Get ready for your next interview with our comprehensive question library
A bastion host is a dedicated server that acts as a secure gateway between external networks (like the internet) and internal private networks. It's typically placed in a DMZ (Demilitarized Zone) and serves as the only entry point for administrative access to internal systems.
Key purposes:
Example: Instead of exposing SSH ports on 50 internal servers to the internet, you expose only one bastion host and require administrators to connect through it to reach internal systems.
Difficulty: Beginner
Answer:
Essential parameters in /etc/ssh/sshd_config:
# Disable root login
PermitRootLogin no
# Use key-based authentication only
PasswordAuthentication no
PubkeyAuthentication yes
# Disable empty passwords
PermitEmptyPasswords no
# Change default port
Port 2222
# Protocol version
Protocol 2
# Limit user access
AllowUsers admin user1 user2
DenyUsers guest
# Session timeouts
ClientAliveInterval 300
ClientAliveCountMax 2
# Disable unnecessary features
X11Forwarding no
AllowTcpForwarding no
Benefits:
Difficulty: Beginner
Answer:
SSH Keys vs Passwords:
SSH Keys:
Passwords:
Why keys are preferred:
Example key generation:
ssh-keygen -t ed25519 -C "admin@company.com"
Difficulty: Intermediate
Answer:
A typical bastion host architecture includes:
Network Layout:
Components:
Traffic Flow:
Internet → Firewall → Bastion Host → Internal Network → Target Servers
Security Zones:
Difficulty: Intermediate
Answer:
Access Control:
Network Security:
System Hardening:
Operational Security:
Difficulty: Intermediate
Answer:
Multiple Bastion Hosts:
Configuration Management:
Shared Storage for Keys:
Example setup:
Load Balancer
├── Bastion Host 1 (AZ-1)
├── Bastion Host 2 (AZ-2)
└── Bastion Host 3 (AZ-3)
Difficulty: Intermediate
Answer:
Key Rotation Strategy:
1. Regular Rotation Schedule:
2. Centralized Key Management:
# Use SSH Certificate Authorities
ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_ca_key
# Sign user certificates
ssh-keygen -s /etc/ssh/ssh_host_ca_key -I user1 -n user1 ~/.ssh/id_rsa.pub
3. Automated Deployment:
4. Key Lifecycle Management:
Tools for Management:
Difficulty: Intermediate
Answer:
SSH Agent Forwarding allows your local SSH keys to be used on remote servers without copying the private key to those servers.
How it works:
# Enable agent forwarding
ssh -A user@bastion-host
# From bastion, connect to internal server using local keys
ssh internal-server
Security Benefits:
Security Risks:
Safer Alternatives:
ProxyJump example:
# Safer than agent forwarding
ssh -J bastion-host target-server
Difficulty: Intermediate
Answer:
Fail2ban is an intrusion prevention system that monitors log files and bans IP addresses showing suspicious behavior.
Installation and Basic Configuration:
# Install fail2ban
sudo apt-get install fail2ban
# Create custom configuration
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
SSH Protection Configuration:
# /etc/fail2ban/jail.local
[sshd]
enabled = true
port = ssh,2222
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600
Advanced Configuration:
# Custom SSH jail
[ssh-custom]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
sendmail-whois[name=SSH, dest=admin@company.com]
logpath = /var/log/secure
maxretry = 5
bantime = 86400
Key Parameters:
Monitoring:
# Check status
sudo fail2ban-client status sshd
# Unban IP
sudo fail2ban-client set sshd unbanip 192.168.1.100
Difficulty: Intermediate
Answer:
SSH Multiplexing allows multiple SSH sessions to share a single network connection.
