CloudLabBox
Try the free demo

Network+ lab 18 of 27

Secure remote management with SSH and a jump host

Take a router and a switch from Telnet with default passwords to hardened SSH management. You capture a Telnet password in clear text, enable SSH v2 with local accounts at two privilege levels, allow management only from an out-of-band jump host, and switch off services nobody uses.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 2,304 MB in total. That fits the free demo too.

In your workspace: Shared, then CompTIA Network Plus N10-009 guided labs, then 18 - Secure remote management with SSH and a jump host

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 60 minutes
Nodes need
4 vCPU, 2,304 MB
Smallest plan
Lite

The scenario

An audit of the Harbour Logistics depot found the router and switch managed over Telnet with the factory-style password cisco, reachable from every user PC. Your job is to make management secure: encrypted, authenticated per person, limited to what each person needs, and possible only from the jump host on the separate out-of-band (OOB) management network.

DeviceInterfaceAddressNetwork
R1Gi0/010.10.10.1/24user LAN (in-band)
R1Gi0/310.99.0.1/24OOB management
SW1Vlan99 (port Gi1/3)10.99.0.2/24OOB management
JUMPeth010.99.0.10/24OOB management, the only admin entry point
H1eth0DHCP 10.10.10.100+an ordinary user PC

Accounts to create (teaching values): admin / Harb0ur-Adm1n at privilege 15, helpdesk / Help-Desk1 at privilege 1, enable secret Harb0ur-Enable. Domain name harbour.lab.

What you’ll practise

  • Explain in-band and out-of-band management, console access and jump hosts
  • Show why Telnet is unsafe by capturing its credentials
  • Enable SSH version 2 with RSA keys, local users and secrets
  • Apply least privilege with privilege levels
  • Restrict management access to a jump host with an access class
  • Harden devices: remove default credentials, disable unused services, add banners and timeouts

The tasks

  1. Prepare the jump host
  2. See why Telnet must go
  3. Enable SSH v2 with local accounts
  4. Apply least privilege
  5. Allow management only from the jump host
  6. Switch off what nobody uses

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Secure remote management with SSH and a jump host4 nodes and 1 network, 5 links. Every link is listed as text below the diagram.R1SW1H1JUMPOOBeth0Gi0/0Gi0/0Gi0/1eth0Gi0/3Gi1/3
4 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 Gi0/0 to SW1 Gi0/0
  • SW1 Gi0/1 to H1 eth0
  • R1 Gi0/3 to OOB (network)
  • SW1 Gi1/3 to OOB (network)
  • JUMP eth0 to OOB (network)
Nodes in Secure remote management with SSH and a jump host, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
SW1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
JUMPAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CompTIA Network Plus N10-009 guided labs.

  3. Open 18 - Secure remote management with SSH and a jump host and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Network+ labs

All Network+ labs

Related labs in other courses

CloudLabBox is independent of CompTIA, Cisco and Netgate. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.