Linux24: Remote Triage

Real incident response happens across multiple machines — you SSH into affected hosts, work there, and pull evidence back

Objective

Learner can connect to a remote host via SSH, run commands remotely, and transfer files with scp

Mission

The full incident report only exists on a separate machine called ops-server-01 — you do not have direct file access to it from your own workstation. Connect to it over SSH (user: student, password: student), read the report to find the Case Closure Code, then copy the report file back to your local ~/documents/ directory using scp before you move on. Both steps — retrieving the code and copying the file locally — are required to complete this case

Commands you may need to solve this lab

sshscp

Questions

1. What is the basic command to open an SSH connection to remote host ops-server-01 as user student?

2. Which command copies files between hosts over an encrypted SSH connection?

3. Why is it critical to verify a host key fingerprint before logging into a remote server for the first time?

Machine Offline

Isolated container is offline

Click "Start Machine" to boot your sandbox instance and choose your preferred interface