Configuration:
# In ~/.ssh/config
Host *
ControlMaster auto
ControlPath ~/.ssh/sockets/%r@%h-%p
ControlPersist 600
Benefits:
Usage Examples:
# First connection establishes master
ssh server.example.com
# Subsequent connections are fast
scp file.txt server.example.com:/tmp/
ssh server.example.com "ls -la"
Advanced Configuration:
# Per-host settings
Host production-*
ControlMaster auto
ControlPath ~/.ssh/master-%r@%h:%p
ControlPersist 10m
Host development-*
ControlMaster no
Management Commands:
# Check active connections
ssh -O check server.example.com
# Stop master connection
ssh -O stop server.example.com
# Exit master connection
ssh -O exit server.example.com
Security Considerations:
Difficulty: Intermediate
Answer:
SSH Tunneling creates encrypted connections through SSH for other protocols.
Types of Tunnels:
1. Local Port Forwarding:
# Forward local port 8080 to remote service
ssh -L 8080:localhost:80 user@server.com
# Access through tunnel
curl http://localhost:8080
2. Remote Port Forwarding:
# Make local service accessible from remote server
ssh -R 8080:localhost:3000 user@server.com
3. Dynamic Port Forwarding (SOCKS proxy):
# Create SOCKS proxy on port 1080
ssh -D 1080 user@server.com
# Configure applications to use SOCKS proxy
SSH Configuration for Tunneling:
# /etc/ssh/sshd_config
AllowTcpForwarding yes
GatewayPorts no
PermitTunnel yes
# Restrict specific users
Match User tunnel-user
AllowTcpForwarding local
X11Forwarding no
PermitTTY no
ForceCommand /bin/false
Security Implications:
Risks:
Mitigation:
Best Practices:
Difficulty: Intermediate
Answer:
Log Monitoring Strategies:
1. Key Log Files:
# Common SSH log locations
/var/log/auth.log # Debian/Ubuntu
/var/log/secure # Red Hat/CentOS
/var/log/messages # Some systems
/var/log/sshd.log # Custom configurations
2. Important Log Patterns:
# Failed login attempts
grep "Failed password" /var/log/auth.log
# Successful logins
grep "Accepted publickey\|Accepted password" /var/log/auth.log
# Root login attempts
grep "root" /var/log/auth.log | grep "Failed\|Accepted"
# Brute force indicators
grep "authentication failure" /var/log/auth.log | cut -d' ' -f1-3,9- | sort | uniq -c
3. Real-time Monitoring Script:
#!/bin/bash
# ssh-monitor.sh
LOGFILE="/var/log/auth.log"
ALERT_EMAIL="admin@company.com"
tail -f $LOGFILE | while read line; do
if echo "$line" | grep -q "Failed password"; then
IP=$(echo "$line" | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b")
COUNT=$(grep "$IP" $LOGFILE | grep "Failed password" | wc -l)
if [ $COUNT -gt 5 ]; then
echo "ALERT: $IP has $COUNT failed attempts" | mail -s "SSH Alert" $ALERT_EMAIL
fi
fi
done
4. Advanced Monitoring with ELK Stack:
{
"query": {
"bool": {
"must": [
{"match": {"program": "sshd"}},
{"match": {"message": "Failed password"}}
],
"filter": {
"range": {
"@timestamp": {
"gte": "now-1h"
}
}
}
}
},
"aggs": {
"source_ips": {
"terms": {
"field": "source_ip",
"size": 10
}
}
}
}
Suspicious Activity Indicators:
Difficulty: Intermediate
Answer:
Debugging SSH Connection Issues:
1. Client-Side Debugging:
# Verbose SSH connection
ssh -vvv user@server.com
# Test specific authentication methods
ssh -o PasswordAuthentication=no user@server.com
ssh -o PubkeyAuthentication=no user@server.com
# Test with specific key
ssh -i /path/to/specific/key user@server.com
# Test SSH configuration
ssh -F /path/to/ssh_config user@server.com
2. Server-Side Debugging:
# Run SSH daemon in debug mode
sudo /usr/sbin/sshd -d -p 2222
# Check SSH daemon status
systemctl status sshd
journalctl -u sshd -f
# Test SSH configuration
sudo sshd -t
3. Network Connectivity Tests:
# Test port connectivity
telnet server.com 22
nc -zv server.com 22
# Check firewall rules
sudo iptables -L INPUT | grep ssh
sudo ufw status
# Network route tracing
traceroute server.com
mtr server.com
4. Key and Permission Issues:
# Check key permissions
ls -la ~/.ssh/
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub
# Verify key fingerprints
ssh-keygen -lf ~/.ssh/id_rsa.pub
ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub
# Check authorized_keys
cat ~/.ssh/authorized_keys
Common Issues and Solutions:
| Issue | Symptom | Solution |
|---|---|---|
| Permission denied | Authentication fails | Check key permissions, authorized_keys |
| Connection timeout | No response | Check network, firewall, SSH daemon |
| Host key verification failed | MITM warning | Update known_hosts or verify host key |
| Too many authentication failures | Connection drops | Reduce keys in agent, use specific key |
5. SSH Agent Debugging:
# Check SSH agent
ssh-add -l
ssh-add -D # Remove all keys
ssh-add ~/.ssh/id_rsa # Add specific key
# SSH agent forwarding test
ssh -A server.com 'ssh-add -l'
Difficulty: Intermediate
Answer:
SSH Escape Sequences are special key combinations that provide control over SSH connections, initiated with ~ (tilde) character.
