Exercise: Secure remote access review

Secure remote access review

• Set up key authentication and a host alias.
• Harden sshd with a correctly named drop-in.
• Transfer and mirror files with scp and rsync.

Before you start: reset the servers and complete this chapter's lessons. You work on workstation as student and use ssh root@servera for the administration. The grader looks at the hardening settings, the account, the copied files and your answers.txt; it connects to servera as root with a key, so do not set PermitRootLogin no.

1. On servera, create the account ops (password Ops-Pass-2026). On workstation, create the key ~/.ssh/id_ops and install it with ssh-copy-id. Add a Host opsa alias to ~/.ssh/config.
2. In /etc/ssh/sshd_config.d/10-hardening.conf on servera, set PasswordAuthentication no, X11Forwarding no, MaxAuthTries 3 and LoginGraceTime 30. Check with sshd -T and reload. Keep a second session open while you do it.
3. Copy inventory.txt to the home directory of ops.
4. Copy reports/ into /home/ops/mirror/ with rsync. Then delete reports/b.txt locally and run rsync with --delete.
5. Put servera's Ed25519 host key fingerprint and key type in answers.txt.

Start the exercise

[student@workstation ~]$ lab start sa-ssh-review
[student@workstation ~]$ cd ~/sa-ssh-review
[student@workstation sa-ssh-review]$

Account, key and alias

[student@workstation sa-ssh-review]$ ssh root@servera "useradd -m ops && echo 'Ops-Pass-2026' | passwd --stdin ops"
[student@workstation sa-ssh-review]$ ssh-keygen -t ed25519 -f ~/.ssh/id_ops -N '' -C 'student@workstation (ops)'
[student@workstation sa-ssh-review]$ ssh-copy-id -i ~/.ssh/id_ops.pub ops@servera
[student@workstation sa-ssh-review]$ cat >> ~/.ssh/config <<'EOT'

Host opsa
    HostName servera
    User ops
    IdentityFile ~/.ssh/id_ops
    IdentitiesOnly yes
EOT
[student@workstation sa-ssh-review]$ ssh opsa hostname
servera.lab.example.com

Harden sshd

[student@workstation sa-ssh-review]$ ssh root@servera
[root@servera ~]# printf 'PasswordAuthentication no\nX11Forwarding no\nMaxAuthTries 3\nLoginGraceTime 30\n' > /etc/ssh/sshd_config.d/10-hardening.conf
[root@servera ~]# sshd -t && systemctl reload sshd
[root@servera ~]# sshd -T | grep -E '^(passwordauthentication|x11forwarding|maxauthtries|logingracetime) '
logingracetime 30
maxauthtries 3
passwordauthentication no
x11forwarding no

In a second terminal, run ssh opsa hostname to prove the key login still works before you close the first session.

Copy and mirror

[student@workstation sa-ssh-review]$ scp inventory.txt opsa:
[student@workstation sa-ssh-review]$ rsync -av reports/ opsa:mirror/
[student@workstation sa-ssh-review]$ rm reports/b.txt
[student@workstation sa-ssh-review]$ rsync -avn --delete reports/ opsa:mirror/
[student@workstation sa-ssh-review]$ rsync -av --delete reports/ opsa:mirror/
[student@workstation sa-ssh-review]$ ssh opsa ls mirror
a.txt
c.txt

Record the fingerprint and grade

Fill in answers.txt (use ssh-keygen -lF servera; the type is the word ED25519 in the listing), then:

Check your work with lab grade sa-ssh-review, then put the exercise away with lab finish sa-ssh-review.