Перейти до вмісту
DEVOPS SSH & NETWORKING PRACTICAL LAB
Source: Dev.to | Dec 28, 2025 (UTC)
🧩 MODULE 1 — NETWORK FOUNDATION (WHY SSH WORKS)
🔹 Lecture Topics Covered
- TCP vs UDP
- Port scanning (Nmap)
- NAT & Port Forwarding
- Home vs Cloud networking
- Why SSH ports matter
🧪 LAB 1 — Understanding Ports & Services (Nmap)
🎯 Goal
Understand what ports are, why SSH uses ports, and how attackers find servers.
🧠 Concept (Beginner Explanation)
A port is like a door on a server.
SSH uses port 22 by default.
Attackers scan the internet to find open doors.
🧪 Exercise
- Install nmap:
sudo apt install nmap -y
Enter fullscreen mode
Exit fullscreen mode
- Scan localhost:
nmap localhost
Enter fullscreen mode
Exit fullscreen mode
- Scan SSH explicitly:
nmap -p 22 localhost
Enter fullscreen mode
Exit fullscreen mode
- Run SYN scan (root required):
sudo nmap -sS localhost
Enter fullscreen mode
Exit fullscreen mode
🧠 What You Learn
- What “open”, “closed”, “filtered” mean
- Why SSH port scanning is dangerous
- Why changing SSH port reduces noise
🧑💼 DevOps Real-World Use
Before exposing a server, DevOps engineers scan their own infrastructure to ensure only expected ports are open.
🧪 LAB 2 — NAT & Port Forwarding (Mental Model)
🎯 Goal
Understand why SSH sometimes works locally but not from outside.
🧠 Concept
- Home router = NAT
- Internal IP ≠ Internet IP
- SSH from outside requires port forwarding
🧪 Exercise (Observation)
- Find local IP:
ip a
Enter fullscreen mode
Exit fullscreen mode
- Find gateway:
ip route
Enter fullscreen mode
Exit fullscreen mode
- Understand:
- Why cloud servers don’t need port forwarding
- Why home servers do
🧠 What You Learn
- Why cloud networking feels “easier”
- Why DevOps prefers cloud infra
- Why NAT breaks inbound SSH
🧩 MODULE 2 — SSH FUNDAMENTALS
🔹 Lecture Topics Covered
- What SSH is
- Client vs Server
- Use cases
- VM networking models
🧪 LAB 3 — Install & Start SSH Server
🎯 Goal
Turn a machine into a real server.
🧠 Concept
SSH server = remote control service
🧪 Exercise
Ubuntu:
sudo apt update sudo apt install openssh-server -y sudo systemctl status ssh
Enter fullscreen mode
Exit fullscreen mode
CentOS:
sudo dnf install openssh-server -y sudo systemctl enable sshd --now
Enter fullscreen mode
Exit fullscreen mode
🧠 What You Learn
- Difference between client & server
- How servers accept connections
- How system services work
🧑💼 DevOps Reality
Every cloud VM you manage relies on SSH.
🧪 LAB 4 — SSH Connection Basics
🎯 Goal
Log into a server remotely.
🧪 Exercise
ssh user@server-ip
Enter fullscreen mode
Exit fullscreen mode
Test:
whoami hostname pwd
Enter fullscreen mode
Exit fullscreen mode
🧠 What You Learn
- You are controlling a remote machine
- Commands run on the server, not locally
🧩 MODULE 3 — SSH SECURITY HARDENING (CORE DEVOPS SKILL)
🔹 Lecture Topics Covered
- Change SSH port
- Disable root login
- Whitelist users
- Logs & monitoring
🧪 LAB 5 — Change SSH Port (22 → 2222)
🎯 Goal
Reduce attack surface.
