XK0-005 · Question #307
An administrator is trying to access a server in a cloud via SSH but is unable to log in. The administrator determines the company's IP address has been blocklisted on the server. Which of the…
The correct answer is C. Add the company's IP address from the /etc/hosts.allow. To prevent future SSH blocklisting on a server, the administrator should add the company's IP address to the /etc/hosts.allow file on the server, as this file explicitly defines permitted hosts for services like SSH.
Question
An administrator is trying to access a server in a cloud via SSH but is unable to log in. The administrator determines the company’s IP address has been blocklisted on the server. Which of the following should the administrator do to prevent being blocked in the future?
Options
- AAdd the company's TLS certificate to the authorized_keys and known_hosts files.
- BModify the cloud provider security rules to allow all connectors form the company's IP address.
- CAdd the company's IP address from the /etc/hosts.allow.
- DTurn on SELinux and enable the SSH context.
How the community answered
(45 responses)- A16% (7)
- B9% (4)
- C71% (32)
- D4% (2)
Why each option
To prevent future SSH blocklisting on a server, the administrator should add the company's IP address to the `/etc/hosts.allow` file on the server, as this file explicitly defines permitted hosts for services like SSH.
Adding TLS certificates to `authorized_keys` (which stores SSH public keys) or `known_hosts` (which stores host keys) is unrelated to preventing IP blocklisting for SSH access; these files are for authentication and host authenticity verification, respectively.
Modifying cloud provider security rules to allow all connectors from the company's IP address would be a necessary step if the cloud provider firewall was blocking access, but the question states the server itself has blocklisted the IP, implying a server-side mechanism like TCP wrappers or `fail2ban`.
The `/etc/hosts.allow` file is part of TCP wrappers, which provide host-based access control for network services, including SSH. By adding the company's IP address to this file, the administrator explicitly grants access, preventing the server from blocklisting connections from that IP in the future based on TCP wrapper rules.
Turning on SELinux and enabling the SSH context relates to mandatory access control and securing the SSH daemon, but it does not directly address or prevent an IP address from being blocklisted based on connection attempts.
Concept tested: TCP wrappers host-based access control
Source: https://man7.org/linux/man-pages/man5/hosts.allow.5.html
Topics
Community Discussion
No community discussion yet for this question.