Common Escape Sequences:
1. Connection Control:
# Terminate connection (even if hung)
~.
# Background SSH session
~^Z
# List forwarded connections
~#
# Display escape sequence help
~?
2. Port Forwarding Management:
# Add dynamic port forwarding
~C
ssh> -D 8080
# Add local port forwarding
~C
ssh> -L 8080:localhost:80
# Add remote port forwarding
~C
ssh> -R 8080:localhost:3000
# Cancel port forwarding
~C
ssh> -KD 8080
3. Connection Debugging:
# Show connection statistics
~s
# Enable/disable debug mode
~C
ssh> -v # Enable verbose
ssh> -q # Quiet mode
Practical Troubleshooting Examples:
1. Hung Connection Recovery:
# When session appears frozen
~. # Forcefully terminate
# Alternative: send break signal
~~ # Send literal tilde
~B # Send break to remote system
2. Network Debugging:
# Test if connection is responsive
~s # Shows connection status
# If network is unstable
~C
ssh> -o ServerAliveInterval=30
ssh> -o ServerAliveCountMax=3
3. Emergency Port Forwarding:
# Create emergency tunnel during active session
~C
ssh> -L 9999:internal-server:22
# Now you can SSH to internal server
ssh -p 9999 user@localhost
4. Session Multiplexing Control:
# Create new session in same connection
~C
ssh> -O forward -L 8080:localhost:80
# Check master connection status
~C
ssh> -O check
Advanced Usage:
1. Custom Escape Character:
# Change escape character (useful if ~ conflicts)
ssh -e '^B' user@server.com
# Disable escape sequences entirely
ssh -e none user@server.com
2. Script-Friendly Operations:
# In ~/.ssh/config
Host production-*
EscapeChar ~
Host development-*
EscapeChar none # Disable for automated scripts
When Escape Sequences Are Useful:
Limitations:
Difficulty: Expert
Answer:
AWS Systems Manager Session Manager:
VPN Solutions:
Zero Trust Access (ZTA) Solutions:
Privileged Access Management (PAM):
When to choose each:
Difficulty: Expert
Answer:
SSH Certificate Authorities provide scalable, centralized authentication management.
1. Create Certificate Authority:
# Generate CA key pair
ssh-keygen -t rsa -b 4096 -f ssh_ca
ssh-keygen -t rsa -b 4096 -f ssh_ca_host
2. Configure SSH Server:
# In /etc/ssh/sshd_config
TrustedUserCAKeys /etc/ssh/ssh_ca.pub
HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub
3. Issue User Certificates:
# Sign user's public key
ssh-keygen -s ssh_ca -I "user1@company.com" -n user1 -V +52w ~/.ssh/id_rsa.pub
# Creates id_rsa-cert.pub certificate
4. Client Configuration:
# In ~/.ssh/config
Host *.company.com
CertificateFile ~/.ssh/id_rsa-cert.pub
Benefits:
Certificate Contents:
Difficulty: Expert
Answer:
Port knocking requires connecting to a sequence of closed ports before the SSH port becomes accessible.
