Lab — Practice Key in cyberlium-lab
Lab: ssh-keygen ed25519 to a PRACTICE path — never overwrite real id_ed25519 without asking, never hydra.
Visual · practice_ed25519_lab
Generate t11_practice_ed25519 under $HOME/cyberlium-lab. Original Cyberlium.
The lab is a new keypair in a folder named cyberlium-lab, not a surprise identity theft of yourself.
You will run ssh-keygen -t ed25519 -f $HOME/cyberlium-lab/t11_practice_ed25519 -N "" so the private key lands in the practice path with an empty passphrase for this classroom file only. That empty -N is for a disposable lab key, not a recommendation for production identities. You will show the public half with ssh-keygen -y. You will chmod 600 the private file. Original Cyberlium.
1. Generate into the practice path only
If t11_practice_ed25519 already exists from a prior attempt, do not also run default ssh-keygen. Use -f every time. Confirm the printed path before you type yes if the tool asks to overwrite the practice file.
Empty passphrase here is a disposable classroom choice. For a real identity key, you would use a passphrase. Do not copy this -N "" habit onto id_ed25519.
Command guide
Generate into the practice path only
═══ LINUX / BASH (Network & Reconnaissance Audit) ═══
Scan target host for open ports and service version signatures
Command — copy this
nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}DNS and WHOIS reconnaissance on authorized domain
Command — copy this
dig +short A target.local dig +short MX target.local whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6
Inspect HTTP headers for technology stack fingerprinting
Command — copy this
curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"2. Prove the public half without mailing the private half
ssh-keygen -y -f the private practice file prints the public key. Compare to the.pub file. That is how you check you still have a matching pair.
Do not cat the private file into chat. Do not add this key to GitHub as if it were your main identity unless you intend that (you should not, for a classroom empty-passphrase key).
Command guide
Prove the public half without mailing the private half
═══ LINUX / BASH (Network & Reconnaissance Audit) ═══
Scan target host for open ports and service version signatures
Command — copy this
nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}DNS and WHOIS reconnaissance on authorized domain
Command — copy this
dig +short A target.local dig +short MX target.local whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6
Inspect HTTP headers for technology stack fingerprinting
Command — copy this
curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"3. What you will not do with this key
You will not hydra to “see if the key is strong.” Keys are not password lists. You will not ssh-copy-id to machines you do not own. You will not start sshd on 0.0.0.0 to “accept the key.”
Optional: ssh -F the sample config -G t11-practice to see IdentityFile resolve. Connecting still requires an SSH server you own.
Command guide
What you will not do with this key
═══ LINUX / BASH (Network & Reconnaissance Audit) ═══
Scan target host for open ports and service version signatures
Command — copy this
nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}DNS and WHOIS reconnaissance on authorized domain
Command — copy this
dig +short A target.local dig +short MX target.local whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6
Inspect HTTP headers for technology stack fingerprinting
Command — copy this
curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"4. What you ship: a practice Ed25519 pair under cyberlium-lab
t11_practice_ed25519 +.pub, chmod 600 private. Matching -y output. Real id_ed25519 untouched unless the user asked. No hydra. No 0.0.0.0 sshd. DEMO GATE holds.
5. What you record before the next lesson
Practice key paths. DEMO identified/STOP. SAFE NEVER hydra SSH. Next: Quiz — VPN and SSH.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
- Wrong: ssh-keygen without -f and accept overwrite of id_ed25519. hydra -L users -P rockyou. sshd on 0.0.0.0. Paste the private key into Discord.
- Right: Practice path only. Show public with -y. Stop. Next: Quiz — VPN and SSH.
Mission: make a PRACTICE key, not a new main identity by accident
1) / STOP if router. 2) ssh-keygen -t ed25519 -f $HOME/cyberlium-lab/t11_practice_ed25519 -N "" 3) chmod 600 the private file; ssh-keygen -y to verify. Never overwrite real id_ed25519 without asking. Never hydra SSH.
Stuck? Ask Cyberlium AI Mentor
If ssh-keygen asks to overwrite, read the path. If it says id_ed25519, answer no and add -f to the practice file.
APPLY: Correct lab command shape is:
APPLY: True or False: You should paste the practice private key into the course forum so mentors can grade it.
APPLY: ssh-keygen prompts overwrite of /Users/you/.ssh/id_ed25519. You: