Target State

This level covers Bastion Hosts, ProxyJump, Multiplexing, SSH-Zertifikate, Git/CI und Betriebsmodelle. You work with local test keys, sample configurations and evidence files. The goal is not only executing SSH access, but explaining trust, authentication, risks and recovery.

Level Context

SSH is often the last administrative access path to systems. Mistakes in key handling, host-key verification, bastion design or forwarding can affect direct production access. Every module therefore combines usage, review and security justification.

Task Sheet

Safe Workflow

git checkout -b workshop/<name>/ssh
ssh -V
./examples/00-lab-skeleton/run.sh

Technical Foundations

1. explain SSH protocol layers

This unit shows how to explain SSH protocol layers in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

2. distinguish OpenSSH client and server

This unit shows how to distinguish OpenSSH client and server in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

3. verify host-key trust

This unit shows how to verify host-key trust in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

4. generate and protect user keys

This unit shows how to generate and protect user keys in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

5. review permissions for .ssh

This unit shows how to review permissions for .ssh in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

6. debug public-key authentication

This unit shows how to debug public-key authentication in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

7. structure ssh_config with Host blocks

This unit shows how to structure ssh_config with Host blocks in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

8. review sshd_config safely

This unit shows how to review sshd_config safely in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

9. design ProxyJump and bastion paths

This unit shows how to design ProxyJump and bastion paths in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

10. control port forwarding

This unit shows how to control port forwarding in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

11. classify SFTP and safe file transfer

This unit shows how to classify SFTP and safe file transfer in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

12. use ssh-agent safely

This unit shows how to use ssh-agent safely in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

13. justify or reject agent forwarding

This unit shows how to justify or reject agent forwarding in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

14. model OpenSSH certificates and CA trust

This unit shows how to model OpenSSH certificates and CA trust in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

15. explain KRL and revocation

This unit shows how to explain KRL and revocation in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

16. classify FIDO2 keys

This unit shows how to classify FIDO2 keys in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

17. analyze logging and auth events

This unit shows how to analyze logging and auth events in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

18. weigh hardening options

This unit shows how to weigh hardening options in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

19. run incident response for key leakage

This unit shows how to run incident response for key leakage in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

20. test client and server configuration

This unit shows how to test client and server configuration in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

21. plan recovery for host-key rotation

This unit shows how to plan recovery for host-key rotation in the SSH context. Always check host-key trust, user identity, configuration, permissions, logs and possible tunnel or agent risks.

Typical review points:

• Which host is actually reached?
• Which user and which key are used?
• How is the host key verified?
• Which option allows or denies forwarding?
• Which recovery action exists for key leakage or host-key change?

Practice Modules

Module 1: host-key trust

1. Read the matching example in the examples/ directory.
2. Run run.sh and inspect evidence files below work/evidence/.
3. Deliberately change one configuration option and document the effect.
4. Add a production review rule.

Module 2: user keys

1. Read the matching example in the examples/ directory.
2. Run run.sh and inspect evidence files below work/evidence/.
3. Deliberately change one configuration option and document the effect.
4. Add a production review rule.

Module 3: client configuration

1. Read the matching example in the examples/ directory.
2. Run run.sh and inspect evidence files below work/evidence/.
3. Deliberately change one configuration option and document the effect.
4. Add a production review rule.

Module 4: server configuration

1. Read the matching example in the examples/ directory.
2. Run run.sh and inspect evidence files below work/evidence/.
3. Deliberately change one configuration option and document the effect.
4. Add a production review rule.

Module 5: bastion

1. Read the matching example in the examples/ directory.
2. Run run.sh and inspect evidence files below work/evidence/.
3. Deliberately change one configuration option and document the effect.
4. Add a production review rule.

Module 6: forwarding

1. Read the matching example in the examples/ directory.
2. Run run.sh and inspect evidence files below work/evidence/.
3. Deliberately change one configuration option and document the effect.
4. Add a production review rule.