Implementation with knockd:
1. Install and Configure knockd:
# /etc/knockd.conf
[options]
UseSyslog
[openSSH]
sequence = 7000,8000,9000
seq_timeout = 5
command = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
tcpflags = syn
[closeSSH]
sequence = 9000,8000,7000
seq_timeout = 5
command = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
tcpflags = syn
2. Firewall Rules:
# Block SSH by default
iptables -A INPUT -p tcp --dport 22 -j DROP
# Allow knockd
iptables -A INPUT -p tcp --dport 7000:9000 -j REJECT
3. Client Usage:
# Knock sequence
for port in 7000 8000 9000; do
nmap -Pn --host-timeout 201 --max-retries 0 -p $port server.example.com
done
# Connect
ssh user@server.example.com
# Close sequence
for port in 9000 8000 7000; do
nmap -Pn --host-timeout 201 --max-retries 0 -p $port server.example.com
done
Considerations:
Difficulty: Expert
Answer:
SSH Honeypots are decoy SSH services designed to detect and analyze attack attempts.
Implementation with Cowrie:
1. Installation:
# Install Cowrie honeypot
git clone https://github.com/cowrie/cowrie
cd cowrie
python -m venv cowrie-env
source cowrie-env/bin/activate
pip install -r requirements.txt
2. Configuration:
# etc/cowrie.cfg
[honeypot]
hostname = web-server-01
log_path = var/log/cowrie
download_path = var/lib/cowrie/downloads
[ssh]
listen_endpoints = tcp:2222:interface=0.0.0.0
sftp_enabled = true
[telnet]
listen_endpoints = tcp:2223:interface=0.0.0.0
[output_json]
logfile = var/log/cowrie/cowrie.json
3. Firewall Redirection:
# Redirect SSH traffic to honeypot
iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port 2222
Benefits:
Monitoring and Analysis:
# Analyze logs
tail -f var/log/cowrie/cowrie.json | jq '.'
# Common attack patterns
grep "login attempt" var/log/cowrie/cowrie.log
Integration with SIEM:
Difficulty: Expert
Answer:
Key Differences:
| Feature | Key-Based | Certificate-Based |
|---|---|---|
| Scalability | Manual key distribution | Centralized CA management |
| Revocation | Remove from authorized_keys | Certificate expiration/CRL |
| Identity | Public key fingerprint | Rich identity information |
| Validity | Permanent until removed | Time-limited |
Certificate-Based Implementation:
1. Certificate Authority Setup:
# Generate CA keys
ssh-keygen -t rsa -b 4096 -f ca_user_key
ssh-keygen -t rsa -b 4096 -f ca_host_key
2. Server Configuration:
# /etc/ssh/sshd_config
TrustedUserCAKeys /etc/ssh/ca_user_key.pub
HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub
3. Issue User Certificate:
# Create certificate with specific permissions
ssh-keygen -s ca_user_key \
-I "john.doe@company.com" \
-n john.doe,admin \
-V +24h \
-O force-command=/usr/bin/limited-shell \
~/.ssh/id_rsa.pub
Certificate Contents:
Advantages:
Use Cases:
Difficulty: Expert
Answer:
Session Recording Implementation:
1. Using script command:
# Force session recording for all users
# /etc/profile.d/session-recording.sh
if [ -n "$SSH_CLIENT" ]; then
script -f -q /var/log/sessions/$(date +%Y%m%d-%H%M%S)-${USER}-$$-session.log
fi
2. Using Teleport (Enterprise Solution):
# teleport.yaml
version: v2
teleport:
nodename: bastion-01
ssh_service:
enabled: "yes"
enhanced_recording:
enabled: true
command_buffer_size: 8
disk_buffer_size: 128
network_buffer_size: 8
3. Custom Session Wrapper:
#!/bin/bash
