Week 1 Day 4 — NETW-0014 Advanced Operating Systems

0:00–0:10
Recap

0:10–1:45
Lab 1D Parts 3–4

1:45–1:55
Bonus

1:55–2:00
Wrap

0:00 – 0:10 Recap · 10 min

Key auth confirmed, sshd_config walkthrough

Quick verification: passwordless SSH to all three servers from Windows Terminal. Anyone still having issues — address them now before the hardening steps begin. A misconfigured sshd_config can lock you out of a server; having key auth confirmed first is the safety net.
Open /etc/ssh/sshd_config on S1 together. Walk through the structure: commented-out lines show default values. Active lines override the defaults. Ask: "What happens if you save the file with a typo in a directive name?" — SSH daemon may refuse to start on next restart. Good habit: always run sudo sshd -t (config test) before restarting SSH.
Emphasise: every change to sshd_config requires a service restart to take effect: sudo systemctl restart ssh. And every change should be tested immediately from a second terminal — never close your current session until you've confirmed the new session works.

0:10 – 1:45 Lab 1D Parts 3–4 · 95 min

Apply production-grade SSH hardening: disable password auth, change port, banners, timeout, access controls

Part 3a — Disable password authentication (15 min)

In /etc/ssh/sshd_config, find the line #PasswordAuthentication yes. Uncomment it and change to no:
PasswordAuthentication no
Also ensure ChallengeResponseAuthentication no is set — on some Ubuntu versions this can override PasswordAuthentication if left enabled.
Test config: sudo sshd -t — no output means the config is valid. Restart: sudo systemctl restart ssh.
Critical test: Open a brand new terminal window (keep the current session open as a safety net). Attempt to SSH using a password — add -o PubkeyAuthentication=no to force password mode:
ssh -o PubkeyAuthentication=no student@[S1-IP]
You should see: Permission denied (publickey). This confirms password auth is disabled. If you still get a password prompt, check the config file for a second PasswordAuthentication line (some Ubuntu versions have one in a Match block at the bottom).
Repeat on S2 and S3.

Lock-out prevention: Always keep an existing SSH session open when changing sshd_config. If the service fails to restart or you accidentally lock yourself out, the existing session keeps you in. The Hyper-V console is the last resort — connect directly to the VM and fix the config from there.

Part 3b — Change the SSH port (10 min)

In sshd_config, find #Port 22. Uncomment and change to a non-standard port, e.g. Port 2222.
Test config and restart SSH. Then update your Windows Terminal profiles to use the new port: add -p 2222 to the SSH command. Test the connection on the new port before proceeding.
Discuss honestly: changing the port is security through obscurity — it doesn't make the server more secure against a determined attacker. A port scanner finds it in seconds. But it does dramatically reduce the noise in auth.log from automated scanners and bots that only target port 22. In a real environment, this is a useful quality-of-life improvement, not a security control.

Part 3c — Authentication security settings (15 min)

Set the following directives in sshd_config. For each one, discuss what it does and why the value is reasonable:
LoginGraceTime 30 — close the connection if the user hasn't authenticated within 30 seconds. Default is 120 — too generous.
MaxAuthTries 3 — only allow 3 authentication attempts per connection. Default is 6. Lowering this reduces the window for automated attacks.
MaxSessions 5 — limit concurrent sessions per connection. Default 10 is excessive for a server.
PermitRootLogin no — never allow direct root login over SSH. Root should always be accessed by logging in as a regular user and using sudo.
Set user access restrictions — only allow the student account to log in:
AllowUsers student
This means even if an attacker creates a new user account somehow, that account cannot be used for SSH access. To allow multiple users: AllowUsers student admin (space-separated).
Test and restart after each change. Verify the settings work as expected.

Part 4a — Configure the idle timeout (15 min)

SSH itself has no idle timeout — a logged-in session stays open forever if the user walks away. This is a security risk: an unattended terminal is a wide-open door. The timeout is implemented in the Bash shell rather than SSH.
Edit /etc/profile on each server. Add these three lines at the bottom:
TMOUT=300
readonly TMOUT
export TMOUT
This sets a 5-minute idle timeout for all bash sessions (including SSH sessions). readonly prevents users from unsetting it.
The change takes effect for new login sessions — existing sessions are not affected. Log out and log back in, then sit idle for 5 minutes (or temporarily change to 30 seconds to test). You should see the session terminate with timed out waiting for input: auto-logout.

Part 4b — Configure login banners (20 min)

Two distinct banners — they appear at different times:
· SSH Banner — shown before authentication, as soon as the client connects. Typically a legal warning: "Authorised users only. Activity is monitored." Configured via Banner /etc/ssh_banner in sshd_config.
· MOTD (Message of the Day) — shown after successful login. Typically informational: server name, last login, custom ASCII art. File: /etc/motd.
Create the SSH banner: sudo nano /etc/ssh_banner. Add a warning message, for example:
*************************************************************
* AUTHORISED ACCESS ONLY *
* This system is monitored. Unauthorised access is illegal. *
*************************************************************
In sshd_config: Banner /etc/ssh_banner. Restart SSH and verify the banner appears when connecting.
Create the MOTD: sudo nano /etc/motd. The lab sheet includes ASCII penguin art — copy it in. The MOTD is shown immediately after the login prompt. Students can customise their penguin or add server info (hostname, date, reminder to take snapshots).

Lab 1D complete when: Password authentication rejected on all three servers. SSH available on new port. LoginGraceTime, MaxAuthTries, MaxSessions, PermitRootLogin, and AllowUsers all set. Idle timeout active. SSH banner appears before login. MOTD penguin appears after login.

1:45 – 1:55 Bonus · 10 min

Reading auth.log — a preview of fail2ban

Run: sudo tail -f /var/log/auth.log — watch the log live while attempting connections from a second terminal.
Deliberately make three failed login attempts (wrong port, wrong key, etc.). Observe the entries appearing in auth.log. Identify the timestamp, the source IP, and the failure reason in each log line.
Ask: "If a bot was running a dictionary attack against this server, what would this log look like?" — hundreds of entries per minute, all from the same IP. Tomorrow: fail2ban watches for exactly this pattern and blocks it automatically.

1:55 – 2:00 Wrap · 5 min

Confirm all hardening settings are applied on all three servers. Students should check their own sshd_config against the checklist on the lab sheet.
Preview Friday: fail2ban installation and configuration — 30 minutes of lab, then Mini-Assessment 1. Review the SSH topics tonight — the assessment covers everything from Day 1 through today.

Learning outcomes — by end of Day 4, students can…

Disable password authenticationSet PasswordAuthentication no in sshd_config and verify rejection with a forced password attempt

Apply security directivesConfigure LoginGraceTime, MaxAuthTries, MaxSessions, PermitRootLogin, and AllowUsers with appropriate values

Configure idle timeoutSet TMOUT in /etc/profile as readonly/exported and verify it terminates idle sessions

Deploy login bannersCreate and configure both the SSH pre-auth banner and the post-auth MOTD

Read auth.logIdentify failed login attempts, source IPs, and failure reasons in /var/log/auth.log

Common issues and fixes

Issue	Likely cause	Fix
Password auth still works after setting PasswordAuthentication no	Second PasswordAuthentication directive in a Match block at file bottom, or PAM override	Search for all occurrences: `grep -n PasswordAuthentication /etc/ssh/sshd_config`. Also check `/etc/ssh/sshd_config.d/` — Ubuntu 22+ may include a drop-in file that overrides the main config
Locked out after changing SSH port	Windows Terminal profile not updated, or firewall blocking new port	Connect via Hyper-V console. Update the port in sshd_config back to 22 temporarily, restart, then update Windows Terminal and change the port again
AllowUsers blocks the student account	Username typo or case sensitivity (Linux usernames are case-sensitive)	Verify exact username: `whoami` on the server. Correct the AllowUsers line and restart SSH
SSH banner not appearing	Banner directive not pointing to the correct file path, or sshd not restarted	Verify the file exists: `ls -l /etc/ssh_banner`. Check the directive in sshd_config matches the path exactly. Restart SSH
TMOUT not working in existing sessions	TMOUT only applies to new sessions	Log out completely and open a new SSH session. The TMOUT setting is read at shell startup

← Day 3 Lab 1D Handout Day 5 →