🧪 Exercise
sudo nano /etc/ssh/sshd_config
Enter fullscreen mode
Exit fullscreen mode
Change:
Port 2222
Enter fullscreen mode
Exit fullscreen mode
Test:
sudo sshd -t sudo systemctl restart sshd
Enter fullscreen mode
Exit fullscreen mode
Connect:
ssh -p 2222 user@server
Enter fullscreen mode
Exit fullscreen mode
🧠 What You Learn
- How SSH configuration works
- Why services must be restarted
- How easy it is to break access
🧑💼 DevOps Reality
Every production SSH server does this.
🧪 LAB 6 — Disable Root Login
🎯 Goal
Prevent instant full compromise.
🧪 Exercise
PermitRootLogin no
Enter fullscreen mode
Exit fullscreen mode
Restart SSH.
Test:
ssh root@server
Enter fullscreen mode
Exit fullscreen mode
🧠 What You Learn
- Principle of least privilege
- Why attackers target root
🧪 LAB 7 — AllowUsers Whitelisting
🎯 Goal
Explicitly control access.
🧪 Exercise
AllowUsers devuser
Enter fullscreen mode
Exit fullscreen mode
Test login failure for others.
🧠 What You Learn
- SSH as access control layer
- How DevOps enforces policy
🧩 MODULE 4 — DO NOT LOCK YOURSELF OUT
🔹 Lecture Topics Covered
- Multiple SSH sessions
- Safe changes
- Recovery mindset
🧪 LAB 8 — Two-Session Safety Practice
🎯 Goal
Never brick a production server.
🧪 Exercise
- Open two SSH terminals
- Stop SSH:
sudo systemctl stop sshd
Enter fullscreen mode
Exit fullscreen mode
- Observe:
- Session A works
- Session B fails
- Restore:
sudo systemctl start sshd
Enter fullscreen mode
Exit fullscreen mode
🧠 What You Learn
- Why existing connections survive
- How DevOps recovers mistakes
🧩 MODULE 5 — SSH KEYS (ENTERPRISE AUTH)
🔹 Lecture Topics Covered
- Public/private keys
- ssh-keygen
- ssh-copy-id
- authorized_keys
🧪 LAB 9 — SSH Key Authentication
🎯 Goal
Replace passwords with cryptography.
🧪 Exercise
ssh-keygen -t rsa -b 4096 ssh-copy-id -p 2222 user@server ssh -p 2222 user@server
Enter fullscreen mode
Exit fullscreen mode
🧠 What You Learn
- Cryptographic trust
- Why keys are stronger than passwords
- Foundation for automation
🧩 MODULE 6 — DISABLE PASSWORD LOGIN
🔹 Lecture Topics Covered
- PasswordAuthentication no
- sudo separation
- Recovery planning
🧪 LAB 10 — Enforce Key-Only SSH
🎯 Goal
Eliminate brute-force attacks.
🧪 Exercise
PasswordAuthentication no
Enter fullscreen mode
Exit fullscreen mode
Restart SSH.
Test:
ssh user@server
Enter fullscreen mode
Exit fullscreen mode
From another user → should fail.
🧠 What You Learn
- Zero-trust login
- Production hardening standard
🧩 MODULE 7 — KEEP SSH ALIVE
🔹 Lecture Topics Covered
- SSH keepalive
- Client config
- Long-running sessions
🧪 LAB 11 — Prevent Connection Drops
🎯 Goal
Survive long deployments.
🧪 Exercise
nano ~/.ssh/config
Enter fullscreen mode
Exit fullscreen mode
Host * ServerAliveInterval 60 ServerAliveCountMax 3
Enter fullscreen mode
Exit fullscreen mode
🧠 What You Learn
- Client vs server responsibility
- Why SSH drops connections
🧩 MODULE 8 — FINGERPRINTS & MITM PROTECTION
🔹 Lecture Topics Covered
- Fingerprints
- known_hosts
- MITM attacks
🧪 LAB 12 — Fingerprint Verification
🎯 Goal
Detect impostor servers.
🧪 Exercise
Client:
cat ~/.ssh/known_hosts
Enter fullscreen mode
Exit fullscreen mode
Server:
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
Enter fullscreen mode
Exit fullscreen mode
Compare hashes.
🧠 What You Learn
- Why fingerprints exist
- How SSH prevents MITM
🧩 MODULE 9 — FILE TRANSFER (SFTP / SCP)
🔹 Lecture Topics Covered
- SCP
- SFTP
- GUI tools (Cyberduck)
🧪 LAB 13 — SCP & SFTP
🎯 Goal
Move data securely.
scp -P 2222 file.txt user@server:/home/user/ scp -P 2222 user@server:/home/user/file.txt .
Enter fullscreen mode
Exit fullscreen mode
GUI:
- Connect via SFTP
- Drag & drop files
🧠 What You Learn
- Why FTP is insecure
- Secure automation transfers
🧩 MODULE 10 — SCREEN (PRODUCTION SURVIVAL TOOL)
🔹 Lecture Topics Covered
- screen
- detach/attach
- collaboration
🧪 LAB 14 — Screen Mastery
🎯 Goal
Survive disconnects & collaborate.
screen Ctrl+A Ctrl+D screen -x exit
Enter fullscreen mode
Exit fullscreen mode
🧠 What You Learn
- Persistent sessions
- Remote teamwork
🏁 FINAL CAPSTONE PROJECT
🎯 Scenario
You are the only DevOps engineer managing a production server.
You must:
- Harden SSH
- Use key auth only
- Prevent lockout
- Enable file transfer
- Keep sessions alive
- Share terminal with teammate
🎓 OUTCOME
After completing this:
- Student can manage real servers
- Student understands SSH deeply
- Student thinks like a DevOps engineer
- Student can pass interviews
If you want, next I can:
- Convert this into PDF course manual
- Create graded homework
- Add interview questions
- Add cloud (AWS EC2) version
- Add GitHub lab repo
Just tell me what you want next.
Audience: Absolute beginners
Outcome: Production-ready DevOps engineer mindset
Environment: Ubuntu / CentOS / Cloud / VM
Style: Real-world, mistakes included, recovery included
🧩 MODULE 1 — NETWORK FOUNDATION (WHY SSH WORKS)
🔹 Lecture Topics Covered
- TCP vs UDP
- Port scanning (Nmap)
- NAT & Port Forwarding
- Home vs Cloud networking
- Why SSH ports matter
🧪 LAB 1 — Understanding Ports & Services (Nmap)
🎯 Goal
Understand what ports are, why SSH uses ports, and how attackers find servers.
🧠 Concept (Beginner Explanation)
A port is like a door on a server.
SSH uses port 22 by default.
Attackers scan the internet to find open doors.
🧪 Exercise
- Install nmap:
sudo apt install nmap -y
Enter fullscreen mode
Exit fullscreen mode
- Scan localhost:
nmap localhost
Enter fullscreen mode
Exit fullscreen mode
- Scan SSH explicitly:
nmap -p 22 localhost
Enter fullscreen mode
Exit fullscreen mode
- Run SYN scan (root required):
sudo nmap -sS localhost
Enter fullscreen mode
Exit fullscreen mode
🧠 What You Learn
- What “open”, “closed”, “filtered” mean
- Why SSH port scanning is dangerous
- Why changing SSH port reduces noise
🧑💼 DevOps Real-World Use
Before exposing a server, DevOps engineers scan their own infrastructure to ensure only expected ports are open.
🧪 LAB 2 — NAT & Port Forwarding (Mental Model)
🎯 Goal
Understand why SSH sometimes works locally but not from outside.
