Vulnarex | Elite Cybersecurity Learning Platform

#Locking Down the Management Plane#link

SSH is the primary target for brute-force attacks. In this lab, you will transform a default SSH installation into a hardened fortress by removing password authentication and enforcing cryptographic keys.

Phase 1: Generating a Hardened Key Pair

We avoid the legacy RSA algorithm in favor of Ed25519, which is faster, more secure, and has a smaller footprint.

Generate Ed25519 Key Pair

root@vulnarex:~#ssh-keygen -t ed25519 -C "admin@vulnarex-lab" -f ~/.ssh/id_ed25519

info

💡 Always use a passphrase when generating keys. If your laptop is stolen, the key is useless without the passphrase.

Phase 2: Deploying the Key and Disabling Passwords

After copying the public key to the server, we must modify the SSH daemon configuration to stop accepting passwords.

bash

# 1. Copy key to server
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server-ip

# 2. Edit /etc/ssh/sshd_config
# Set these values:
PasswordAuthentication no
PermitRootLogin no
PubkeyAuthentication yes

# 3. Restart SSH
systemctl restart ssh

Once `PasswordAuthentication no` is applied, any attacker attempting to brute-force the password will be instantly rejected by the server without any password prompt.

Phase 3: Adding a Layer of Brute-Force Defense

Installing and Configuring Fail2Ban

root@vulnarex:~#apt-get install fail2ban fail2ban-client set sshd ban-time 3600 maxretry 3

Setting	Default Value	Hardened Value	Security Benefit
PermitRootLogin	yes / prohibit-password	no	Prevents direct root targeting
PasswordAuthentication	yes	no	Eliminates brute-force
Port	22	Custom (e.g. 2222)	Reduces noise in logs
PubkeyAuthentication	yes	yes	Strong cryptographic proof

Final Audit

The final step is to attempt to log in *without* your key to ensure the lockdown is working.

Testing the Lockdown

root@vulnarex:~#ssh -o PubkeyAuthentication=no user@server-ip

▪Verify that root login is disabled
▪Confirm a custom port is working if changed
▪Check Fail2Ban logs for banned IPs
▪Verify that the .ssh directory has 700 permissions

STRICT SECURE AUDIT RULE

Never disable password authentication until you have verified that your public key login works in a separate terminal session. Otherwise, you will lock yourself out of the server.

quiz BLOCK (★ 50 XP)

Why is Ed25519 preferred over RSA for SSH keys in modern environments?

Select your proof vectors above

challenge BLOCK (★ 100 XP)

The Permission Puzzle