Updates and SSH
Patch cadence and sshd posture — literacy on $LAB_HOST only.
Visual · linux_updates_ssh
apt/dnf updates + sshd literacy. $LAB_HOST only. Original Cyberlium.
Stale packages and PasswordAuthentication yes are defender red flags — on YOUR lab, read both.
Package managers (apt, dnf, pacman) close known CVEs. sshd_config controls remote access: PermitRootLogin, PasswordAuthentication, AllowUsers. Defenders verify patch level and SSH posture on owned servers. Cyberlium teaches reading apt list --upgradable and sshd -T on $LAB_HOST — not pushing keys to strangers or enabling root login on classmate boxes. Next: Firewall (ufw/nftables literacy).
1. Update literacy per distro
Document pending updates on $LAB_HOST with your package manager's list command. Plan reboot if kernel updates require it — on hardware you control.
Running apt upgrade on a server you do not administer is out of scope — even for 'helpful' patching.
Command guide
Try these commands — Update literacy per distro
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
SSH hardening — https://www.ssh.com/academy/ssh/config
CIS Controls — https://www.cisecurity.org/controls
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (iproute2)
macOS: Use: netstat
Windows: Use: netstat
═══ LINUX / macOS ═══
Command — copy this
grep -E '^PermitRootLogin|^PasswordAuthentication|^Port' /etc/ssh/sshd_config 2>/dev/null || echo 'Review sshd_config on YOUR Linux lab' ss -tulpn 2>/dev/null | grep ':22 ' || ss -tuln | grep ':22 '
Primary tools to practice this lesson: ss, grep. Reference sites: SSH hardening (https://www.ssh.com/academy/ssh/config); CIS Controls (https://www.cisecurity.org/controls). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. sshd_config defender reads
Prefer key-based auth, disable root login, restrict AllowUsers to lab accounts. Read effective config with sshd -T on $LAB_HOST before editing.
Never 'test' SSH by brute forcing a classmate's port 22 — that is attack traffic.
3. Change with rollback on lab only
Optional: set PermitRootLogin no on $LAB_HOST with snapshot and console access confirmed.
Ship: pending update count + three sshd settings for $LAB_HOST. Next: firewall literacy.
4. What you ship: update and SSH readout for $LAB_HOST
Pending updates count. PermitRootLogin, PasswordAuthentication, AllowUsers readout. chmod 600.
5. What you record before the next lesson
Date. Update list summary. sshd -T highlights on $LAB_HOST. File t16-m03-l02-linux-updates-ssh.txt chmod 600.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Copy your pubkey to every SSH port on the LAN. Enable root password login on library server.
- Right: Read updates and sshd on $LAB_HOST. Next: Firewall (ufw/nftables literacy).
Mission: updates and SSH readout
1) List pending updates on $LAB_HOST. 2) Run sshd -T and record three security-relevant settings. 3) No stranger SSH changes. Never patch or reconfigure hosts you do not own.
Stuck? Ask Cyberlium AI Mentor
Keep console access before restarting sshd — lock yourself out only on $LAB_HOST you can revert.
APPLY: sshd PermitRootLogin no is:
APPLY: True or False: Brute forcing port 22 on dorm IPs teaches defense.
APPLY: Pending kernel update on $LAB_HOST often requires:
Firewall (ufw/nftables literacy)
Part of Defensive Security Basics with AI — Linux Hardening Literacy.
Linux Lab
Part of Defensive Security Basics with AI — Linux Hardening Literacy.
Quiz — Linux Hardening Literacy
Part of Defensive Security Basics with AI — Linux Hardening Literacy.