Hardening YOUR SSH Config
Read YOUR ~/.ssh/config if present — do not smash production aliases to prove you were here.
Visual · ssh_config_hardening
Client config literacy on THIS user. Do not break production.
ssh_config is how THIS account chooses keys, jump hosts, and algorithms — read it before you rewrite it.
OpenSSH client configuration lives in ~/.ssh/config (and system files). It can pin HostName, IdentityFile, User, and options that stop you from falling back to passwords. It can also contain production aliases you must not casually destroy for a screenshot. This lesson is read-first. If the file is missing, you write a tiny example under cyberlium-lab, not a surprise overwrite of a working config. Original Cyberlium.
1. Read, then copy interesting lines into a note — not into Discord
If ~/.ssh/config exists, list Host / HostName / IdentityFile / PasswordAuthentication lines. Redact real hostnames if you would not want them in a screenshot. The lesson cares that you know the file's job, not that you leak your employer's jump box.
If the file does not exist, that is normal. Do not invent a production mesh. Write a sample under cyberlium-lab.
Command guide
Read, then copy interesting lines into a note — not into Discord
═══ LINUX / BASH (Network & Reconnaissance Audit) ═══
Scan target host for open ports and service version signatures
Command — copy this
nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}DNS and WHOIS reconnaissance on authorized domain
Command — copy this
dig +short A target.local dig +short MX target.local whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6
Inspect HTTP headers for technology stack fingerprinting
Command — copy this
curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"2. A sample you own is safer than editing the real file blindly
Create t11-ssh-config.sample with a Host block that points IdentityFile at the coming practice key path and sets PasswordAuthentication no for that dummy Host. This sample is not wired into ssh unless you later Include it on purpose.
Never set StrictHostKeyChecking no as a global “lab hack.” Teaching people to skip host keys is how they get a different kind of MITM than Topic 11 already refused.
Command guide
A sample you own is safer than editing the real file blindly
═══ LINUX / BASH (Network & Reconnaissance Audit) ═══
Scan target host for open ports and service version signatures
Command — copy this
nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}DNS and WHOIS reconnaissance on authorized domain
Command — copy this
dig +short A target.local dig +short MX target.local whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6
Inspect HTTP headers for technology stack fingerprinting
Command — copy this
curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"3. Server-side hardening is a different file you also must own
sshd_config PasswordAuthentication no belongs on a server you administer, with a live key already working, and a console fallback. This lesson will not walk you into locking yourself out, and it will not tell you to harden a campus jumphost.
Client sample + later practice key is enough shipping for Cyberlium Topic 11.
Command guide
Server-side hardening is a different file you also must own
═══ LINUX / BASH (Network & Reconnaissance Audit) ═══
Scan target host for open ports and service version signatures
Command — copy this
nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}DNS and WHOIS reconnaissance on authorized domain
Command — copy this
dig +short A target.local dig +short MX target.local whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6
Inspect HTTP headers for technology stack fingerprinting
Command — copy this
curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"4. What you ship: a read of YOUR config plus a sample, production intact
Record whether ~/.ssh/config exists. Do not delete production Host blocks. Sample file chmod 600. No StrictHostKeyChecking no global. No hydra. DEMO GATE holds.
5. What you record before the next lesson
t11-ssh-config.sample. DEMO identified/STOP. SAFE NEVER break production ssh. Next: Lab — Practice Key.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
- Wrong: Replace ~/.ssh/config with a blank file for a cleaner screenshot. StrictHostKeyChecking no globally. hydra to “test the hardened server.”
- Right: Read real config if present. Keep a sample in cyberlium-lab. Next: Lab — Practice Key in cyberlium-lab.
Mission: read YOUR ssh config without breaking it
1) / STOP if router. 2) If ~/.ssh/config exists, read Host/IdentityFile lines (redact as needed). 3) Write t11-ssh-config.sample under cyberlium-lab. Do not smash production. Do not hydra.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor what Include means in ssh_config — not how to disable host-key checking for a phishing lab.
APPLY: You find a production Host jump-prod in ~/.ssh/config. For this lesson you:
APPLY: True or False: StrictHostKeyChecking no as a global lab default is good hardening.
APPLY: PasswordAuthentication no in a SAMPLE Host block is: