Shut the password spray out of the jump host
Try this labAll SY0-701 practice
- Certification
- SY0-701
- Format
- Artifact workspace
- Difficulty
- easy
- Estimated time
- 12 min
- Automated checks
- 8
SCENARIO
A password spray hit edge-bastion-1 overnight. Every administrator already has a managed SSH key, so password login is no longer needed. The host must keep serving its private jump-host workflow while the exposed authentication paths and unused X11 forwarding are closed.
TASK
Repair sshd_config so only ssh-admins can log in with managed keys at 10.20.0.14:22.
- Disable direct root, password, keyboard-interactive, empty-password, and X11 access; allow at most three authentication attempts.
- Preserve TCP forwarding for the jump-host workflow.