🧠 Concept
- Home router = NAT
- Internal IP ≠ Internet IP
- SSH from outside requires port forwarding
🧪 Exercise (Observation)
- Find local IP:
ip a
Enter fullscreen mode
Exit fullscreen mode
- Find gateway:
ip route
Enter fullscreen mode
Exit fullscreen mode
- Understand:
- Why cloud servers don’t need port forwarding
- Why home servers do
🧠 What You Learn
- Why cloud networking feels “easier”
- Why DevOps prefers cloud infra
- Why NAT breaks inbound SSH
🧩 MODULE 2 — SSH FUNDAMENTALS
🔹 Lecture Topics Covered
- What SSH is
- Client vs Server
- Use cases
- VM networking models
🧪 LAB 3 — Install & Start SSH Server
🎯 Goal
Turn a machine into a real server.
🧠 Concept
SSH server = remote control service
🧪 Exercise
Ubuntu:
sudo apt update sudo apt install openssh-server -y sudo systemctl status ssh
Enter fullscreen mode
Exit fullscreen mode
CentOS:
sudo dnf install openssh-server -y sudo systemctl enable sshd --now
Enter fullscreen mode
Exit fullscreen mode
🧠 What You Learn
- Difference between client & server
- How servers accept connections
- How system services work
🧑💼 DevOps Reality
Every cloud VM you manage relies on SSH.
🧪 LAB 4 — SSH Connection Basics
🎯 Goal
Log into a server remotely.
🧪 Exercise
ssh user@server-ip
Enter fullscreen mode
Exit fullscreen mode
Test:
whoami hostname pwd
Enter fullscreen mode
Exit fullscreen mode
🧠 What You Learn
- You are controlling a remote machine
- Commands run on the server, not locally
🧩 MODULE 3 — SSH SECURITY HARDENING (CORE DEVOPS SKILL)
🔹 Lecture Topics Covered
- Change SSH port
- Disable root login
- Whitelist users
- Logs & monitoring
🧪 LAB 5 — Change SSH Port (22 → 2222)
🎯 Goal
Reduce attack surface.
🧪 Exercise
sudo nano /etc/ssh/sshd_config
Enter fullscreen mode
Exit fullscreen mode
Change:
Port 2222
Enter fullscreen mode
Exit fullscreen mode
Test:
sudo sshd -t sudo systemctl restart sshd
Enter fullscreen mode
Exit fullscreen mode
Connect:
ssh -p 2222 user@server
Enter fullscreen mode
Exit fullscreen mode
🧠 What You Learn
- How SSH configuration works
- Why services must be restarted
- How easy it is to break access
🧑💼 DevOps Reality
Every production SSH server does this.
🧪 LAB 6 — Disable Root Login
🎯 Goal
Prevent instant full compromise.
🧪 Exercise
PermitRootLogin no
Enter fullscreen mode
Exit fullscreen mode
Restart SSH.
Test:
ssh root@server
Enter fullscreen mode
Exit fullscreen mode
🧠 What You Learn
- Principle of least privilege
- Why attackers target root
🧪 LAB 7 — AllowUsers Whitelisting
🎯 Goal
Explicitly control access.
🧪 Exercise
AllowUsers devuser
Enter fullscreen mode
Exit fullscreen mode
Test login failure for others.
🧠 What You Learn
- SSH as access control layer
- How DevOps enforces policy
🧩 MODULE 4 — DO NOT LOCK YOURSELF OUT
🔹 Lecture Topics Covered
- Multiple SSH sessions
- Safe changes
- Recovery mindset
🧪 LAB 8 — Two-Session Safety Practice
🎯 Goal
Never brick a production server.
🧪 Exercise
- Open two SSH terminals
- Stop SSH:
sudo systemctl stop sshd
Enter fullscreen mode
Exit fullscreen mode
- Observe:
- Session A works
- Session B fails
- Restore:
sudo systemctl start sshd
Enter fullscreen mode
Exit fullscreen mode
🧠 What You Learn
- Why existing connections survive
- How DevOps recovers mistakes
🧩 MODULE 5 — SSH KEYS (ENTERPRISE AUTH)
🔹 Lecture Topics Covered
- Public/private keys
- ssh-keygen
- ssh-copy-id
- authorized_keys
🧪 LAB 9 — SSH Key Authentication
🎯 Goal
Replace passwords with cryptography.
