◇ OpenCyber Academy
Technical · Chapter 12 · English

Chapter 12 — Contained laboratory I

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 12 — Contained laboratory I

Lesson map

Lesson 12 published. Map, example, EX034.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Lab build"]
  N2["12.2 Exercises in the lab"]
  N3["12.3 Reproducing a size failure"]
  N4["12.4 Lab report"]
  N5["12.6 Hands-on activity"]
  N6["12.7 Lab safety"]
  N7["12.9 Extending the lab"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX034"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Lab build"]
  N2["12.2 Exercises in the lab"]
  N3["12.3 Reproducing a size failure"]
  N4["12.4 Lab report"]
  N5["12.6 Hands-on activity"]
  N6["12.7 Lab safety"]
  N7["12.9 Extending the lab"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX034"]

[Learning outcomes]
    |
    v
[12.1 Lab build]
    |
    v
[12.2 Exercises in the lab]
    |
    v
[12.3 Reproducing a size failure]
    |
    v
[12.4 Lab report]
    |
    v
[12.6 Hands-on activity]
    |
    v
[12.7 Lab safety]
    |
    v
[12.9 Extending the lab]
    |
    v
[Worked example] --> [Exercise EX034]

Learning outcomes

You will (1) build an isolated lab with hybrid-capable TLS and SSH; (2) reproduce a hybrid deployment end to end; (3) reproduce a common failure; and (4) write a lab report.

12.1 Lab build

Use two or three virtual machines or containers on an isolated network: a server with a current OpenSSL and OpenSSH, a client with current tools, and optionally an old client. No production data, no connection to production networks, no real credentials.

Record the versions of OpenSSL, OpenSSH and the clients, since results depend on them. Use generated test keys and lab hostnames. At HHG, trainees build this lab before touching any staging service. Take a snapshot once the lab works.

12.2 Exercises in the lab

Configure the server with hybrid first; connect with the current client (expect hybrid) and old client (expect classical fallback). Then reorder the groups to put classical first and observe that the current client now negotiates classical — the silent fallback of Chapter 8. Restore the correct order.

Save the output of each run with the configuration in place at the time. The silent fallback step matters most: it shows that a single edit can remove hybrid protection with nothing breaking, which is why preference order is checked after every change.

12.3 Reproducing a size failure

Some labs can emulate a device that drops large first messages, for example a proxy configured with a small buffer. Observe timeouts with hybrid and success without it. This shows why the fix is on the network device, not in removing protection.

In the lab, record the size of the first message with and without hybrid, so you can tie the timeouts to the size. At HHG, this reproduced the Summit firewall problem and supported the request for a firmware fix rather than removing hybrid from the portal.

12.4 Lab report

State purpose, environment (versions), steps, results, interpretation and lessons. Include outputs.

Write it so another operator could repeat the lab from your report alone. Keep interpretation separate from results, and record any step that did not go as expected, with what you did next. Include the date and the lab snapshot used. A short report with full versions and outputs is better than a long one without them. Ask a peer to repeat one step from it before you submit it.

12.5 Worked example

An HHG trainee's lab report: server OpenSSL 3.5.x and current OpenSSH; current client negotiated X25519MLKEM768 and mlkem768x25519-sha256; old client fell back to classical; reordered groups caused silent fallback; restored. Lesson: always check preference order after edits.

The report is short but complete: versions, results, the failure reproduced and a lesson that changes practice. Another trainee could repeat it from the report alone. The lesson about preference order is the same one HHG learned on the guest portal, so the lab confirms a production finding safely.

12.6 Hands-on activity

Build the lab and complete the steps; write your report.

Follow the steps in order: build the isolated lab, configure hybrid first, test with current and old clients, reproduce silent fallback by reordering groups, restore the order and, if your lab allows, reproduce a size failure. Save every output. Then write the report with purpose, environment and versions, steps, results, interpretation and lessons, and ask a peer to repeat one step from your report alone. Keep the report. Note what the peer found unclear.

12.7 Lab safety

Keep the lab network separate from home or office networks; use generated test keys; destroy the lab when finished or snapshot it with notes. Never point lab tools at production hosts by mistake: use hostnames that cannot resolve outside the lab, and double-check targets before running commands.

Record in the report where the lab ran, its network layout and the target names, so others can check that the lab stayed isolated. If you suspect a command reached a real host, stop and report it.

12.8 Common errors and limits

Each error weakens the lab or its report. A lab connected to production can affect real services or leak test traffic. Skipping the old-client test hides whether fallback works, which is exactly what HHG's partners on older clients depend on. A report without versions cannot be repeated or compared, because results depend on library and client versions. Check your lab and report for all three. Correct them before submitting.

12.9 Extending the lab

Once the basics work, extend the lab one step at a time: add a second server behind a reverse proxy to show that each hop negotiates separately; add a log parser that counts hybrid and classical sessions; or add an SSH bastion to practise the SFTP configuration of Chapter 10. Each extension should end with a short note in the report so the lab grows into a reusable training environment for the team.

Record each extension's purpose. Note its versions too.

Exercises

Synthesis

A contained lab lets operators reproduce hybrid deployment, silent fallback and size failures safely, and document lessons.

Continue studying — chapter 12 of 18

← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →