Skip to content
LFCSNetworkingSingle Linux VMMedium

Harden the OpenSSH server and set up a client profile

Scenario lfcs-net-003 · about 7 minutes · 8 points · 7 grader checks

Make sshd listen on two ports with key-only logins limited to one group, then give a user a key pair and a host alias that works without prompts.

  • openssh
  • sshd
  • ssh-keys
  • ssh-config
  • hardening

What you will practise

  • Configure sshd ports, root login, password authentication and AllowGroups
  • Find overriding sshd drop-in files
  • Create a key pair and an ssh client configuration

Start this lab

With the CLI installed and signed in, this command provisions a fresh Ubuntu 24.04 LTS virtual machine on your Mac, applies the scenario setup and prints the task below.

goldenkube start lfcs-net-003

Task

The task text exactly as the CLI shows it. Solve it on the machine, then run goldenkube submit.

1. Configure the OpenSSH server on this host: - it listens on port 22 and additionally on port 2222 - root cannot log in over SSH - password authentication is disabled (keys only) - only members of the group sshusers may log in. Do not change the membership of sshusers. The settings must be in effect now and persist. 2. For the user deploy (a member of sshusers): - create an ed25519 key pair without a passphrase at ~deploy/.ssh/id_ed25519 and authorise it for logins as deploy - create ~deploy/.ssh/config with a host alias lab that connects to 127.0.0.1 on port 2222 as deploy with that key Running "ssh lab" as deploy must log in without any prompt.

Requirements and details

Certification
LFCS · Linux Foundation Certified System Administrator
Domain
Networking
Difficulty
Medium
Environment
Single Linux VM
Recommended time
7 minutes
Points
8
Grader checks
7
Operating system
Ubuntu 24.04 LTS
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 7 state checks read your machine when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Networking labs

LFCSNetworkingHard

Bond, bridge, IPv4/IPv6 addresses, a static route and name resolution

Build an active-backup bond and a bridge from dummy interfaces, address the bridge with IPv4 and IPv6, add a static route and a hosts entry, all persistent.

Single Linux VM · ~9 min · 9 points

  • bonding
  • bridge
  • ipv6
  • static-route
  • netplan
  • systemd-networkd
  • hosts

goldenkube start lfcs-net-001

LFCSNetworkingEasy

Time synchronisation with chrony and the time zone

Point chrony at two internal time servers only, allow a client network to query it, enable it, and set the system time zone.

Single Linux VM · ~4 min · 6 points

  • chrony
  • ntp
  • time
  • timezone
  • timedatectl

goldenkube start lfcs-net-002

LFCSNetworkingHard

Packet filtering, port redirection and NAT with nftables

Write a persistent nftables ruleset with a default-drop input chain, a port redirect and source NAT, and track down an unexpected listener.

Single Linux VM · ~8 min · 9 points

  • nftables
  • firewall
  • nat
  • port-redirection
  • ss
  • troubleshooting

goldenkube start lfcs-net-004

LFCSNetworkingMedium

Reverse proxy and load balancer with nginx

Publish two local backends behind one nginx virtual host with round-robin balancing, the original Host header and a status path answered by nginx itself.

Single Linux VM · ~6 min · 7 points

  • nginx
  • reverse-proxy
  • load-balancing
  • upstream
  • http

goldenkube start lfcs-net-005

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.