Which TWO statements about OpenSSH server host keys are correct? (Choose two.)
LPIC-1 Exam 102-500, objective 110. Security medium
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Choose 2.
Correct They live in /etc/ssh, are created when the OpenSSH server package is installed or first started, and identify the machine rather than any user.
Correct. Files such as /etc/ssh/ssh_host_ed25519_key and its .pub counterpart belong to the host. sshd offers the public half during the key exchange so a client can recognise the machine.
Correct The private halves must be readable only by root, and sshd refuses to use a host key file whose permissions are too open.
Correct. A private host key readable by anyone would let any local user impersonate the server, so sshd checks the mode at startup and rejects the key otherwise.
Not correct Each user gets their own host key pair under ~/.ssh when they first log in.
Wrong. The pairs under ~/.ssh, such as id_ed25519 and id_rsa, are user identity keys used for client authentication. Host keys are per machine and are never generated per user.
Not correct The server sends the private host key to the client, which uses it to verify the server's identity.
Wrong, and it would destroy the security of the protocol. Only the public half is transmitted; the server proves possession of the private half by signing data in the key exchange.
Not correct Incoming public-key logins are authenticated against the host keys, which is why ~/.ssh/authorized_keys is optional.
Wrong. User authentication is checked against the keys listed in the target user's ~/.ssh/authorized_keys. Host keys authenticate the server to the client, never the other way round.
Why
Two independent authentications happen in one SSH session: the server proves who it is with its host key, and the user proves who they are with a user key or a password. The two live in different places, /etc/ssh/ssh_host_* for the machine and ~/.ssh/id_* plus ~/.ssh/authorized_keys for people, and in both cases only the public half ever leaves the machine that holds the private one. ssh-keygen -A regenerates any missing host key types in the default locations.
Where this comes from
- Cited
- manual page sshd(8)
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 110 and space the ones you get wrong.
More questions on this objective
- During an audit you must list every file under /usr that has the set-user-ID bit set, regardless of what its other permission bits are. Which command does that? machine-checked
- You locked the password of the account `intern` and confirmed that its hash in /etc/shadow now begins with an exclamation mark. The intern nevertheless still reaches a shell on the host over SSH, without being prompted for anything. What is going on, and what actually stops it? machine-checked
- You have just been added to a sudo rule on a host and want sudo itself to report which commands you are allowed to run there, without running any of them. Type the complete command. machine-checked
- A daemon started from your bash session keeps hitting a 'too many open files' error. Which command raises the limit on open file descriptors for the current shell and the processes it starts to 4096? machine-checked
- You are about to take a server down for maintenance and want ordinary users refused at login for the next hour, with an explanatory message, while root can still get in. On a system using PAM's pam_nologin, creating which file achieves this? machine-checked
- Which two commands report the users who are logged in right now, rather than a history of past logins? (Choose two.) machine-checked