Module 7: certificates

1. Read the matching example in the examples/ directory.
2. Run run.sh and inspect evidence files below work/evidence/.
3. Deliberately change one configuration option and document the effect.
4. Add a production review rule.

Module 8: logging

1. Read the matching example in the examples/ directory.
2. Run run.sh and inspect evidence files below work/evidence/.
3. Deliberately change one configuration option and document the effect.
4. Add a production review rule.

Required Exercises

• Exercise 01: Create or improve an SSH artifact focused on host-key trust and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 02: Create or improve an SSH artifact focused on user keys and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 03: Create or improve an SSH artifact focused on client configuration and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 04: Create or improve an SSH artifact focused on server configuration and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 05: Create or improve an SSH artifact focused on bastion and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 06: Create or improve an SSH artifact focused on forwarding and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 07: Create or improve an SSH artifact focused on certificates and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 08: Create or improve an SSH artifact focused on logging and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 09: Create or improve an SSH artifact focused on host-key trust and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 10: Create or improve an SSH artifact focused on user keys and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 11: Create or improve an SSH artifact focused on client configuration and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 12: Create or improve an SSH artifact focused on server configuration and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 13: Create or improve an SSH artifact focused on bastion and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 14: Create or improve an SSH artifact focused on forwarding and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 15: Create or improve an SSH artifact focused on certificates and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 16: Create or improve an SSH artifact focused on logging and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 17: Create or improve an SSH artifact focused on host-key trust and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 18: Create or improve an SSH artifact focused on user keys and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 19: Create or improve an SSH artifact focused on client configuration and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 20: Create or improve an SSH artifact focused on server configuration and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 21: Create or improve an SSH artifact focused on bastion and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 22: Create or improve an SSH artifact focused on forwarding and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 23: Create or improve an SSH artifact focused on certificates and submit fingerprint, configuration evaluation and risk analysis.
• Exercise 24: Create or improve an SSH artifact focused on logging and submit fingerprint, configuration evaluation and risk analysis.

Success Criteria

• Private test keys exist only below work/.
• Host-key trust is explained.
• ssh -G or ssh-keygen output exists as evidence.
• Forwarding and agent use are justified.
• Server options are not blindly claimed as defaults.
• Recovery for key rotation or revocation is described.

Sources and References

• OpenSSH Manual Pages
• OpenSSH Release Notes
• ssh(1) OpenBSD Manual
• sshd(8) OpenBSD Manual
• ssh_config(5) OpenBSD Manual
• sshd_config(5) OpenBSD Manual
• ssh-keygen(1) OpenBSD Manual
• RFC 4251 SSH Protocol Architecture
• RFC 4252 SSH Authentication Protocol
• RFC 4253 SSH Transport Layer Protocol

Review Checklist for Professional

• 01. document host-key trust: Record the affected host, user, key, configuration and risk.
• 02. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 03. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 04. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 05. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 06. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 07. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 08. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 09. keep certificate validity short: Record the affected host, user, key, configuration and risk.
• 10. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
• 11. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
• 12. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
• 13. document host-key trust: Record the affected host, user, key, configuration and risk.
• 14. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 15. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 16. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 17. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 18. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 19. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 20. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 21. keep certificate validity short: Record the affected host, user, key, configuration and risk.
• 22. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
• 23. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
• 24. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
• 25. document host-key trust: Record the affected host, user, key, configuration and risk.
• 26. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 27. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 28. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 29. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 30. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 31. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 32. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 33. keep certificate validity short: Record the affected host, user, key, configuration and risk.
• 34. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
• 35. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
• 36. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
• 37. document host-key trust: Record the affected host, user, key, configuration and risk.
• 38. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 39. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 40. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 41. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 42. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 43. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 44. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 45. keep certificate validity short: Record the affected host, user, key, configuration and risk.
• 46. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
• 47. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
• 48. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
• 49. document host-key trust: Record the affected host, user, key, configuration and risk.
• 50. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 51. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 52. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 53. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 54. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 55. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 56. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 57. keep certificate validity short: Record the affected host, user, key, configuration and risk.
• 58. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
• 59. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
• 60. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.

Practice Appendix: Professional

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSH client tools, test keys and sample configurations.

A001. host-key trust

• Task: verify fingerprint and connect the observation explicitly to host-key trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A002. user keys

• Task: evaluate configuration and connect the observation explicitly to user keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A003. client configuration

• Task: justify risk and connect the observation explicitly to client configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A004. server configuration

• Task: explain error path and connect the observation explicitly to server configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A005. bastion

• Task: classify log line and connect the observation explicitly to bastion.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A006. forwarding

• Task: document trust model and connect the observation explicitly to forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A007. certificates

• Task: plan rotation and connect the observation explicitly to certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A008. logging

• Task: restrict access and connect the observation explicitly to logging.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A009. host-key trust

• Task: review forwarding and connect the observation explicitly to host-key trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A010. user keys

• Task: describe recovery path and connect the observation explicitly to user keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A011. client configuration

• Task: verify fingerprint and connect the observation explicitly to client configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A012. server configuration

• Task: evaluate configuration and connect the observation explicitly to server configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A013. bastion

• Task: justify risk and connect the observation explicitly to bastion.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A014. forwarding

• Task: explain error path and connect the observation explicitly to forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A015. certificates

• Task: classify log line and connect the observation explicitly to certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A016. logging

• Task: document trust model and connect the observation explicitly to logging.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A017. host-key trust

• Task: plan rotation and connect the observation explicitly to host-key trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A018. user keys

• Task: restrict access and connect the observation explicitly to user keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A019. client configuration

• Task: review forwarding and connect the observation explicitly to client configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A020. server configuration

• Task: describe recovery path and connect the observation explicitly to server configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A021. bastion

• Task: verify fingerprint and connect the observation explicitly to bastion.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A022. forwarding

• Task: evaluate configuration and connect the observation explicitly to forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A023. certificates

• Task: justify risk and connect the observation explicitly to certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A024. logging

• Task: explain error path and connect the observation explicitly to logging.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A025. host-key trust

• Task: classify log line and connect the observation explicitly to host-key trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A026. user keys

• Task: document trust model and connect the observation explicitly to user keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A027. client configuration

• Task: plan rotation and connect the observation explicitly to client configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A028. server configuration

• Task: restrict access and connect the observation explicitly to server configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A029. bastion

• Task: review forwarding and connect the observation explicitly to bastion.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A030. forwarding

• Task: describe recovery path and connect the observation explicitly to forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A031. certificates

• Task: verify fingerprint and connect the observation explicitly to certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A032. logging

• Task: evaluate configuration and connect the observation explicitly to logging.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A033. host-key trust

• Task: justify risk and connect the observation explicitly to host-key trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A034. user keys

• Task: explain error path and connect the observation explicitly to user keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A035. client configuration

• Task: classify log line and connect the observation explicitly to client configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A036. server configuration

• Task: document trust model and connect the observation explicitly to server configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A037. bastion

• Task: plan rotation and connect the observation explicitly to bastion.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A038. forwarding

• Task: restrict access and connect the observation explicitly to forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A039. certificates

• Task: review forwarding and connect the observation explicitly to certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A040. logging

• Task: describe recovery path and connect the observation explicitly to logging.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A041. host-key trust

• Task: verify fingerprint and connect the observation explicitly to host-key trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A042. user keys

• Task: evaluate configuration and connect the observation explicitly to user keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A043. client configuration

• Task: justify risk and connect the observation explicitly to client configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A044. server configuration

• Task: explain error path and connect the observation explicitly to server configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A045. bastion

• Task: classify log line and connect the observation explicitly to bastion.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A046. forwarding

• Task: document trust model and connect the observation explicitly to forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A047. certificates

• Task: plan rotation and connect the observation explicitly to certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A048. logging

• Task: restrict access and connect the observation explicitly to logging.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A049. host-key trust

• Task: review forwarding and connect the observation explicitly to host-key trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A050. user keys

• Task: describe recovery path and connect the observation explicitly to user keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A051. client configuration

• Task: verify fingerprint and connect the observation explicitly to client configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A052. server configuration

• Task: evaluate configuration and connect the observation explicitly to server configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A053. bastion

• Task: justify risk and connect the observation explicitly to bastion.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A054. forwarding

• Task: explain error path and connect the observation explicitly to forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A055. certificates

• Task: classify log line and connect the observation explicitly to certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A056. logging

• Task: document trust model and connect the observation explicitly to logging.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A057. host-key trust

• Task: plan rotation and connect the observation explicitly to host-key trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A058. user keys

• Task: restrict access and connect the observation explicitly to user keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A059. client configuration

• Task: review forwarding and connect the observation explicitly to client configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A060. server configuration

• Task: describe recovery path and connect the observation explicitly to server configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A061. bastion

• Task: verify fingerprint and connect the observation explicitly to bastion.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A062. forwarding

• Task: evaluate configuration and connect the observation explicitly to forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A063. certificates

• Task: justify risk and connect the observation explicitly to certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A064. logging

• Task: explain error path and connect the observation explicitly to logging.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A065. host-key trust

• Task: classify log line and connect the observation explicitly to host-key trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A066. user keys

• Task: document trust model and connect the observation explicitly to user keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A067. client configuration

• Task: plan rotation and connect the observation explicitly to client configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A068. server configuration

• Task: restrict access and connect the observation explicitly to server configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A069. bastion

• Task: review forwarding and connect the observation explicitly to bastion.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A070. forwarding

• Task: describe recovery path and connect the observation explicitly to forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A071. certificates

• Task: verify fingerprint and connect the observation explicitly to certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A072. logging

• Task: evaluate configuration and connect the observation explicitly to logging.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A073. host-key trust

• Task: justify risk and connect the observation explicitly to host-key trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A074. user keys

• Task: explain error path and connect the observation explicitly to user keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A075. client configuration

• Task: classify log line and connect the observation explicitly to client configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A076. server configuration

• Task: document trust model and connect the observation explicitly to server configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A077. bastion

• Task: plan rotation and connect the observation explicitly to bastion.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A078. forwarding

• Task: restrict access and connect the observation explicitly to forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A079. certificates

• Task: review forwarding and connect the observation explicitly to certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A080. logging

• Task: describe recovery path and connect the observation explicitly to logging.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A081. host-key trust

• Task: verify fingerprint and connect the observation explicitly to host-key trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A082. user keys

• Task: evaluate configuration and connect the observation explicitly to user keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A083. client configuration

• Task: justify risk and connect the observation explicitly to client configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A084. server configuration

• Task: explain error path and connect the observation explicitly to server configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A085. bastion

• Task: classify log line and connect the observation explicitly to bastion.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A086. forwarding

• Task: document trust model and connect the observation explicitly to forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A087. certificates

• Task: plan rotation and connect the observation explicitly to certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A088. logging

• Task: restrict access and connect the observation explicitly to logging.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A089. host-key trust

• Task: review forwarding and connect the observation explicitly to host-key trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A090. user keys

• Task: describe recovery path and connect the observation explicitly to user keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A091. client configuration

• Task: verify fingerprint and connect the observation explicitly to client configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A092. server configuration

• Task: evaluate configuration and connect the observation explicitly to server configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A093. bastion

• Task: justify risk and connect the observation explicitly to bastion.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A094. forwarding

• Task: explain error path and connect the observation explicitly to forwarding.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A095. certificates

• Task: classify log line and connect the observation explicitly to certificates.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A096. logging

• Task: document trust model and connect the observation explicitly to logging.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A097. host-key trust

• Task: plan rotation and connect the observation explicitly to host-key trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A098. user keys

• Task: restrict access and connect the observation explicitly to user keys.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A099. client configuration

• Task: review forwarding and connect the observation explicitly to client configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A100. server configuration

• Task: describe recovery path and connect the observation explicitly to server configuration.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.