CloudLabBox
Try the free demo

Linux for network engineers lab 7 of 14

SSH: keys, client config, jump hosts and tunnels

You replace passwords with keys, harden a jump host, reach a secure network and an old router through it, and use SSH tunnels to get to services no route will take you to.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 2,560 MB in total. That fits the free demo too.

In your workspace: Shared, then Linux for network engineers guided labs, then 07 - SSH - keys client config jump hosts and tunnels

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 80 minutes
Nodes need
4 vCPU, 2,560 MB
Smallest plan
Lite

The scenario

Kestrel's Bradford site keeps its application server APP and core router R1 on a secure LAN that nothing routes to. The only way in is JUMP, a hardened Linux box with one foot on each network. Your workstation WS sits on the office side. Your job is to make that journey safe and painless, and to reach what's behind JUMP without opening anything new.

DeviceInterfaceAddressRole
WSeth010.7.10.50/24your workstation; no route to the secure LAN
JUMPeth0, eth110.7.10.5/24, 10.7.20.5/24jump host; it does not forward packets
APPeth010.7.20.20/24status page on 127.0.0.1:8080, internal site on port 80
R1Gi0/010.7.20.1/24core router, SSH only
DeviceRunsHow to log in
WSUbuntu 22.04 desktop containerIts console is a remote desktop: root / eve. Open a terminal there.
JUMP, APPAlpine Linux 3.20root, no password.
R1Cisco IOSv 15.9The console opens at >; enable has no password.

What you’ll practise

  • Verify host keys and read known_hosts
  • Create and install SSH keys
  • Harden sshd and test it safely
  • Write a client config with ProxyJump
  • Connect to older network devices with per-host algorithm settings
  • Build local, remote and dynamic tunnels, and copy files over SSH

The tasks

  1. Start the Linux nodes
  2. First contact and host keys
  3. Log in with a key
  4. Harden JUMP
  5. Use a client config and jump through
  6. Reach a router that speaks old SSH
  7. Tunnels
  8. Copy files

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of SSH - keys client config jump hosts and tunnels4 nodes and 1 network, 4 links. Every link is listed as text below the diagram.WSJUMPAPPR1Secureeth1eth0Gi0/0eth0eth0
4 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • WS eth0 to JUMP eth0
  • JUMP eth1 to Secure (network)
  • APP eth0 to Secure (network)
  • R1 Gi0/0 to Secure (network)
Nodes in SSH: keys, client config, jump hosts and tunnels, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
WSEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
JUMPAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
APPAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
R1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Linux for network engineers guided labs.

  3. Open 07 - SSH - keys client config jump hosts and tunnels and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Linux for network engineers labs

All Linux for network engineers labs

Related labs in other courses

CloudLabBox is independent of Cisco, CompTIA, the Linux Foundation and the Linux Professional Institute. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.