Lab: Network troubleshooting, key-based SSH and firewall

What you will learn in this TP

• Troubleshoot layer by layer
• Set up and harden key-based SSH
• Filter with a firewall

Introduction #

What you will learn in this section

• Troubleshoot layer by layer
• Set up and harden key-based SSH
• Filter with a firewall

Context. A freshly installed server accepts SSH passwords and has no firewall. A developer also complains that a service "answers on the server but not from my laptop".

Prerequisites: a disposable Ubuntu 24.04 VM with console access (in case of an SSH or firewall mistake)  ·  Estimated time: 45 min

Key-only SSH access, a default-deny firewall and a correctly exposed service.

Hands-on #

Guided steps, with their solution.

1. 1. Take a network inventory

   Why? Knowing addresses, routes, DNS and open ports is the prerequisite for any troubleshooting.

   Note interfaces and addresses, the default gateway, DNS servers and listening ports.

2. 2. Troubleshoot resolution and connections

   Why? Go up the layers: DNS, port, then application.

   Resolve a name with dig and getent, test a port with nc, inspect an HTTPS request with curl -v, and capture DNS traffic during a lookup.

3. 3. Fix "it only works locally"

   Why? A service listening on 127.0.0.1 is invisible from the network: ss shows it immediately.

   Start an HTTP server on 127.0.0.1:8000, see the listening address with ss, test from the VM's IP address, then restart it on 0.0.0.0.

4. 4. Switch SSH to key authentication

   Why? A protected ed25519 key is far safer than a password, and a config file avoids retyping options.

   Generate a key, install it for your account (connecting to localhost for the lab), declare a tp host in ~/.ssh/config and connect.

5. 5. Harden the SSH server

   Why? Forbidding root and passwords defeats brute-force attacks.

   Create a file in /etc/ssh/sshd_config.d/ forbidding root and passwords, validate with sshd -t, reload and check a key-less connection is refused. Keep your session open.

6. 6. Enable the firewall

   Why? Deny everything by default, then open only what is needed, to the sources that need it.

   With ufw: default deny incoming, allow SSH, allow port 8000 only from the VM's private network. Enable it, then look at the generated nftables rules.

7. 7. Create an SSH tunnel

   Why? A tunnel gives access to an internal service without opening its port in the firewall.

   Forward local port 9000 to the server's port 8000 through SSH, test with curl, then stop the tunnel and the HTTP server.

Difficulty level : ●●○○○ (2/5)