Write the change record for a change you actually make

short · 30 min · Objective 1.3

Task

Make a genuine security change to your lab VM, and produce the four artefacts an approver needs before it: impact analysis, test evidence, backout plan and maintenance window. Then use the backout plan, to find out whether it works.

Steps

  1. Choose the change: disable password authentication for SSH and require keys. Write /tmp/change.md BEFORE touching anything.
  2. Under 'Impact analysis', list what depends on SSH password login on this machine, and what happens to each if it stops working.
  3. Under 'Backout plan', write the exact commands to restore the previous state, including how you will reach the machine if SSH is the thing you broke. Console access is part of the answer.
  4. Under 'Test' and 'Window', record how you will verify success and when you are making the change.
  5. Make the change: back up /etc/ssh/sshd_config, set PasswordAuthentication no, and reload the service.
  6. Verify it took, then execute your own backout plan exactly as written and confirm the original state is restored. Note any step your plan was missing — that gap is the finding.

Verify

grep -icE "impact|backout|window|test" /tmp/change.md
test -f /etc/ssh/sshd_config.bak && echo "backup taken: yes"
sudo sshd -t && echo "config parses"
grep -E "^\s*PasswordAuthentication" /etc/ssh/sshd_config

The first must be at least four — all four artefacts are present. The second confirms there is something to back out to; a backout plan referring to a backup you never took is the commonest form of the failure. The third must pass: sshd -t validates the file, and a config that does not parse leaves you locked out after the reload rather than before it. The fourth shows the final state, which after your backout should be the original value.

Notes

The step worth dwelling on is the one where you run your own backout plan. Most backout plans have never been executed, and the gap you found in yours — usually 'how do I reach the machine now' — is exactly the gap that turns a failed change into an outage.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.