Network › Module 9 › Lesson 3
Hardening YOUR SSH Config
Read YOUR ~/.ssh/config if present — do not smash production aliases to prove you were here.
Visual · ssh_config_hardening
Client config literacy on THIS user. Do not break production.
Opening
ssh_config is how THIS account chooses keys, jump hosts, and algorithms — read it before you rewrite it.
OpenSSH client configuration lives in ~/.ssh/config (and system files). It can pin HostName, IdentityFile, User, and options that stop you from falling back to passwords. It can also contain production aliases you must not casually destroy for a screenshot. This lesson is read-first. If the file is missing, you write a tiny example under cyberlium-lab, not a surprise overwrite of a working config. Original Cyberlium.
1. Read, then copy interesting lines into a note — not into Discord
If ~/.ssh/config exists, list Host / HostName / IdentityFile / PasswordAuthentication lines. Redact real hostnames if you would not want them in a screenshot. The lesson cares that you know the file's job, not that you leak your employer's jump box.
If the file does not exist, that is normal. Do not invent a production mesh. Write a sample under cyberlium-lab.
Command guide
Read, then copy interesting lines into a note — not into Discord
═══ COMMANDS ═══
Command — copy this
if [ -f "$HOME/.ssh/config" ]; then grep -Ei "^[[:space:]]*(Host|HostName|IdentityFile|User|PasswordAuthentication|PubkeyAuthentication)[[:space:]]" "$HOME/.ssh/config" | head -n 40
2. A sample you own is safer than editing the real file blindly
Create t11-ssh-config.sample with a Host block that points IdentityFile at the coming practice key path and sets PasswordAuthentication no for that dummy Host. This sample is not wired into ssh unless you later Include it on purpose.
Never set StrictHostKeyChecking no as a global “lab hack.” Teaching people to skip host keys is how they get a different kind of MITM than Topic 11 already refused.
Command guide
A sample you own is safer than editing the real file blindly
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssh-client
macOS: Built-in
Windows: Built-in (OpenSSH)
═══ COMMANDS ═══
Command — copy this
cat > "$HOME/cyberlium-lab/t11-ssh-config.sample" << 'EOF' Host t11-practice HostName 127.0.0.1 User IGNORE_UNLESS_YOU_RUN_AN_SSH_SERVER_YOU_OWN IdentityFile ~/.ssh/../cyberlium-lab/t11_practice_ed25519 PasswordAuthentication no PubkeyAuthentication yes EOF
Command — copy this
ssh -F "$HOME/cyberlium-lab/t11-ssh-config.sample" -G t11-practice | grep -Ei "identityfile|passwordauthentication|hostname" | head -n 20
3. Server-side hardening is a different file you also must own
sshd_config PasswordAuthentication no belongs on a server you administer, with a live key already working, and a console fallback. This lesson will not walk you into locking yourself out, and it will not tell you to harden a campus jumphost.
Client sample + later practice key is enough shipping for Cyberlium Topic 11.
Command guide
Server-side hardening is a different file you also must own
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
python3 -c "print('StrictHostKeyChecking no is not a hardening flex; it is how MITM wins')"4. What you ship: a read of YOUR config plus a sample, production intact
Record whether ~/.ssh/config exists. Do not delete production Host blocks. Sample file chmod 600. No StrictHostKeyChecking no global. No hydra. DEMO GATE holds.
5. What you record before the next lesson
t11-ssh-config.sample. DEMO identified/STOP. SAFE NEVER break production ssh. Next: Lab — Practice Key.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
Replace ~/.ssh/config with a blank file for a cleaner screenshot. StrictHostKeyChecking no globally. hydra to “test the hardened server.”
Right
Read real config if present. Keep a sample in cyberlium-lab. Next: Lab — Practice Key in cyberlium-lab.
Mission: read YOUR ssh config without breaking it
1) / STOP if router. 2) If ~/.ssh/config exists, read Host/IdentityFile lines (redact as needed). 3) Write t11-ssh-config.sample under cyberlium-lab. Do not smash production. Do not hydra.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor what Include means in ssh_config — not how to disable host-key checking for a phishing lab.
Knowledge Check
APPLY: You find a production Host jump-prod in ~/.ssh/config. For this lesson you:
Multiple choice
Knowledge Check
APPLY: True or False: StrictHostKeyChecking no as a global lab default is good hardening.
True or False
Knowledge Check
APPLY: PasswordAuthentication no in a SAMPLE Host block is:
Multiple choice