NETW-0014 Week 1, Day 3 — SSH Keys & Hardening

Explain how key authentication works.

The client offers a public key; the server looks it up in ~/.ssh/authorized_keys; the client then signs data that includes the session identifier with its private key, and the server verifies the signature with the public key. The private key never leaves the client and nothing secret crosses the wire. (A common shorthand says the server encrypts a challenge; the real protocol uses a signature. Do not repeat the simplified version.)

Why does a key beat a password?

Nothing to intercept or replay, nothing to guess online, no server-side password hashes to steal.

What are the two key authentication files and what must be done so sshd doesn’t ignore the key?

The two files: id_rsa never leaves your PC; id_rsa.pub goes on servers. ~/.ssh must be mode 700 and authorized_keys mode 600, or sshd silently ignores the key.

What is the difference between 4096-bit RSA and Ed25519 keys?

This course uses 4096-bit RSA, which is fine and universally supported. Ed25519 keys are shorter and fast, the modern default, and supported everywhere we care about. A passphrase plus ssh-agent is the production habit; we skip the passphrase in the lab.

What does /etc/ssh/sshd_config start with?

Include /etc/ssh/sshd_config.d/*.conf

How are drop-in files read?

Drop-in files are read first, in lexical order, and for most directives the first value found wins. So a drop-in overrides the main file, and a file named 00-… beats 50-….

What does a Match block do?

A Match block (for a user, group or address) applies its settings only to matching connections and can silently re-enable something you disabled. Putting your changes in your own drop-in leaves the packaged file untouched and makes the change copyable to other machines.

What does sshd -t do?

Checks syntax

What does sshd -T do and what is the rule associated with it?

sshd -T prints the effective configuration after Includes and defaults. Rule: never trust the file you edited, trust sshd -T.

What is the change-control routine?

(this is what separates a hardened server from a locked-out one): checkpoint the VM and back the file up; edit; sshd -t; restart; test from a second, new session while the first stays open; close nothing until the new login works. The Hyper-V console is the last resort, not the plan.

What is sshd normally started by?

systemd's ssh.socket, and the socket decides the listening port

After changing Port , what should you check?

Check ss -tlnp and if it still shows 22 run systemctl daemon-reload and restart ssh.socket

What does ClientAliveInterval do?

SSH has no idle timeout of its own: ClientAliveInterval only detects dead connections.

How is an idle user ended by the shell?

via TMOUT (readonly and exported, set in /etc/profile.d/).

Is changing the SSH port a security control?

No, it reduces noise

What does AllowUsers protect against that PermitRootLogin no does not?

Any other account, including ones created later.

What is the likely cause and the fix for the following issue:

SSH still prompts for a password after the key copy

Wrong permissions or ownership on ~/.ssh or authorized_keys

chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys; check ownership with ls -la ~/.ssh

What is the likely cause and the fix for the following issue:

authorized_keys exists but the key is refused

Private key copied instead of public key

cat ~/.ssh/authorized_keys must start with ssh-rsa; if it starts with -----BEGIN, delete the file and copy the .pub file

What is the likely cause and the fix for the following issue:

Connection refused on a desktop

The Ubuntu Desktop has no SSH server

sudo apt install openssh-server curl, then systemctl status ssh

What is the likely cause and the fix for the following issue:

Passwords still work after PasswordAuthentication no

A second definition (Match block or another drop-in sorted earlier) wins

sudo sshd -T | grep -i passwordauth; grep -rn -i passwordauthentication /etc/ssh/; name your drop-in 00-hardening.conf so it is read first

What is the likely cause and the fix for the following issue:

Port change has no effect

ssh.socket still listens on the old port

sudo systemctl daemon-reload && sudo systemctl restart ssh.socket, then recheck with sudo ss -tlnp | grep ssh

What is the likely cause and the fix for the following issue:

Locked out after changing the port or config

Config or port wrong and no session left open

Use the Hyper-V console and fix or remove the drop-in, or restore the Lab1C-pre-hardening checkpoint

What is the likely cause and the fix for the following issue:

AllowUsers blocks the student account

Username typo (case-sensitive)

whoami on the VM; correct the line and restart

What is the likely cause and the fix for the following issue:

No banner appears

Wrong file path, or not restarted

ls -l /etc/ssh_banner; match the Banner path exactly; restart ssh

What is the likely cause and the fix for the following issue:

TMOUT does nothing

Applies to new login sessions only

Log out completely and open a new session