back to labs
SSH Key Purge
HardDigital Forensics & Incident Response30-45 minThe brief
During an intrusion the attacker planted their own SSH public keys (tagged attacker@evil) into authorized_keys files so they could log back in. Hunt down and remove every rogue key from root and the service accounts — without breaking the legitimate keys that are also present.
What you'll do
- Search all authorized_keys files for the attacker's key
- Remove the rogue key from root's authorized_keys
- Remove the rogue key from the deploy account's authorized_keys
- Leave legitimate keys intact
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.