# /usr/local/bin/session-wrapper
SESSION_ID="$(date +%Y%m%d-%H%M%S)-${USER}-$$"
LOG_DIR="/var/log/sessions"
# Create session log
exec script -f -q "${LOG_DIR}/${SESSION_ID}.log" -c "$@"
4. SSH Configuration:
# /etc/ssh/sshd_config
ForceCommand /usr/local/bin/session-wrapper $SSH_ORIGINAL_COMMAND
Monitoring Implementation:
1. Real-time Monitoring:
# Monitor active sessions
#!/bin/bash
while true; do
echo "=== Active SSH Sessions ==="
who | grep pts
echo "=== Recent Commands ==="
tail -f /var/log/sessions/*.log | grep -E "(sudo|su|rm|mv)" &
sleep 30
done
2. Log Analysis:
# Analyze session logs
grep -r "sudo" /var/log/sessions/
grep -r "failed\|error" /var/log/sessions/
3. SIEM Integration:
# Forward logs to SIEM
rsyslog_config='
$ModLoad imfile
$InputFileName /var/log/sessions/*.log
$InputFileTag ssh-session:
$InputFileStateFile ssh-session-state
$InputFileSeverity info
$InputFileFacility local0
$InputRunFileMonitor
'
Benefits:
Difficulty: Expert
Answer:
Container-Specific SSH Challenges:
1. Ephemeral Infrastructure:
2. Network Complexity:
Security Best Practices:
1. Avoid SSH in Containers:
# Use exec instead of SSH
docker exec -it container_name /bin/bash
kubectl exec -it pod_name -- /bin/bash
2. Secure SSH Implementation:
# Dockerfile with SSH hardening
FROM ubuntu:20.04
RUN apt-get update && apt-get install -y openssh-server
RUN mkdir /var/run/sshd
# Harden SSH configuration
COPY sshd_config /etc/ssh/sshd_config
RUN chmod 600 /etc/ssh/sshd_config
# Use non-root user
RUN useradd -m -s /bin/bash sshuser
USER sshuser
EXPOSE 22
CMD ["/usr/sbin/sshd", "-D"]
3. Key Management in Containers:
# Use secrets management
# Kubernetes secret
apiVersion: v1
kind: Secret
metadata:
name: ssh-keys
data:
authorized_keys: <base64-encoded-keys>
4. Monitoring and Logging:
# Kubernetes logging sidecar
apiVersion: v1
kind: Pod
spec:
containers:
- name: app
image: myapp:latest
- name: log-forwarder
image: fluent/fluent-bit:latest
volumeMounts:
- name: ssh-logs
mountPath: /var/log/ssh
Alternative Approaches:
When SSH is Necessary:
Difficulty: Expert
Answer:
Centralized Logging Architecture:
1. Rsyslog Configuration:
# /etc/rsyslog.d/ssh-forwarding.conf
# Forward SSH logs to central server
auth.* @@log-server.company.com:514
# Local backup
auth.* /var/log/ssh-local.log
2. Central Log Server Setup:
# /etc/rsyslog.conf on log server
# Enable reception of logs
$ModLoad imudp
$UDPServerRun 514
$UDPServerAddress 0.0.0.0
# Template for SSH logs
$template SSHLogFormat,"/var/log/ssh/%HOSTNAME%-%$YEAR%-%$MONTH%-%$DAY%.log"
auth.* ?SSHLogFormat
3. ELK Stack Implementation:
# logstash.conf
input {
syslog {
port => 514
type => "ssh"
}
}
filter {
if [type] == "ssh" {
grok {
match => {
"message" => "%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:hostname} %{WORD:program}\[%{POSINT:pid}\]: %{GREEDYDATA:ssh_message}"
}
}
if "Failed password" in [ssh_message] {
grok {
match => {
"ssh_message" => "Failed password for %{USERNAME:failed_user} from %{IP:source_ip} port %{POSINT:source_port}"
}
}
}
}
}
output {
elasticsearch {
hosts => ["elasticsearch:9200"]
index => "ssh-logs-%{+YYYY.MM.dd}"
}
}
4. Structured Logging with JSON:
# Custom SSH wrapper for structured logging
#!/bin/bash
# /usr/local/bin/ssh-json-logger
log_event() {
local event_type="$1"
local user="$2"
local source_ip="$3"
json_log=$(cat <<EOF
{
"timestamp": "$(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)",
"hostname": "$(hostname)",
"event_type": "$event_type",
"user": "$user",
"source_ip": "$source_ip",
"session_id": "$SSH_CLIENT",
"pid": "$$"
}
EOF
)
echo "$json_log" >> /var/log/ssh-events.json
logger -t ssh-events "$json_log"
}
# Hook into SSH events
log_event "session_start" "$USER" "${SSH_CLIENT%% *}"
5. Dashboard and Alerting:
// Kibana dashboard query
{
"query": {
"bool": {
"must": [
{"term": {"event_type": "failed_login"}},
{"range": {"@timestamp": {"gte": "now-1h"}}}
]
}
},
"aggs": {
"top_attackers": {
"terms": {"field": "source_ip", "size": 10}
},
"attack_timeline": {
"date_histogram": {
"field": "@timestamp",
"interval": "5m"
}
}
}
}
Benefits:
Difficulty: Expert
Answer:
Automated Key Rotation Strategy:
1. Key Rotation Workflow:
#!/bin/bash
# ssh-key-rotation.sh
ROTATION_LOG="/var/log/ssh-rotation.log"
KEY_DIR="/etc/ssh/managed-keys"
BACKUP_DIR="/etc/ssh/key-backups"
rotate_keys() {
local target_hosts="$1"
local rotation_id="rotation-$(date +%Y%m%d-%H%M%S)"
echo "Starting rotation: $rotation_id" >> $ROTATION_LOG
# Generate new key pair
ssh-keygen -t ed25519 -f "$KEY_DIR/id_ed25519_new" -N "" -C "$rotation_id"
# Distribute new public key to all hosts
while IFS= read -r host; do
distribute_key "$host" "$KEY_DIR/id_ed25519_new.pub"
done < <(echo "$target_hosts")
# Test new key access
test_key_access "$KEY_DIR/id_ed25519_new"
if [ $? -eq 0 ]; then
# Backup old keys
mv "$KEY_DIR/id_ed25519" "$BACKUP_DIR/id_ed25519_$(date +%Y%m%d)"
mv "$KEY_DIR/id_ed25519.pub" "$BACKUP_DIR/id_ed25519.pub_$(date +%Y%m%d)"
# Activate new keys
mv "$KEY_DIR/id_ed25519_new" "$KEY_DIR/id_ed25519"
mv "$KEY_DIR/id_ed25519_new.pub" "$KEY_DIR/id_ed25519.pub"
echo "Rotation completed successfully: $rotation_id" >> $ROTATION_LOG
else
echo "Rotation failed: $rotation_id" >> $ROTATION_LOG
cleanup_failed_rotation
fi
}
distribute_key() {
local host="$1"
local pubkey_file="$2"
# Add new key alongside existing
ssh -o PasswordAuthentication=no "$host" \
"echo '$(cat $pubkey_file)' >> ~/.ssh/authorized_keys"
}
test_key_access() {
local private_key="$1"
# Test access with new key
ssh -o PasswordAuthentication=no -i "$private_key" target-host "echo 'Key test successful'" 2>/dev/null
}
2. Ansible Playbook for Key Rotation:
# ssh-key-rotation.yml
- name: SSH Key Rotation
hosts: all
gather_facts: no
vars:
rotation_id: "{{ ansible_date_time.epoch }}"
tasks:
- name: Generate new SSH key pair
openssh_keypair:
path: "/tmp/ssh_key_{{ rotation_id }}"
type: ed25519
comment: "rotation-{{ rotation_id }}"
delegate_to: localhost
run_once: true
- name: Read new public key
slurp:
src: "/tmp/ssh_key_{{ rotation_id }}.pub"
register: new_public_key
delegate_to: localhost
run_once: true
- name: Add new key to authorized_keys
authorized_key:
user: "{{ ansible_user }}"
key: "{{ new_public_key.content | b64decode }}"
state: present
- name: Test new key access
shell: "ssh -o PasswordAuthentication=no -i /tmp/ssh_key_{{ rotation_id }} {{ inventory_hostname }} 'echo success'"
delegate_to: localhost
register: key_test
- name: Remove old keys if test successful
authorized_key:
user: "{{ ansible_user }}"
key: "{{ item }}"
state: absent
loop: "{{ old_keys }}"
when: key_test.rc == 0
3. Certificate-Based Rotation:
#!/bin/bash
# certificate-rotation.sh
CA_KEY="/etc/ssh/ca/ssh_ca"
CERT_VALIDITY="52w"
rotate_certificates() {
local user_list="$1"
while IFS= read -r user; do
# Generate new certificate
ssh-keygen -s "$CA_KEY" \
-I "${user}-$(date +%Y%m%d)" \
-n "$user" \
-V "+$CERT_VALIDITY" \
"/home/$user/.ssh/id_rsa.pub"
# Notify user
echo "Certificate renewed for $user" | mail -s "SSH Certificate Renewal" "$user@company.com"
done < <(echo "$user_list")
}
4. Monitoring and Validation:
#!/bin/bash
# key-validation.sh
validate_key_distribution() {
local expected_fingerprint="$1"
local host_list="$2"
while IFS= read -r host; do
actual_fingerprint=$(ssh "$host" "ssh-keygen -lf ~/.ssh/authorized_keys | grep '$expected_fingerprint'" 2>/dev/null)
if [ -n "$actual_fingerprint" ]; then
echo "✓ $host: Key distribution successful"
else
echo "✗ $host: Key distribution failed"
echo "$host" >> /var/log/failed-key-distribution.log
fi
done < <(echo "$host_list")
}
Benefits:
Difficulty: Expert
Answer:
Zero Trust SSH Implementation:
1. Identity-Based Access Control:
# Example Teleport configuration
kind: role
version: v5
metadata:
name: developer
spec:
allow:
logins: ['developer', 'app-user']
node_labels:
'environment': ['dev', 'staging']
'team': ['backend', 'frontend']
rules:
- resources: ['session']
verbs: ['read']
- resources: ['node']
verbs: ['read', 'list']
deny:
node_labels:
'environment': ['production']
2. Certificate-Based Architecture:
# Short-lived certificates (1 hour validity)
ssh-keygen -s /etc/ssh/ca_key \
-I "user@company.com" \
-n "developer" \
-V "+1h" \
-O force-command="/usr/bin/rbash" \
~/.ssh/id_rsa.pub
3. Policy Engine Integration:
{
"policy": {
"version": "1.0",
"rules": [
{
"id": "ssh-access-rule",
"effect": "allow",
"conditions": {
"user_attributes": {
"department": "engineering",
"clearance_level": "standard"
},
"resource_attributes": {
"environment": "development",
"data_classification": "internal"
},
"context": {
"time_range": "09:00-17:00",
"location": "corporate_network",
"device_compliance": "verified"
}
}
}
]
}
}
4. Continuous Verification:
#!/bin/bash
# continuous-verification.sh
verify_session() {
local session_id="$1"
local user="$2"
# Check device compliance
device_status=$(curl -s "https://mdm-api.company.com/device/$device_id/status")
# Verify user attributes
user_attrs=$(curl -s "https://identity-api.company.com/user/$user/attributes")
# Check risk score
risk_score=$(curl -s "https://risk-api.company.com/user/$user/score")
if [[ "$device_status" != "compliant" ]] || [[ "$risk_score" -gt 80 ]]; then
# Terminate session
pkill -f "sshd.*$session_id"
logger "Session terminated for $user due to policy violation"
fi
}
# Run verification every 5 minutes for active sessions
while true; do
for session in $(who | awk '{print $2}'); do
verify_session "$session" "$(who | grep $session | awk '{print $1}')"
done
sleep 300
done
5. Micro-Segmentation:
# Network policies for each SSH session
iptables -A FORWARD -m owner --uid-owner developer -d 10.0.1.0/24 -j ACCEPT
iptables -A FORWARD -m owner --uid-owner developer -d 10.0.2.0/24 -j DROP
Key Zero Trust Principles for SSH:
Never Trust, Always Verify:
Least Privilege Access:
Assume Breach:
Implementation Considerations:
