WIUNIX ACADEMY

OpenSSH user certificates: short-lived access and revocation in a loopback lab

Page 3 of 3. Review the earlier steps and prerequisites before continuing.

YOUR SYSTEM. YOUR STEPS.

Where are you working?

Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.

Rocky Linux 10Reviewed against official documentation · 2026-10-28

USE YOUR OWN VALUES

Configure this tutorial

Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.

Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.

Set values for my environment4 editable values

LET’S BUILD

Confirm that possession of an unsigned key is insufficient

Before revocation, repeat with certificate loading explicitly disabled. The raw key must fail because this listener has no authorized_keys path. An unexpected success means another authentication route remains and the exercise has not proven certificate-only access. Do not make the user account less protected merely to obtain a green result.

Authorized Linux terminal

sudo ssh -F /etc/crypto-policies/back-ends/openssh.config -o StrictHostKeyChecking=yes -o 'UserKnownHostsFile=/var/lib/academy-ssh-cert-lab/known_hosts' -o IdentitiesOnly=yes -o IdentityAgent=none -o CertificateFile=none -i '/var/lib/academy-ssh-cert-lab/client' -p '22222' 'labuser@127.0.0.1'

How do I know it worked?

The unsigned-key attempt is denied while the earlier valid certificate worked; inspect the daemon log rather than counting any failure as success.

LET’S BUILD

Build the KRL separately, inspect it, then replace atomically

The revoked serial is taken from the exact certificate file, scoped to its signing CA. Generate a new KRL filename exclusively, inspect it and test the target before making it active. A nonzero query status can mean revoked OR an error; read the explicit REVOKED result and validate the KRL instead of treating every failure as confirmation. The active file must remain readable and consistent.

Authorized Linux terminal

sudo test ! -e '/var/lib/academy-ssh-cert-lab/revoked.new' || exit 1
sudo ssh-keygen -k -f '/var/lib/academy-ssh-cert-lab/revoked.new' '/var/lib/academy-ssh-cert-lab/client-cert.pub' || exit 1
sudo ssh-keygen -Q -l -f '/var/lib/academy-ssh-cert-lab/revoked.new' || exit 1
sudo ssh-keygen -Q -f '/var/lib/academy-ssh-cert-lab/revoked.new' '/var/lib/academy-ssh-cert-lab/client-cert.pub'
printf 'query exit=%s (read the explicit result above)\n' "$?"

How do I know it worked?

The KRL is valid and the exact target is explicitly REVOKED; stop on malformed/read/parse errors.

LET’S BUILD

Activate the valid KRL without modifying it in place

Only after the previous inspection passed, retain the old empty list, set ownership/mode on the new root-generated file and atomically rename it within the same directory. OpenSSH consults RevokedKeys during authentication, so this fixture needs no production SSH reload. Never regenerate the active file in place while a daemon may read it.

Authorized Linux terminal

sudo test ! -e '/var/lib/academy-ssh-cert-lab/revoked.before' || exit 1
sudo cp -- '/var/lib/academy-ssh-cert-lab/revoked' '/var/lib/academy-ssh-cert-lab/revoked.before'
sudo chown root:root '/var/lib/academy-ssh-cert-lab/revoked.new'
sudo chmod 0644 '/var/lib/academy-ssh-cert-lab/revoked.new'
sudo restorecon -v '/var/lib/academy-ssh-cert-lab/revoked.new'
sudo mv -T -- '/var/lib/academy-ssh-cert-lab/revoked.new' '/var/lib/academy-ssh-cert-lab/revoked'
sudo stat -c '%U %G %a %n' '/var/lib/academy-ssh-cert-lab/revoked'

How do I know it worked?

The active root-owned readable file is now the validated KRL; the previous empty file remains as lab evidence, not a production rollback recommendation.

LET’S BUILD

Repeat the same certificate connection and confirm revocation

Repeat the exact previously successful client command while the certificate is still within its validity window. A new connection must be denied, with a revocation reason in the dedicated daemon’s log. Expiry, a wrong passphrase or a stopped listener can also fail, so do not confuse those with revocation. KRL changes do not terminate already established SSH sessions.

Authorized Linux terminal

sudo ssh -F /etc/crypto-policies/back-ends/openssh.config -o StrictHostKeyChecking=yes -o 'UserKnownHostsFile=/var/lib/academy-ssh-cert-lab/known_hosts' -o IdentitiesOnly=yes -o IdentityAgent=none -i '/var/lib/academy-ssh-cert-lab/client' -o 'CertificateFile=/var/lib/academy-ssh-cert-lab/client-cert.pub' -p '22222' 'labuser@127.0.0.1'

How do I know it worked?

The new login is denied for the explicitly revoked certificate while the loopback daemon is healthy and certificate time has not expired.

LET’S BUILD

Stop only the foreground lab and retain key custody

Use Ctrl+C in the dedicated daemon terminal, then verify its loopback listener disappeared. The normal SSH listener and account remain unchanged. Keep the root-only lab keys/evidence until reviewed and dispose of them through the VM/lab lifecycle; do not copy the private CA into source control or a browser. Production rollout needs reviewed key custody, principal authorization, short validity, revocation distribution and tests for wrong/expired principals before adoption.

Authorized Linux terminal

sudo ss -lntp 'sport = :22222'

How do I know it worked?

No lab listener remains; existing administrative access is healthy and production SSH configuration was never changed.

LET’S BUILD

Remove only the two mappings this lab added

Run only after Ctrl+C, verification that the lab listener is gone, and comparison with your recorded additions. Delete these exact mappings only if this exercise successfully added them. Preserve all pre-existing mappings, port ranges, port22 and administration SSH policy. If one addition failed, clean up only the mapping actually created. After removing equivalence, do not relabel the system SSH tree; the private lab tree is retained only until VM disposal.

Authorized terminal on the host identified in this section

sudo ss -lntp 'sport = :22222'
sudo semanage port -l -C
sudo semanage fcontext -l -C
read -r -p 'Type REMOVE-LAB-MAPPINGS only after checking the conditions above: ' academy_policy_confirm
test "$academy_policy_confirm" = REMOVE-LAB-MAPPINGS || exit 1
sudo semanage port -d -t ssh_port_t -p tcp '22222'
sudo semanage fcontext -d -e /etc/ssh '/var/lib/academy-ssh-cert-lab'
sudo semanage port -l -C
sudo semanage fcontext -l -C

How do I know it worked?

Only lab-created mappings are removed; the lab listener is absent and administration access remains healthy.

GO TO THE SOURCE

Official references

Each environment states how it was reviewed. A documentation review does not claim a hands-on test of every version.

Explore all tutorials ↗