Configure & Secure SSH

Question 1

What username will be prompted for a password when omiting username from the ssh command? (e.g. ssh hostname)

Answer 1

The current user’s username.

Question 2

What CLI command will log you out of an ssh connection?

Answer 2

exit

Question 3

What CLI command will initiate an ssh connection as username with host server.

Answer 3

ssh username@host

Question 4

What CLI command will show the hostname of a remote server without accessing the remote interactive shell?

Answer 4

ssh username@host hostname

Question 5

What Linux CLI command will list the currently logged in users along with the remote location they logged in from?

Answer 5

w -f

Question 6

In what files (global and user) are the public keys for known hosts kept?

Answer 6

/etc/ssh/ssh_known_hosts and ~/.ssh/known_hosts

Question 7

With StrictHostKeyChecking enabled, what will happen if the public keys don’t match on ssh login?

Answer 7

ssh will abort the connection.

Question 8

In what two ways can you enable Strict HostKeyChecking for ssh connections?

Answer 8

1. Add StrictHostKeyChecking=yes to ~/.ssh/config or /etc/ssh/ssh_config
2. Add the option -o StrictHostKeyChecking=yes to the ssh command

Red Hat recommends always enabling StrictHostKeyChecking.

Question 9

What CLI command is used to display a host’s ssh public key?

Answer 9

ssh-keygen -lf /etc/ssh/filename.pub

Question 10

How does Red Hat recommend sharing a hosts public key for use with ssh?

Answer 10

Use an out-of-band communication channel such as email, phone call, or video conference.

Question 11

What three fields are contained in a hosts entry in the client’s known_hosts file?

Answer 11

1. hostname or IP address
2. Encryption algorythm used
3. the public key

Question 12

What must you do if ssh warns that a remote host’s identification has changed?

Answer 12

Manually modify the clients known_hosts file with the correct public key or IP address, or remove the host’s entry from the file and reconnect to obtain a new public key.

This warning is an indication of a possible malicious attack.

Question 13

What CLI command will find and remove a host’s key entry from the known_hosts file?

Answer 13

ssh-keygen -R *remotehostname* -f filename

(

~/.ssh/known_hosts

or

/etc/ssh/ssh_known_hosts

)

Question 14

Wher does the

ssh-keygen

command save your public and private keys by default?

Answer 14

~/.ssh/id_rsa

and

~/.ssh/id_rsa.pub

Question 15

What CLi command will generate a key pair for ssh login?

Answer 15

ssh-keygen

Question 16

Why is adding a passphrase to a key pair more secure than just using a password for ssh login?

Answer 16

A login password is sent in the clear to the remote computer for authentication, while the key pair’s passphrase is used locally to decrypt the private key before use.

Question 17

What

ssh-keygen

option flag is used to specify the file name to store the key pair?

Answer 17

-f ~/.ssh/filename

Question 18

What read and write permissions are the

ssh-keygen

generated key pair assigned by default?

Answer 18

• public key

  -rw-------

  or 600
• private key

  -rw-r--r--

  or 644

Question 19

What CLI command is used to copy your public key to a remote host?

Answer 19

ssh-copy-id -i ~/.ssh/filename user@remotehost

Ommit “

-i ~/.ssh/filename

” to copy the default public key

Question 20

What does the

ssh-agent

key manager do?

Answer 20

Caches key pair passphrases for ssh login, which further limits passphrase exposure.

Question 21

What CLI command is used to manually enable the ssh-agent key manager?

Answer 21

eval $(ssh-agent)

Must be manually started when logged in to a text environment

Question 22

What CLI command is used to manually load your private key passphrase to the

ssh-agent

key manager?

Answer 22

ssh-add

or

ssh-add ~/.ssh/filename

ssh-add without a filename will add the default id_rsa passphrase.

Question 23

What

ssh

option flag(s) would you use to help troubleshoot ssh login issues?

Answer 23

-v | -vv | -vvv

Question 24

In what file are configuration options for a users ssh logins stored?

Answer 24

~/.ssh/config

Question 25

What file is edited to configure sshd?

Answer 25

/etc/ssh/sshd_config

Question 26

What setting in sshd_config do you edit to prohibit loging as root

Answer 26

PermitRootLogin no

Question 27

What CLI command do you run to apply any changes to sshd_config

Answer 27

systemctl reload sshd

Question 28

What setting in sshd_config do you edit to prohibit any password based authentication by ssh

Answer 28

PasswordAuthentication no

Make sure a public key has been shared with the host before changing.