Lock the Door (SSH)

The SSH daemon on a small server accepts logins from anyone who can guess a password, including the all-powerful root account, and it gives each connection plenty of tries. Attackers scan for exactly this: exposed SSH with password logins is one of the most common ways servers are broken into.

Your job is to harden the daemon configuration. Turn off direct root login and password authentication so that only keys work, allow only the named administrator to log in, reduce the number of attempts per connection and switch off features the server does not need. Each failed check explains the risk in plain words.

Do not lock yourself out. The administrator must still be able to sign in with a key, so key authentication has to stay enabled. Only when all required checks pass does the lab release its flag. The lab only reads the text you submit; nothing is applied to a real system, and the check tells you what is still weak and why, never the exact line to type.