Close the Door

The box was left wide open, and someone made sure they could get back in. Three things need fixing before you close it up:

• sshd_config permits direct root login and password authentication — both should be off on a hardened host.
• /root/.ssh/authorized_keys carries a rogue key alongside the legitimate admin key. Purge the intruder's key without locking out the real admin.
• The intruder left a note in root's .ssh directory. Recover the flag from it.

Record your findings under /root/case:

1. Set PermitRootLogin no in /etc/ssh/sshd_config.

2. Set PasswordAuthentication no.

3. Remove the rogue key from /root/.ssh/authorized_keys; keep the legitimate admin@signal9 key.

4. Recover the flag to /root/case/flag.txt.

See /root/case/brief.txt. Grading reads the config and key files directly.