SSH keys, config file, hardening, scp and jump hosts

Most steps run on ubu01 as student, with rocky01 as the target; step 7 runs on your laptop. Take a snapshot of both VMs before you start (VBoxManage snapshot rocky01 take before-l33 and the same for ubu01). The key you create here, ~/.ssh/id_ed25519 for student on ubu01, is used by later lessons, so keep it.

1Look at the SSH servers you already have

On ubu01, run this:

systemctl is-active ssh.socket ssh.service
ssh -V

You should see something like this:

active
active
OpenSSH_10.2p1 Ubuntu-2ubuntu3, OpenSSL 3.5.5 27 Jan 2026

On rocky01 (log in with your password from the laptop), run this:

systemctl is-active sshd
sudo sshd -T | grep -E '^(permitrootlogin|pubkeyauthentication|passwordauthentication) '
ls /etc/ssh/sshd_config.d/

You should see something like this:

active
permitrootlogin without-password
pubkeyauthentication yes
passwordauthentication yes
50-redhat.conf

Both servers are running, with different unit names: ssh (plus ssh.socket) on Ubuntu, sshd on Rocky. sshd -T prints the settings sshd will use after reading every file; “without-password” is how it shows the default prohibit-password (root may log in with a key, not a password). If you ticked “Allow root SSH login with password” in the Rocky installer, you’ll also see a file like 01-permitrootlogin.conf and permitrootlogin yes; step 8 overrides it.

✅ Checkpoint: Both SSH servers are active and you know rocky01 still accepts passwords.

2Create your ed25519 key on ubu01

On ubu01, run this and choose a passphrase you’ll remember:

ssh-keygen -t ed25519 -C "student@ubu01"

Press Enter to accept the file name. You should see something like this:

Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/student/.ssh/id_ed25519):
Enter passphrase for "/home/student/.ssh/id_ed25519" (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/student/.ssh/id_ed25519
Your public key has been saved in /home/student/.ssh/id_ed25519.pub
The key fingerprint is:
SHA256:wRxHH/xEhT5QGNr7W2TW2Ljua2Qgpg31kVxviDxCfsE student@ubu01
The key's randomart image is:
+--[ED25519 256]--+
|        ..+++B+o.|
|       o =.=E+oo |
|        +.+.B*. o|
|        ..oooo+=.|
|        S= ...o.*|
|        . .  .o= |
|             oo .|
|             ..o |
|             o=. |
+----[SHA256]-----+

-t ed25519 picks the key type and -C adds a comment, which ends up at the end of the public key so you can tell keys apart in authorized_keys later. The passphrase encrypts the private key on disk: if someone copies the file, it’s useless without it. Your fingerprint and picture will be different.

ls -ld ~/.ssh; ls -l ~/.ssh
cat ~/.ssh/id_ed25519.pub

drwx------ 2 student student 4096 Oct 27 11:40 /home/student/.ssh
total 8
-rw------- 1 student student 444 Oct 27 11:40 id_ed25519
-rw-r--r-- 1 student student  95 Oct 27 11:40 id_ed25519.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDxGcLW9C9Ms6VlsrVcRRwGsBEvi2hpzq3q9+mrfJ0ZH student@ubu01

✅ Checkpoint: ~/.ssh is 700, id_ed25519 is 600, and the .pub file is one line starting with ssh-ed25519.

3Install the public key on rocky01

On ubu01, run this:

ssh-copy-id student@10.10.10.11

Type yes, then student’s password on rocky01. You should see something like this:

/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/student/.ssh/id_ed25519.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
The authenticity of host '10.10.10.11 (10.10.10.11)' can't be established.
ED25519 key fingerprint is SHA256:Q8m2kTnV0yJcR5aP1sXw4LhE9uDfG7bZ3oNqY6iKtUc.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.10.11' (ED25519) to the list of known hosts.
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
student@10.10.10.11's password:

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'student@10.10.10.11'"
and check to make sure that only the key(s) you wanted were added.

The first question is step 1 from the explanation above: ubu01 has never seen rocky01, so it shows the host key fingerprint. To check it properly, run ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub on rocky01’s console and compare. ssh-copy-id then logged in with your password once, appended your public key to ~/.ssh/authorized_keys on rocky01, and set the permissions (and the SELinux label) for you.

