For Teachers · Back to the Module · Print with your browser's Print command.

P2 Worksheet: SSH Security

Student Worksheet (about 15 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P1

Learning Objectives

• [ ] Explain why key-based authentication beats passwords for SSH.
• [ ] Explain the risk of direct root login.
• [ ] Identify weak SSH ciphers, MACs and key exchange methods.

Key Terms

Write each definition in your own words.

• Public-Key Authentication: ______________________________________________
• Brute Force: ______________________________________________
• Cipher: ______________________________________________
• MAC: ______________________________________________
• Key Exchange: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt explain HOST-SSH-004 and read the detection logic.
2. Run: openvapt demo --only HOST-SSH- and read the evidence lines for each finding.
3. On your own server: sshd -T | grep -Ei 'permitrootlogin|passwordauthentication|ciphers'

Self-Check Questions

1. Why is public-key authentication stronger than passwords for SSH?

• [ ] a) Keys cannot be guessed by trying common passwords
• [ ] b) Keys make SSH faster
• [ ] c) Keys hide the server
• [ ] d) Keys let any user log in as root

1. PermitRootLogin prohibit-password means:

• [ ] a) Root may log in with a password
• [ ] b) Root may log in only with a key
• [ ] c) Root may never log in
• [ ] d) Root may log in only from the console

1. Which SSH cipher is considered weak?

• [ ] a) aes256-gcm
• [ ] b) chacha20-poly1305
• [ ] c) aes128-cbc
• [ ] d) aes256-ctr

1. Why log in as a named user and use sudo instead of logging in as root?

• [ ] a) Sudo is faster
• [ ] b) It keeps a record of which person acted and avoids the one name every attacker knows
• [ ] c) Root cannot use SSH keys
• [ ] d) It turns off MaxAuthTries

1. What does a low MaxAuthTries setting do?

• [ ] a) Blocks the address forever
• [ ] b) Makes guessing slower and noisier by ending a connection after a few failures
• [ ] c) Disables password logins
• [ ] d) Limits the number of open sessions

1. Where do most weak SSH cryptography settings come from today?

• [ ] a) Modern OpenSSH defaults
• [ ] b) Old custom configuration lines
• [ ] c) The client's web browser
• [ ] d) RFC 9142

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• OpenBSD, sshd_config(5): https://man.openbsd.org/sshd_config
• RFC 9142, Key Exchange Method Updates for SSH: https://www.rfc-editor.org/rfc/rfc9142.html

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.