OpenSSH user certificates: short-lived access and revocation in a loopback lab

Use a dedicated VM with active SELinux and standard OpenSSH policy. Before adding anything, inspect local path customizations and the full port list: the chosen port must have no existing service-specific assignment, including a range, or prior local customization, and the lab prefix must have no existing equivalence. On conflict choose a different lab value; never modify/delete another mapping. Missing tools do not justify disabling SELinux. Generic unreserved_port_t ranges are different from a service-specific assignment; do not modify them. The lab adds one new ssh_port_t entry for its otherwise unused port and never uses modify.

Only after confirming no conflict, add the two lab-owned mappings below. Equivalence to the SSH configuration tree lets the standard host-key filename receive its policy label; restorecon is limited to the new lab tree. Retain the output and verify sshd_key_t for the host key. Stop on a different installed-policy result or unresolved AVC; do not generate a blanket allow rule. This registers an SELinux port, not a public firewall opening.

getenforce
sudo semanage fcontext -l -C
sudo semanage port -l
read -r -p 'Type ADD-LAB-MAPPINGS only after checking the conditions above: ' academy_policy_confirm
test "$academy_policy_confirm" = ADD-LAB-MAPPINGS || exit 1
sudo semanage fcontext -a -e /etc/ssh '/var/lib/academy-ssh-cert-lab' || exit 1
sudo semanage port -a -t ssh_port_t -p tcp '22222' || exit 1
sudo restorecon -Rv '/var/lib/academy-ssh-cert-lab'
ls -Zd '/var/lib/academy-ssh-cert-lab' '/var/lib/academy-ssh-cert-lab/ssh_host_rsa_key'
matchpathcon '/var/lib/academy-ssh-cert-lab/ssh_host_rsa_key'
sudo ausearch -m AVC,USER_AVC -ts recent

Run the parser and effective-config view against the explicit lab file. Inspect the emitted port/listenaddress, trust and revocation paths, forced command and authentication settings. A failure about a missing privilege-separation directory means the packaged service prerequisites must be repaired through its native package procedure on the disposable VM; do not modify the production daemon or disable privilege separation.

sudo /usr/sbin/sshd -t -f '/var/lib/academy-ssh-cert-lab/sshd_config' || exit 1
sudo /usr/sbin/sshd -T -f '/var/lib/academy-ssh-cert-lab/sshd_config' | awk '$1 ~ /^(port|listenaddress|trustedusercakeys|authorizedprincipalsfile|revokedkeys|forcecommand|authenticationmethods|authorizedkeysfile)$/ {print}'

Open a separate authorized terminal on the lab VM and keep it attached to this foreground process. This command does not start/restart/enable the system ssh service. Leave its output visible for certificate rejection reasons; logs can contain usernames and must remain private. Stop this lab daemon with Ctrl+C in its own terminal when the exercise is finished.

sudo /usr/sbin/sshd -D -e -f '/var/lib/academy-ssh-cert-lab/sshd_config'

In the other terminal, check the listener and derive a separate known_hosts file from the host public key you just generated locally. This authenticated local file is the trust source; a network keyscan by itself would not authenticate a remote host. No existing known_hosts entries are deleted or bypassed.

sudo ss -lntp 'sport = :22222'
sudo ssh-keygen -lf '/var/lib/academy-ssh-cert-lab/ssh_host_rsa_key.pub'
sudo awk '{print "[127.0.0.1]:22222 " $1 " " $2}' '/var/lib/academy-ssh-cert-lab/ssh_host_rsa_key.pub' | sudo tee '/var/lib/academy-ssh-cert-lab/known_hosts' >/dev/null
sudo chmod 0644 '/var/lib/academy-ssh-cert-lab/known_hosts'

Sign only the public user key. Serial1001 and key ID identify this issuance; the principal must match the account mapping created next. A one-minute start allowance handles a small lab clock difference, not a substitute for correct time. Clearing extensions removes forwarding/PTY defaults; the isolated daemon also enforces a harmless fixed command. The CA passphrase is entered interactively.

sudo ssh-keygen -s '/var/lib/academy-ssh-cert-lab/user-ca' -I academy-user-1001 -z 1001 -n 'academy-operator' -V -1m:+15m -O clear '/var/lib/academy-ssh-cert-lab/client.pub'
sudo ssh-keygen -L -f '/var/lib/academy-ssh-cert-lab/client-cert.pub'

The client reads only the system crypto-policy algorithm backend, not user or normal system SSH connection configuration. The isolated identity/certificate, pinned known_hosts and absence of an agent are explicit. Do not weaken the active policy if it rejects the algorithm/certificate. Enter the user-key passphrase interactively; the server must return only the fixed id command as labuser and close.

sudo ssh -F /etc/crypto-policies/back-ends/openssh.config -o StrictHostKeyChecking=yes -o 'UserKnownHostsFile=/var/lib/academy-ssh-cert-lab/known_hosts' -o IdentitiesOnly=yes -o IdentityAgent=none -i '/var/lib/academy-ssh-cert-lab/client' -o 'CertificateFile=/var/lib/academy-ssh-cert-lab/client-cert.pub' -p '22222' 'labuser@127.0.0.1'