🔄 Topic

Troubleshooting SSH connection failures and understanding security warnings during remote access.

🎯 Goal

Understand why an SSH connection failed and analyze the meaning of security warnings related to encryption.

🛠 What I Did

Attempted to connect to a remote machine via SSH:

ssh juribuora@192.168.0.32

Received the following:

  • warning about missing post-quantum key exchange
  • connection reset on port 22

🔗 Key Cybersecurity Connections

SSH is a critical protocol used for:

  • remote administration
  • lateral movement in attacks
  • secure communication between systems

A failed connection combined with warnings can indicate:

  • service misconfiguration
  • network issues
  • outdated cryptographic settings

🔍 Investigation Questions

  • Is the SSH service running on the target machine?
  • Is port 22 open and reachable?
  • Why is the connection being reset?
  • Is the warning related to a real vulnerability or just an upgrade recommendation?

🚨 Detection Opportunities

  • repeated failed SSH connection attempts
  • unusual connection resets across multiple hosts
  • outdated cryptographic configurations

🧭 MITRE ATT&CK Techniques

  • T1021 — Remote Services
  • T1046 — Network Service Discovery

⚠ Challenges

Two things happened at once:

  1. connection failure
  2. cryptographic warning

This makes troubleshooting harder because not all messages are equally important.

📚 What I Learned

  • not all warnings indicate immediate risk
  • connection reset usually means service/network issue
  • security warnings can be informational, not blocking

➡ Next Steps

  • verify SSH service status on target machine
  • check listening ports (ss -tulpn)
  • test connectivity from both ends

🧠 Reflection

This was a good example of how real-world troubleshooting is rarely clean — multiple signals appear at once, and not all of them are relevant.

🧩 Lessons Learned

What worked

Reading and breaking down the error message.

What broke

Assuming the warning was the main issue.

Why it broke

Multiple signals created confusion.

Fix / takeaway

Separate connection issues from security warnings.

📈 Skill Progression Context

This improves troubleshooting and protocol-level understanding, both critical for SOC investigations.

😄 TL;DR

SSH didn’t break because of “post-quantum doom”…
it just wasn’t listening.