Remote Access with SSH Keys & Linux Package Management

Lab 09 of 20 · SSH & Packages · 5 hands-on activities · bilingual (English + සිංහල)

පිටුව 09: SSH Keys මඟින් ආරක්ෂිතව Server එකට ඇතුල් වීම සහ Package කළමනාකරණය

Asymmetric Cryptography (Public vs Private Key), SSH login සැකසීම (~/.ssh/authorized_keys), chmod 400 ආරක්ෂාව, සහ apt/yum packages ස්ථාපනය.

Architectural Foundation & Systems Diagram

Production cloud servers never permit plaintext password authentication. System administrators connect using Asymmetric Public-Key Cryptography over OpenSSH.

• 🔑 Private Key (id_rsa) — Stays on your laptop. NEVER share it, commit it to GitHub, or email it! Protected with strict file permissions: chmod 400.

• 🔓 Public Key (id_rsa.pub) — The lock. Placed on the remote server inside ~/.ssh/authorized_keys. Anyone with the matching private key can unlock and authenticate.

• 📦 Package Managers — • Debian/Ubuntu: apt / apt-get (.deb packages).
  • RHEL/Amazon Linux: yum / dnf (.rpm packages).

Step-by-step practical lab

Step 01: Audit Open Listening Network Ports & Sockets

සිංහලෙන් — Server එකේ open කර ඇති Ports (දොරටු) පරීක්ෂා කරමු.

Display all open listening TCP sockets, port bindings, and associated process IDs.

ss -tuln

• -t : TCP sockets පමණක් පෙන්වයි.
• -u : UDP sockets.
• -l : Listening (සක්‍රීයව බලාසිටින) sockets පමණක් filter කරයි.
• -n : Numeric: නම් වෙනුවට port අංක (80, 22, 8080) පෙන්වයි.

Expected output

Netid  State   Recv-Q  Send-Q   Local Address:Port   Peer Address:Port
tcp    LISTEN  0       511            0.0.0.0:80          0.0.0.0:*
tcp    LISTEN  0       128            0.0.0.0:22          0.0.0.0:*
tcp    LISTEN  0       50             0.0.0.0:8080        0.0.0.0:*

Step 02: Verify DNS Resolution via Dig Tool

සිංහලෙන් — Domain Name එකක් IP Address බවට හැරවීම (DNS) පරීක්ෂා කරමු.

Query Domain Name System (DNS) servers to resolve a domain name into an IP address.

curl -I https://google.com

• curl -I : DNS resolution සහ TLS handshake සාර්ථකදැයි තහවුරු කරයි.

Expected output

HTTP/2 301
location: https://www.google.com/
date: Wed, 16 Sep 2026 12:55:00 GMT

Hands-on practice activities

Work through these yourself — tick them off as you go.

• Activity 41: Generate 4096-bit RSA Keypair (Checkpoint) — Execute 'ssh-keygen -t rsa -b 4096 -C sre-deploy-key' to create military-grade cryptographic keys.
• Activity 42: Enforce Strict Chmod 400 Permissions (Checkpoint) — Run 'chmod 400 ~/.ssh/id_rsa'. OpenSSH client will refuse connection if private key is world-readable!
• Activity 43: Append Public Key to authorized_keys (Checkpoint) — On remote host, append public key string to ~/.ssh/authorized_keys with chmod 600 permissions.
• Activity 44: APT vs YUM Command Parity (Checkpoint) — Understand that 'apt-get update && apt-get install' on Ubuntu matches 'yum install' on Amazon Linux.
• Activity 45: SSH Private Key Security Quiz (Quiz) — What chmod permission should you apply to your private SSH key before connecting? Answer: chmod 400.

Keep going: ← Lab 08 · Lab 10 → · Track your progress in the Self Guide