🧪 Exercise
ssh-keygen -t rsa -b 4096 ssh-copy-id -p 2222 user@server ssh -p 2222 user@server
Enter fullscreen mode
Exit fullscreen mode
🧠 What You Learn
- Cryptographic trust
- Why keys are stronger than passwords
- Foundation for automation
🧩 MODULE 6 — DISABLE PASSWORD LOGIN
🔹 Lecture Topics Covered
- PasswordAuthentication no
- sudo separation
- Recovery planning
🧪 LAB 10 — Enforce Key-Only SSH
🎯 Goal
Eliminate brute-force attacks.
🧪 Exercise
PasswordAuthentication no
Enter fullscreen mode
Exit fullscreen mode
Restart SSH.
Test:
ssh user@server
Enter fullscreen mode
Exit fullscreen mode
From another user → should fail.
🧠 What You Learn
- Zero-trust login
- Production hardening standard
🧩 MODULE 7 — KEEP SSH ALIVE
🔹 Lecture Topics Covered
- SSH keepalive
- Client config
- Long-running sessions
🧪 LAB 11 — Prevent Connection Drops
🎯 Goal
Survive long deployments.
🧪 Exercise
nano ~/.ssh/config
Enter fullscreen mode
Exit fullscreen mode
Host * ServerAliveInterval 60 ServerAliveCountMax 3
Enter fullscreen mode
Exit fullscreen mode
🧠 What You Learn
- Client vs server responsibility
- Why SSH drops connections
🧩 MODULE 8 — FINGERPRINTS & MITM PROTECTION
🔹 Lecture Topics Covered
- Fingerprints
- known_hosts
- MITM attacks
🧪 LAB 12 — Fingerprint Verification
🎯 Goal
Detect impostor servers.
🧪 Exercise
Client:
cat ~/.ssh/known_hosts
Enter fullscreen mode
Exit fullscreen mode
Server:
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
Enter fullscreen mode
Exit fullscreen mode
Compare hashes.
🧠 What You Learn
- Why fingerprints exist
- How SSH prevents MITM
🧩 MODULE 9 — FILE TRANSFER (SFTP / SCP)
🔹 Lecture Topics Covered
- SCP
- SFTP
- GUI tools (Cyberduck)
🧪 LAB 13 — SCP & SFTP
🎯 Goal
Move data securely.
scp -P 2222 file.txt user@server:/home/user/ scp -P 2222 user@server:/home/user/file.txt .
Enter fullscreen mode
Exit fullscreen mode
GUI:
- Connect via SFTP
- Drag & drop files
🧠 What You Learn
- Why FTP is insecure
- Secure automation transfers
🧩 MODULE 10 — SCREEN (PRODUCTION SURVIVAL TOOL)
🔹 Lecture Topics Covered
- screen
- detach/attach
- collaboration
🧪 LAB 14 — Screen Mastery
🎯 Goal
Survive disconnects & collaborate.
screen Ctrl+A Ctrl+D screen -x exit
Enter fullscreen mode
Exit fullscreen mode
🧠 What You Learn
- Persistent sessions
- Remote teamwork
🏁 FINAL CAPSTONE PROJECT
🎯 Scenario
You are the only DevOps engineer managing a production server.
You must:
- Harden SSH
- Use key auth only
- Prevent lockout
- Enable file transfer
- Keep sessions alive
- Share terminal with teammate
🎓 OUTCOME
After completing this:
- Student can manage real servers
- Student understands SSH deeply
- Student thinks like a DevOps engineer
- Student can pass interviews
For further actions, you may consider blocking this person and/or reporting abuse
Залишити відповідь