused on User Keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 33: known_hosts

Build or improve an SSH artifact focused on known_hosts.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 34: authorized_keys

Build or improve an SSH artifact focused on authorized_keys.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 35: ssh_config

Build or improve an SSH artifact focused on ssh_config.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub

Task 36: sshd_config

Build or improve an SSH artifact focused on sshd_config.

Requirements:

  • do not use production keys
  • do not commit private keys
  • document host-key trust
  • name an error or abuse path

Evidence:

bash
ssh -V
ssh -G -F client/ssh_config lab-target | sed -n "1,20p"
ssh-keygen -lf work/keys/user_ed25519.pub
02 / 05

Solution Notes

Use test keys, sample hosts and local configuration evaluation. Do not check production hosts without authorization. Document whether an option is client-side or server-side.

03 / 05

Review Checklist for Exercises Advanced Security

  • 01. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 02. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
  • 03. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
  • 04. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
  • 05. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
  • 06. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
  • 07. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
  • 08. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
  • 09. keep certificate validity short: Record the affected host, user, key, configuration and risk.
  • 10. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
  • 11. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
  • 12. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
  • 13. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 14. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
  • 15. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
  • 16. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
  • 17. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
  • 18. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
  • 19. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
  • 20. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
  • 21. keep certificate validity short: Record the affected host, user, key, configuration and risk.
  • 22. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
  • 23. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
  • 24. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
  • 25. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 26. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
  • 27. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
  • 28. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
  • 29. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
  • 30. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
  • 31. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
  • 32. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
  • 33. keep certificate validity short: Record the affected host, user, key, configuration and risk.
  • 34. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
  • 35. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
  • 36. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
  • 37. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 38. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
  • 39. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
  • 40. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
  • 41. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
  • 42. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
  • 43. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
  • 44. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
  • 45. keep certificate validity short: Record the affected host, user, key, configuration and risk.
  • 46. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
  • 47. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
  • 48. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
  • 49. document host-key trust: Record the affected host, user, key, configuration and risk.
  • 50. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
04 / 05

Practice Appendix: Exercises Advanced Security

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSH client tools, test keys and sample configurations.

A001. Host Keys

  • Task: verify fingerprint and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A002. User Keys

  • Task: evaluate configuration and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A003. known_hosts

  • Task: justify risk and connect the observation explicitly to known_hosts.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A004. authorized_keys

  • Task: explain error path and connect the observation explicitly to authorized_keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A005. ssh_config

  • Task: classify log line and connect the observation explicitly to ssh_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A006. sshd_config

  • Task: document trust model and connect the observation explicitly to sshd_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A007. ProxyJump

  • Task: plan rotation and connect the observation explicitly to ProxyJump.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A008. Forwarding

  • Task: restrict access and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A009. CA

  • Task: review forwarding and connect the observation explicitly to CA.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A010. KRL

  • Task: describe recovery path and connect the observation explicitly to KRL.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A011. Host Keys

  • Task: verify fingerprint and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A012. User Keys

  • Task: evaluate configuration and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A013. known_hosts

  • Task: justify risk and connect the observation explicitly to known_hosts.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A014. authorized_keys

  • Task: explain error path and connect the observation explicitly to authorized_keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A015. ssh_config

  • Task: classify log line and connect the observation explicitly to ssh_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A016. sshd_config

  • Task: document trust model and connect the observation explicitly to sshd_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A017. ProxyJump

  • Task: plan rotation and connect the observation explicitly to ProxyJump.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A018. Forwarding

  • Task: restrict access and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A019. CA

  • Task: review forwarding and connect the observation explicitly to CA.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A020. KRL

  • Task: describe recovery path and connect the observation explicitly to KRL.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A021. Host Keys

  • Task: verify fingerprint and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A022. User Keys

  • Task: evaluate configuration and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A023. known_hosts

  • Task: justify risk and connect the observation explicitly to known_hosts.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A024. authorized_keys

  • Task: explain error path and connect the observation explicitly to authorized_keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A025. ssh_config

  • Task: classify log line and connect the observation explicitly to ssh_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A026. sshd_config

  • Task: document trust model and connect the observation explicitly to sshd_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A027. ProxyJump

  • Task: plan rotation and connect the observation explicitly to ProxyJump.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A028. Forwarding

  • Task: restrict access and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A029. CA

  • Task: review forwarding and connect the observation explicitly to CA.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A030. KRL

  • Task: describe recovery path and connect the observation explicitly to KRL.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A031. Host Keys

  • Task: verify fingerprint and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A032. User Keys

  • Task: evaluate configuration and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A033. known_hosts

  • Task: justify risk and connect the observation explicitly to known_hosts.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A034. authorized_keys

  • Task: explain error path and connect the observation explicitly to authorized_keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A035. ssh_config

  • Task: classify log line and connect the observation explicitly to ssh_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A036. sshd_config

  • Task: document trust model and connect the observation explicitly to sshd_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A037. ProxyJump

  • Task: plan rotation and connect the observation explicitly to ProxyJump.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A038. Forwarding

