Auditing and hardening SSH and GPG
You understand the SSH handshake and algorithms and narrow them to company policy, verify host keys, scale access with a key inventory and SSH certificates, and set up a GPG key policy, an offline primary key and a revocation process.
Level 301 · 15 lessons · 12 practice labs
Lessons
SSH cryptography
- The SSH handshake: key exchange, host key, user authentication
- Verifying the host key: known_hosts and SSHFP
- Narrowing the SSH algorithm list to company policy
- Configuration audit with ssh-audit
- Short task: disable weak SSH algorithms on the lab server and verify
SSH key management
- Key types and lengths: Ed25519, RSA, ECDSA
- Protecting private keys: passphrase, agent and hardware key
- Scalable access with SSH certificates
- Key inventory and rotation
- Short task: set up a small SSH certificate authority and issue a time-limited certificate to a user
GPG
- GPG key policy: subkeys, expiry and backup
- Keeping the primary key offline
- Verifying package and release signatures
- The revocation certificate and what to do when a key is lost
- Capstone: audit and rebuild a team’s SSH and GPG key set-up
Practice labs
- Audit the SSH server's algorithm list: Scan the lab SSH server with a configuration audit tool and list key exchange, cipher and MAC algorithms that break company policy.
- Disable weak SSH algorithms and verify: Remove weak algorithms from the server configuration, reload the service and repeat the audit until it comes back clean.
- Bring three servers to policy without breaking an old client: Bring Yakamoz Telekom's three lab servers to policy, test an old management client's compatibility and report the documented exception.
- Verify the server key fingerprint: Compare the fingerprint shown on first connection to the lab server with the server-side value and add the verified entry.
- Investigate a changed host key warning: Prove whether the host-key-changed warning on the lab client comes from a reinstall or something else, and update the entry safely.
- Publish and verify host keys through DNS: Add SSHFP records to the lab DNS server, show the client verifies the key through DNS and document the process.
- Inventory the authorised SSH keys on a server: Collect all authorised key files on the lab server, record type, length and owner, and flag keys with no known owner.
- Replace weak SSH keys and remove the old ones: Replace short RSA and DSA keys with Ed25519 and verify the old keys are no longer accepted.
- Set up a small SSH certificate authority and issue time-limited certificates: Set up an SSH certificate authority for the lab, issue a one-hour certificate to a user and prove access ends when it expires.
- Verify a package signature and reject an unsigned package: Verify the signatures of two packages in the lab repository, reject the one that fails without installing it and note why.
- Restructure a GPG key with subkeys and expiry: Create signing and encryption subkeys with expiry for a team member using a single non-expiring key, and back up the primary key offline.
- Audit and rebuild a team's SSH and GPG key setup: Audit the Bakırdere Madencilik team's keys, resolve missing revocation certificates and a lost-key scenario, and document the new setup.
About this course
You understand the SSH handshake and algorithms and narrow them to company policy, verify host keys, scale access with a key inventory and SSH certificates, and set up a GPG key policy, an offline primary key and a revocation process.
What you will learn
- SSH cryptography
- SSH key management
- GPG
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.