Difficulty: Expert
Answer:
Cloud-Specific SSH Security:
1. AWS Implementation:
# CloudFormation template for secure bastion
Resources:
BastionSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Bastion host security group
VpcId: !Ref VPC
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 22
ToPort: 22
SourceSecurityGroupId: !Ref AdminSecurityGroup
SecurityGroupEgress:
- IpProtocol: tcp
FromPort: 22
ToPort: 22
DestinationSecurityGroupId: !Ref PrivateSecurityGroup
BastionInstance:
Type: AWS::EC2::Instance
Properties:
ImageId: ami-0c55b159cbfafe1d0
InstanceType: t3.micro
SecurityGroupIds:
- !Ref BastionSecurityGroup
IamInstanceProfile: !Ref BastionInstanceProfile
UserData:
Fn::Base64: !Sub |
#!/bin/bash
# Install and configure Session Manager
yum update -y
yum install -y amazon-ssm-agent
systemctl enable amazon-ssm-agent
systemctl start amazon-ssm-agent
# Configure SSH hardening
echo "AllowUsers ec2-user admin" >> /etc/ssh/sshd_config
echo "PasswordAuthentication no" >> /etc/ssh/sshd_config
systemctl restart sshd
2. AWS Systems Manager Session Manager:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::ACCOUNT:user/admin"
},
"Action": "ssm:StartSession",
"Resource": [
"arn:aws:ec2:region:ACCOUNT:instance/*",
"arn:aws:ssm:region:ACCOUNT:document/SSM-SessionManagerRunShell"
],
"Condition": {
"StringEquals": {
"ssm:SessionDocumentAccessCheck": "true"
}
}
}
]
}
3. Azure Bastion Service:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.Network/bastionHosts",
"apiVersion": "2020-05-01",
"name": "MyBastionHost",
"location": "[resourceGroup().location]",
"properties": {
"ipConfigurations": [
{
"name": "IpConf",
"properties": {
"subnet": {
"id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', 'MyVNet', 'AzureBastionSubnet')]"
},
"publicIPAddress": {
"id": "[resourceId('Microsoft.Network/publicIPAddresses', 'MyBastionPublicIP')]"
}
}
}
]
}
}
]
}
4. GCP Identity-Aware Proxy (IAP):
# terraform configuration
resource "google_iap_tunnel_instance_iam_member" "ssh_access" {
instance = google_compute_instance.vm.name
zone = google_compute_instance.vm.zone
role = "roles/iap.tunnelResourceAccessor"
member = "user:admin@company.com"
}
resource "google_compute_firewall" "allow_iap_ssh" {
name = "allow-iap-ssh"
network = google_compute_network.vpc.name
allow {
protocol = "tcp"
ports = ["22"]
}
source_ranges = ["35.235.240.0/20"] # IAP IP range
target_tags = ["iap-ssh"]
}
5. Multi-Cloud SSH Management:
#!/bin/bash
# multi-cloud-ssh-manager.sh
connect_to_instance() {
local cloud="$1"
local instance="$2"
local user="$3"
case "$cloud" in
"aws")
# Use Session Manager
aws ssm start-session --target "$instance"
;;
"azure")
# Use Azure Bastion
az network bastion ssh --name MyBastion \
--resource-group MyRG \
--target-resource-id "$instance" \
--auth-type AAD
;;
"gcp")
# Use IAP tunnel
gcloud compute ssh "$instance" \
--tunnel-through-iap \
--ssh-flag="-o UserKnownHostsFile=/dev/null"
;;
esac
}
Cloud Security Best Practices:
Identity Integration:
Network Security:
Monitoring and Logging:
Key Management:
Access all premium content - interview questions, and other learning resources
We regularly update our features and content, to ensure you get the most relevant and updated premium content.
1000 monthly credits
Cancel anytime