  • Task: restrict access and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A039. CA

  • Task: review forwarding and connect the observation explicitly to CA.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A040. KRL

  • Task: describe recovery path and connect the observation explicitly to KRL.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A041. Host Keys

  • Task: verify fingerprint and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A042. User Keys

  • Task: evaluate configuration and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A043. known_hosts

  • Task: justify risk and connect the observation explicitly to known_hosts.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A044. authorized_keys

  • Task: explain error path and connect the observation explicitly to authorized_keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A045. ssh_config

  • Task: classify log line and connect the observation explicitly to ssh_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A046. sshd_config

  • Task: document trust model and connect the observation explicitly to sshd_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A047. ProxyJump

  • Task: plan rotation and connect the observation explicitly to ProxyJump.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A048. Forwarding

  • Task: restrict access and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A049. CA

  • Task: review forwarding and connect the observation explicitly to CA.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A050. KRL

  • Task: describe recovery path and connect the observation explicitly to KRL.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A051. Host Keys

  • Task: verify fingerprint and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A052. User Keys

  • Task: evaluate configuration and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A053. known_hosts

  • Task: justify risk and connect the observation explicitly to known_hosts.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A054. authorized_keys

  • Task: explain error path and connect the observation explicitly to authorized_keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A055. ssh_config

  • Task: classify log line and connect the observation explicitly to ssh_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A056. sshd_config

  • Task: document trust model and connect the observation explicitly to sshd_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A057. ProxyJump

  • Task: plan rotation and connect the observation explicitly to ProxyJump.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A058. Forwarding

  • Task: restrict access and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A059. CA

  • Task: review forwarding and connect the observation explicitly to CA.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A060. KRL

  • Task: describe recovery path and connect the observation explicitly to KRL.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A061. Host Keys

  • Task: verify fingerprint and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A062. User Keys

  • Task: evaluate configuration and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A063. known_hosts

  • Task: justify risk and connect the observation explicitly to known_hosts.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A064. authorized_keys

  • Task: explain error path and connect the observation explicitly to authorized_keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A065. ssh_config

  • Task: classify log line and connect the observation explicitly to ssh_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A066. sshd_config

  • Task: document trust model and connect the observation explicitly to sshd_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A067. ProxyJump

  • Task: plan rotation and connect the observation explicitly to ProxyJump.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A068. Forwarding

  • Task: restrict access and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A069. CA

  • Task: review forwarding and connect the observation explicitly to CA.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A070. KRL

  • Task: describe recovery path and connect the observation explicitly to KRL.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A071. Host Keys

  • Task: verify fingerprint and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A072. User Keys

  • Task: evaluate configuration and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A073. known_hosts

  • Task: justify risk and connect the observation explicitly to known_hosts.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A074. authorized_keys

  • Task: explain error path and connect the observation explicitly to authorized_keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A075. ssh_config

  • Task: classify log line and connect the observation explicitly to ssh_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A076. sshd_config

  • Task: document trust model and connect the observation explicitly to sshd_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A077. ProxyJump

  • Task: plan rotation and connect the observation explicitly to ProxyJump.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A078. Forwarding

  • Task: restrict access and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A079. CA

  • Task: review forwarding and connect the observation explicitly to CA.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A080. KRL

  • Task: describe recovery path and connect the observation explicitly to KRL.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A081. Host Keys

  • Task: verify fingerprint and connect the observation explicitly to Host Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A082. User Keys

  • Task: evaluate configuration and connect the observation explicitly to User Keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A083. known_hosts

  • Task: justify risk and connect the observation explicitly to known_hosts.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A084. authorized_keys

  • Task: explain error path and connect the observation explicitly to authorized_keys.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A085. ssh_config

  • Task: classify log line and connect the observation explicitly to ssh_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A086. sshd_config

  • Task: document trust model and connect the observation explicitly to sshd_config.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A087. ProxyJump

  • Task: plan rotation and connect the observation explicitly to ProxyJump.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A088. Forwarding

  • Task: restrict access and connect the observation explicitly to Forwarding.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A089. CA

  • Task: review forwarding and connect the observation explicitly to CA.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A090. KRL

  • Task: describe recovery path and connect the observation explicitly to KRL.
  • Evidence: Record command, expected output, actual output, fingerprint or configuration line.
  • Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
  • Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
  • Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.
05 / 05

SSH · Orthevs Academy

31 modules as one continuous learning path.

The sequence remains unchanged: from the lab skeleton through technical foundations and operating models to final troubleshooting. The technical directory names are deliberately preserved.

Practice modules

Orthevs as an app

Install Orthevs

The Orthevs web app can be installed on supported mobile devices and desktop browsers.

iPhone and iPad

Open Orthevs in Safari. Tap Share, then Add to Home Screen. Enable Open as Web App if offered, then tap Add.

Android

For the web app, open the browser menu and choose Install app or Add to Home screen. Confirm the installation.

Desktop browser

Open the browser menu or the install icon in the address bar, then choose Install app or Add to Dock.

Web app installation depends on your browser. If no install prompt appears, follow the browser steps shown above.