Auditing remote access paths: SSH, remote desktop and VPN
You audit SSH, RDP, VNC, remote support tools and VPN gateways: you measure configuration and algorithm choices, the key inventory, MFA coverage and patch status, and bring access into one monitored model.
Level 401 · 16 lessons · 18 practice labs
Lessons
SSH
- Reviewing sshd_config: root login, password login, allowed users
- Auditing SSH algorithms: key exchange, ciphers and MACs
- The authorised-keys inventory: whose key is where
- Short task: bring an SSH server to the company standard and verify with ssh-audit
Remote desktop
- Network level authentication and encryption on RDP
- VNC: password-less sessions open to the internet
- Inventory and audit of remote support tools
- Short task: move remote desktop access behind a gateway
VPN and gateways
- Auditing VPN configuration: protocol, cipher, authentication
- Split tunnelling and client security policies
- Patch tracking on remote-access appliances
- Multi-factor coverage for remote access
- Short task: audit the lab VPN gateway and prioritise the findings
Monitoring
- Monitoring remote access logs: unusual times and places
- Funnelling admin access through a jump host
- Capstone: audit all of the organisation’s remote access paths and propose one model
Practice labs
- Audit and disable root login in sshd_config: Audit root and password login in the lab server's SSH configuration, disable both and verify by reconnecting.
- Limit SSH access to allowed users and groups: Allow SSH login on Yakamoz Telekom's server only for the admin group and prove from the log that another account is refused.
- Bring an SSH server up to the company standard and verify: Apply the ten items of Pusulaya Sigorta's SSH standard on the server, verify with an audit tool and report any deviations with reasons.
- List the algorithms the SSH server offers: Extract the key exchange, cipher and MAC algorithms with an SSH audit tool and tabulate those flagged as weak.
- Remove weak SSH algorithms and test clients: Remove the weak algorithms from the configuration, audit again and check that an old and a new client can both connect.
- Replace an old host key and announce it to clients: Replace the short RSA host key with a modern key, publish its fingerprint and apply transition steps that avoid client warnings.
- Inventory the authorized keys on a server: Scan every user's authorized_keys file on the lab server and list each key with owner, type and comment.
- Find and remove a departed employee's key: Find the key belonging to an employee who left on Karaçam Mobilya's three servers, remove it and verify login with it is refused.
- Restrict an automation key by command and source address: Add a source-address and forced-command restriction to the key the backup script uses and test that no other command can run.
- Find and close a passwordless VNC session: Find the VNC service that asks for no password in the lab network, add a password and local binding and verify outside access is closed.
- Audit network level authentication on remote desktop: Audit the network level authentication and encryption settings of remote desktop on the Windows lab server and fix the gaps.
- Inventory remote support tools and reduce them: Find the remote support tools installed on Kumsal Turizm's lab machines, choose the approved one, remove the rest and put access behind the gateway.
- Audit the protocol and cipher settings of the VPN configuration: Extract the protocol, cipher and authentication settings from the lab VPN gateway's configuration and mark them against policy.
- Measure multi-factor coverage for remote access: Find the accounts without multi-factor authentication in Selvikent Belediyesi's VPN user list, justify exceptions and enrol the rest.
- Audit the lab VPN gateway and prioritise findings: Validate the outdated software, split-tunnel policy and weak cipher findings, prioritise them and apply the patch and configuration fix.
- Find unusual hours in remote access logs: Extract out-of-hours logins from a week of SSH and VPN logs and prepare a per-account summary table.
- Funnel management access through a jump host: Close direct SSH access to three servers, route access through the jump host and verify direct connections are refused.
- Audit every remote access path and propose a single model: Map the SSH, remote desktop, VPN and remote support paths at Bakırdere Madencilik, compare their risks and report a single-gateway model.
About this course
You audit SSH, RDP, VNC, remote support tools and VPN gateways: you measure configuration and algorithm choices, the key inventory, MFA coverage and patch status, and bring access into one monitored model.
What you will learn
- SSH
- Remote desktop
- VPN and gateways
- Monitoring
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.