SSH: keys and tunnels
Connecting to a server securely: the host key, key authentication, the agent, tunnels and the bastion, and the right reflexes when something looks wrong.
- 39 cards
- 3 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- The connection
- Keys
- Tunnels and bastion
A few cards from the deck
What is SSH?
Show the answer
The encrypted remote access protocol (port 22) that authenticates the server and the user, then opens a terminal or transfers files.
It replaced Telnet, which sent everything in clear, passwords included.
“REMOTE HOST IDENTIFICATION HAS CHANGED” shows at login. What should you do?
- Change your password and try again
- Check the fingerprint through another channel before updating known_hosts
- Delete the line and carry on without checking
- Turn off host key checking
Show the answer
Check the fingerprint through another channel before updating known_hosts
The server may have been reinstalled, or someone is in the middle: only an independent check tells.
A private key with or without a passphrase?
Show the answer
With: a stolen key stays unusable without it, and the agent saves typing it at every connection.
The passphrase encrypts the private key on disk; the agent keeps the decrypted copy in memory only.
SSH login with a key: after “Versions and Diffie-Hellman key exchange”, what is the next message?
- Challenge: prove you hold the private key
- Signature of the challenge with the private key
- Host key and signature of the exchange
- Public key authentication request
Show the answer
Host key and signature of the exchange
The client compares the fingerprint with the one in known_hosts.