GRC Engineering Academy logogrceng.academy
YAML lab 50 bonus XP

Harden web01's SSH and firewall

Start labRead the room

Objectives

Write web01's agreed baseline before changing the server. Use YAML Ain't Markup Language (YAML), a structured text format. Use booleans, true or false values, for switches. Use numbers for counts and ports.

A colleague suggests leaving password login on "just in case". The requirements say keys only, so do not follow that advice.

Agreed requirements for web01

Direct root login over SSH: not allowed.
Password login over SSH: not allowed. Public key login: required.
Maximum login attempts per connection: 3.
Firewall default for incoming traffic: deny.
Allowed ports: 443 for everyone, 22 only from 10.0.4.0/24.
/etc/shadow mode: 640.

Checks the server runs (6)

  • Block direct root login
  • Keys only, no passwords
  • Limit login attempts
  • Default deny with only the web port public
  • SSH only from the office
  • Protect the password hashes

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Lock the front door

    Set root login and password login to false. Set key login to true. Done means all three switches match. Do not quote booleans.

    Block direct root loginKeys only, no passwords

  2. Step 2

    Slow down guessing

    Set max_auth_tries to the required count. Done means it contains a number. Do not enter the number as quoted text.

    Limit login attempts

  3. Step 3

    Set the bouncer's list

    Set incoming traffic to deny by default. Put only 443 in public_ports and set the SSH source network. Done means both match the requirements. Do not make SSH public.

    Default deny with only the web port publicSSH only from the office

  4. Step 4

    Guard the hashes

    Enter the required three-digit /etc/shadow mode. Done means it matches owner, group and others permissions. Do not copy the unsafe mode from earlier.

    Protect the password hashes

Rules summary

  • XP on pass

    50 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 13 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.