✅ Checkpoint: ssh-copy-id reports “Number of key(s) added: 1”.

4Log in with the key and ssh-agent

On ubu01, run this:

ssh student@10.10.10.11 'hostname; ls -ld ~/.ssh ~/.ssh/authorized_keys; ls -Z ~/.ssh/authorized_keys'

Type your key’s passphrase (not the password). You should see something like this:

Enter passphrase for key '/home/student/.ssh/id_ed25519':
rocky01
drwx------. 2 student student 29 Oct 27 11:43 /home/student/.ssh
-rw-------. 1 student student 95 Oct 27 11:43 /home/student/.ssh/authorized_keys
unconfined_u:object_r:ssh_home_t:s0 /home/student/.ssh/authorized_keys

rocky01 asked for nothing: the passphrase prompt came from ubu01, to decrypt your own key. On rocky01 the folder is 700 and the file 600, and SELinux labels them ssh_home_t; if you ever create authorized_keys by hand on Rocky, run restorecon -Rv ~/.ssh so sshd may read it. Now load the key into ssh-agent so you type the passphrase once per session:

eval "$(ssh-agent -s)"
ssh-add
ssh-add -l
ssh student@10.10.10.11 hostname

Agent pid 2973
Enter passphrase for /home/student/.ssh/id_ed25519:
Identity added: /home/student/.ssh/id_ed25519 (student@ubu01)
256 SHA256:wRxHH/xEhT5QGNr7W2TW2Ljua2Qgpg31kVxviDxCfsE student@ubu01 (ED25519)
rocky01

The agent keeps the decrypted key in memory for this login session only. ssh-add -l lists what it holds, and ssh-agent -k (or logging out) ends it.

✅ Checkpoint: ssh to rocky01 prints rocky01 with no prompt at all while the agent runs.

5Write an SSH config file

On ubu01, paste this whole block:

cat > ~/.ssh/config <<'EOF'
Host rocky01
    HostName 10.10.10.11
    User student
    IdentityFile ~/.ssh/id_ed25519

Host *
    ServerAliveInterval 60
EOF
chmod 600 ~/.ssh/config
ssh -G rocky01 | grep -E '^(user|hostname|port|identityfile) '
ssh rocky01 uptime

You should see something like this:

user student
hostname 10.10.10.11
port 22
identityfile ~/.ssh/id_ed25519
 11:47:02 up  2:41,  2 users,  load average: 0.00, 0.01, 0.00

Now ssh rocky01 means “student at 10.10.10.11 with this key”. ssh reads the file top to bottom and keeps the first value it finds for each option, so specific Host blocks go first and Host * defaults go last. ssh -G prints the settings ssh would use for a name without connecting, which is how you debug a config file. ServerAliveInterval sends a small keep-alive every 60 seconds so idle sessions aren’t dropped by firewalls.

✅ Checkpoint: ssh rocky01 uptime works with no user name, IP or key on the command line.

6Copy files with scp and rsync

On ubu01, run this:

echo "disk report from ubu01" > ~/report.txt
scp ~/report.txt rocky01:/tmp/
ssh rocky01 cat /tmp/report.txt
mkdir -p ~/lab33/configs && echo a > ~/lab33/configs/app.conf && echo b > ~/lab33/configs/db.conf
rsync -av ~/lab33/configs/ rocky01:/tmp/configs-copy/
rsync -av ~/lab33/configs/ rocky01:/tmp/configs-copy/

You should see something like this:

report.txt                                    100%   24    21.3KB/s   00:00
disk report from ubu01
sending incremental file list
created directory /tmp/configs-copy
./
app.conf
db.conf

sent 199 bytes  received 97 bytes  197.33 bytes/sec
total size is 4  speedup is 0.01
sending incremental file list

sent 102 bytes  received 12 bytes  228.00 bytes/sec
total size is 4  speedup is 0.04

Both tools use your config file and key, so rocky01: is enough. scp copies everything every time. rsync compares first, which is why the second run sent no files at all; that’s the one to use for folders and anything big (Lesson 37 goes deeper). The trailing slash on the source means “the contents of configs”, without it you’d get /tmp/configs-copy/configs/. If rsync says “rsync: command not found” on the far side, install it there with sudo dnf install -y rsync.

