Linux networking, SSH hardening and Session Manager

A layered runbook

ip -br addr
ip route
getent hosts example.com
curl -I --connect-timeout 5 https://example.com
sudo ss -lntp
sudo journalctl -u sshd -n 30 --no-pager

On Ubuntu inspect ssh rather than sshd if that is the installed unit. getent follows the host's configured resolver path, including /etc/hosts; dig tests DNS directly. A working DNS answer does not prove the IP is reachable. traceroute or tracepath may be incomplete because routers filter probes.

Secure SSH lab

1. Keep your current SSH session open while changing access.
2. Create a named user and install that user's public key in ~/.ssh/authorized_keys with directory mode 700 and file mode 600.
3. Test a second login before restricting any existing access.
4. Inspect the effective server configuration with sudo sshd -T. Use distribution-supported drop-ins where appropriate.
5. Validate syntax with sudo sshd -t, then reload the correct service.

Disable password/root login only after verifying key access and recovery. Do not expose SSH to the world merely to troubleshoot a mistyped username.

Copy and tunnel

scp -i academy.pem lesson.html ec2-user@203.0.113.10:/tmp/
# Forward local port 13306 through an authorized bastion to a private DB:
ssh -i academy.pem -N -L 127.0.0.1:13306:DB_ENDPOINT:3306 ec2-user@203.0.113.10

The database still needs to permit the bastion's path. Bind the local tunnel to loopback. TLS certificate verification may require connecting with the real DB hostname mapped appropriately; a tunnel does not justify disabling certificate verification.

Session Manager alternative

Install/verify the SSM Agent, attach an appropriately limited instance role, and provide outbound access to required Systems Manager endpoints via internet/NAT or interface endpoints. With permitted IAM access, start a Session Manager session. This removes the need for inbound SSH for that management path. Configure session logging deliberately; logging coverage differs for shell sessions versus port forwarding.

Assignment

Write a timeout-versus-refused-versus-403 decision tree. Demonstrate that a web service reachable on localhost but not externally needs listener/routing/firewall investigation before changing application code.

Official reference

Systems Manager Session Manager

Interview and revision check

What does connection refused suggest compared with a timeout?

Refusal often indicates no listener or an active reject. A timeout often indicates filtering or routing, though neither message alone proves the exact cause.