SSH Workshop – Overview · SSH

Overview

This workshop covers the path from the first safe OpenSSH login to bastion hosts, certificates, hardening, logging and incident response.

The focus is on:

SSH protocol model and OpenSSH tools
host-key trust, known_hosts and fingerprints
user keys, permissions, agent and public-key authentication
ssh_config, sshd_config, debugging and logs
SFTP, port forwarding, ProxyJump and bastion hosts
OpenSSH certificates, KRL, FIDO2 model and rotation
hardening, break glass and incident response

Quickstart

# Workshop content is provided through the Orthevs Academy.
chmod +x scripts/provision_ssh.sh
./scripts/provision_ssh.sh --dry-run
./examples/00-lab-skeleton/run.sh

Audience

Developers, administrators, DevOps engineers, SREs, platform engineers, security engineers and everyone who designs, operates, debugs or secures SSH access.

Learning Path

Level	Focus	Outcome
Fundamentals	Protokollmodell, erster Login, Host Keys, Public Keys, Dateirechte und sichere Grundbefehle	You can explain, locally check and review the related SSH patterns.
Intermediate	Client- und Serverkonfiguration, Agent, Debugging, Forwarding, SFTP und Auth-Fehler	You can explain, locally check and review the related SSH patterns.
Professional	Bastion Hosts, ProxyJump, Multiplexing, SSH-Zertifikate, Git/CI und Betriebsmodelle	You can explain, locally check and review the related SSH patterns.
Advanced Security	Hardening, Algorithmuspflege, FIDO2, KRL, Forensik, Logging und Incident Response	You can explain, locally check and review the related SSH patterns.

Structure

Workshop Structure

.
├── assessments/
├── docs/
├── examples/
├── exercises/
├── media/
├── scripts/
├── workshops/
├── LICENSE.md
└── README-EN.md

Prerequisites

Linux, macOS or WSL
OpenSSH client (ssh, ssh-keygen)
Git
optional OpenSSH server (sshd) for real server labs
optional nc, sftp, ssh-audit, Fail2ban or security-key hardware

Official Documentation

Working Mode

Do not use production hosts, keys, passwords or customer data in labs.
Private test keys are created only below work/ and are not committed.
Connections to real systems require explicit authorization.
Forwarding, agent forwarding and bastion paths are documented and justified.

Sources and References

Review Checklist for the Workshop

01. document host-key trust: Record the affected host, user, key, configuration and risk.
02. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
03. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
04. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
05. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
06. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
07. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
08. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
09. keep certificate validity short: Record the affected host, user, key, configuration and risk.
10. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
11. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
12. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
13. document host-key trust: Record the affected host, user, key, configuration and risk.
14. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
15. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
16. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
17. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
18. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
19. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
20. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
21. keep certificate validity short: Record the affected host, user, key, configuration and risk.
22. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
23. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
24. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
25. document host-key trust: Record the affected host, user, key, configuration and risk.
26. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
27. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
28. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
29. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
30. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
31. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
32. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
33. keep certificate validity short: Record the affected host, user, key, configuration and risk.
34. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
35. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
36. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.

Practice Appendix: Workshop

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSH client tools, test keys and sample configurations.

A001. OpenSSH

Task: verify fingerprint and connect the observation explicitly to OpenSSH.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A002. Trust

Task: evaluate configuration and connect the observation explicitly to Trust.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A003. Keys

Task: justify risk and connect the observation explicitly to Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A004. Bastion

Task: explain error path and connect the observation explicitly to Bastion.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A005. Security

Task: classify log line and connect the observation explicitly to Security.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A006. OpenSSH

Task: document trust model and connect the observation explicitly to OpenSSH.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A007. Trust

Task: plan rotation and connect the observation explicitly to Trust.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A008. Keys

Task: restrict access and connect the observation explicitly to Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A009. Bastion

Task: review forwarding and connect the observation explicitly to Bastion.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A010. Security

Task: describe recovery path and connect the observation explicitly to Security.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A011. OpenSSH

Task: verify fingerprint and connect the observation explicitly to OpenSSH.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A012. Trust

Task: evaluate configuration and connect the observation explicitly to Trust.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A013. Keys

Task: justify risk and connect the observation explicitly to Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A014. Bastion

Task: explain error path and connect the observation explicitly to Bastion.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A015. Security

Task: classify log line and connect the observation explicitly to Security.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A016. OpenSSH

Task: document trust model and connect the observation explicitly to OpenSSH.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A017. Trust

Task: plan rotation and connect the observation explicitly to Trust.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A018. Keys

Task: restrict access and connect the observation explicitly to Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A019. Bastion

Task: review forwarding and connect the observation explicitly to Bastion.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A020. Security

Task: describe recovery path and connect the observation explicitly to Security.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A021. OpenSSH

Task: verify fingerprint and connect the observation explicitly to OpenSSH.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A022. Trust

Task: evaluate configuration and connect the observation explicitly to Trust.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A023. Keys

Task: justify risk and connect the observation explicitly to Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A024. Bastion

Task: explain error path and connect the observation explicitly to Bastion.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A025. Security

Task: classify log line and connect the observation explicitly to Security.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A026. OpenSSH

Task: document trust model and connect the observation explicitly to OpenSSH.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A027. Trust

Task: plan rotation and connect the observation explicitly to Trust.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A028. Keys

Task: restrict access and connect the observation explicitly to Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A029. Bastion

Task: review forwarding and connect the observation explicitly to Bastion.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A030. Security

Task: describe recovery path and connect the observation explicitly to Security.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A031. OpenSSH

Task: verify fingerprint and connect the observation explicitly to OpenSSH.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A032. Trust

Task: evaluate configuration and connect the observation explicitly to Trust.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A033. Keys

Task: justify risk and connect the observation explicitly to Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A034. Bastion

Task: explain error path and connect the observation explicitly to Bastion.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A035. Security

Task: classify log line and connect the observation explicitly to Security.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A036. OpenSSH

Task: document trust model and connect the observation explicitly to OpenSSH.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A037. Trust

Task: plan rotation and connect the observation explicitly to Trust.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A038. Keys

Task: restrict access and connect the observation explicitly to Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A039. Bastion

Task: review forwarding and connect the observation explicitly to Bastion.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A040. Security

Task: describe recovery path and connect the observation explicitly to Security.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A041. OpenSSH

Task: verify fingerprint and connect the observation explicitly to OpenSSH.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A042. Trust

Task: evaluate configuration and connect the observation explicitly to Trust.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A043. Keys

Task: justify risk and connect the observation explicitly to Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A044. Bastion

Task: explain error path and connect the observation explicitly to Bastion.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A045. Security

Task: classify log line and connect the observation explicitly to Security.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A046. OpenSSH

Task: document trust model and connect the observation explicitly to OpenSSH.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A047. Trust

Task: plan rotation and connect the observation explicitly to Trust.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A048. Keys

Task: restrict access and connect the observation explicitly to Keys.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A049. Bastion

Task: review forwarding and connect the observation explicitly to Bastion.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A050. Security

Task: describe recovery path and connect the observation explicitly to Security.
Evidence: Record command, expected output, actual output, fingerprint or configuration line.
Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.