✅ Checkpoint: report.txt and both .conf files are on rocky01, and the second rsync listed no files.

7Jump from the laptop through ubu01

On your laptop (PowerShell on Windows, Terminal on macOS or Linux), create a key and install it on ubu01:

ssh-keygen -t ed25519 -C "student@laptop"
# macOS / Linux:
ssh-copy-id -p 2221 student@127.0.0.1
# Windows PowerShell (no ssh-copy-id there):
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh -p 2221 student@127.0.0.1 "cat >> ~/.ssh/authorized_keys"

Then create the laptop’s config file (~/.ssh/config, on Windows C:\Users\you\.ssh\config) with this content:

Host ubu01
    HostName 127.0.0.1
    Port 2221
    User student

Host rocky01
    HostName 127.0.0.1
    Port 2211
    User student

Host rocky01-via-ubu01
    HostName 10.10.10.11
    User student
    ProxyJump ubu01

Install the laptop key on rocky01 through the jump host, then test:

# macOS / Linux:
ssh-copy-id rocky01-via-ubu01
# Windows PowerShell:
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh rocky01-via-ubu01 "cat >> ~/.ssh/authorized_keys"
ssh rocky01-via-ubu01 hostname
ssh -J ubu01 student@10.10.10.11 hostname

The last two commands should print:

rocky01
rocky01

The laptop can’t reach 10.10.10.11 directly; only ubu01 can. ProxyJump makes ssh log in to ubu01 (by its short name from the same config file) and ask it to forward a TCP connection to rocky01 port 22, and your laptop then talks SSH to rocky01 through it. ubu01 never sees the laptop’s private key. In a company this is the bastion host pattern: one hardened machine faces you, the servers behind it don’t.

✅ Checkpoint: ssh ubu01, ssh rocky01 and ssh rocky01-via-ubu01 all log in from the laptop with your key, without a password.

8Switch off password and root logins

Keep one SSH session to rocky01 open and logged in for this whole step, and don’t close it until the test at the end works. If something goes wrong, that session (or the VirtualBox console) is how you fix it.

On rocky01, run this:

sudo tee /etc/ssh/sshd_config.d/00-saat-hardening.conf >/dev/null <<'EOF'
# SaatVedha lab hardening (Lesson 33)
PasswordAuthentication no
PermitRootLogin no
EOF
sudo sshd -t && echo "syntax OK"
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication) '
sudo systemctl restart sshd

You should see something like this:

syntax OK
permitrootlogin no
passwordauthentication no

From ubu01, prove that passwords are refused and keys still work:

ssh -o PubkeyAuthentication=no rocky01 true
ssh -o PubkeyAuthentication=no root@10.10.10.11 true
ssh rocky01 hostname

student@10.10.10.11: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
root@10.10.10.11: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
rocky01

The file name starts with 00 so it’s read before 50-redhat.conf and any 01- file the installer wrote; for sshd the first value wins. “password” has gone from the list of allowed methods (the gssapi ones come from Rocky’s 50-redhat.conf, for Kerberos logins). Your key login still works.

Now do the same on ubu01, where the restart command is different:

ls /etc/ssh/sshd_config.d/
sudo tee /etc/ssh/sshd_config.d/00-saat-hardening.conf >/dev/null <<'EOF'
# SaatVedha lab hardening (Lesson 33)
PasswordAuthentication no
PermitRootLogin no
EOF
sudo sshd -t && sudo systemctl restart ssh
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication) '

50-cloud-init.conf
permitrootlogin no
passwordauthentication no

On ubu01 the installer often leaves 50-cloud-init.conf with PasswordAuthentication yes. Your 00- file is read first, so it wins, and sshd -T confirms it. From the laptop, ssh -o PubkeyAuthentication=no ubu01 true should now end with “Permission denied (publickey).”

✅ Checkpoint: On both VMs sshd -T shows passwordauthentication no and permitrootlogin no, and key logins from ubu01 and the laptop still work.