OpenVAPTFor Teachers · Back to the Module · Print with your browser's Print command.
P2 Teacher Answer Key: SSH Security
Teacher Answer Key (about 15 minutes, Practitioner level)
Name: ______________________ Class: __________ Date: __________
Read first: P1
Learning Objectives
- [ ] Explain why key-based authentication beats passwords for SSH.
- [ ] Explain the risk of direct root login.
- [ ] Identify weak SSH ciphers, MACs and key exchange methods.
Key Terms
Write each definition in your own words.
- Public-Key Authentication: Logging in by proving possession of a private key instead of typing a password.
- Brute Force: Trying many passwords or keys in turn until one works.
- Cipher: An algorithm that encrypts and decrypts data.
- MAC: Message authentication code: a value that proves a message was not altered and came from someone with the key.
- Key Exchange: The method two parties use to agree on encryption keys over an untrusted network.
Lab Tasks
Use only the simulated lab or a machine your teacher has authorised.
- Run: openvapt explain HOST-SSH-004 and read the detection logic.
- Run: openvapt demo --only HOST-SSH- and read the evidence lines for each finding.
- On your own server: sshd -T | grep -Ei 'permitrootlogin|passwordauthentication|ciphers'
Self-Check Questions
- Why is public-key authentication stronger than passwords for SSH?
- [x] a) Keys cannot be guessed by trying common passwords
- [ ] b) Keys make SSH faster
- [ ] c) Keys hide the server
- [ ] d) Keys let any user log in as root
- Answer: a. Keys remove password guessing and password reuse as attack paths.
- PermitRootLogin prohibit-password means:
- [ ] a) Root may log in with a password
- [x] b) Root may log in only with a key
- [ ] c) Root may never log in
- [ ] d) Root may log in only from the console
- Answer: b. It blocks password and keyboard-interactive logins for root while still allowing keys.
- Which SSH cipher is considered weak?
- [ ] a) aes256-gcm
- [ ] b) chacha20-poly1305
- [x] c) aes128-cbc
- [ ] d) aes256-ctr
- Answer: c. CBC-mode SSH ciphers have known weaknesses. GCM, ChaCha20-Poly1305 and CTR modes are accepted.
- Why log in as a named user and use sudo instead of logging in as root?
- [ ] a) Sudo is faster
- [x] b) It keeps a record of which person acted and avoids the one name every attacker knows
- [ ] c) Root cannot use SSH keys
- [ ] d) It turns off MaxAuthTries
- Answer: b. Direct root logins lose the record of who acted, and root is the account name every attacker tries first.
- What does a low MaxAuthTries setting do?
- [ ] a) Blocks the address forever
- [x] b) Makes guessing slower and noisier by ending a connection after a few failures
- [ ] c) Disables password logins
- [ ] d) Limits the number of open sessions
- Answer: b. MaxAuthTries caps failed attempts per connection. Attackers must reconnect more often, which is slower and leaves more log lines.
- Where do most weak SSH cryptography settings come from today?
- [ ] a) Modern OpenSSH defaults
- [x] b) Old custom configuration lines
- [ ] c) The client's web browser
- [ ] d) RFC 9142
- Answer: b. Modern OpenSSH defaults are strong. Weak algorithms usually come from old lines someone added to sshd_config. RFC 9142 deprecates weak key exchange methods.
Reflection
Which finding from this module would matter most on a server you are responsible for, and why?
________________________________________________________________
Sources
- OpenBSD, sshd_config(5): https://man.openbsd.org/sshd_config
- RFC 9142, Key Exchange Method Updates for SSH: https://www.rfc-editor.org/rfc/rfc9142.html
Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.