NetOps Quest

Tracks

1. 01🌐Networking Foundations

   0/12 lessons

   From IP addresses to packets on the wire

   The mental model every operator needs. Before we touch SSH or VPNs, you need to *see* what's actually happening on the network — IPs, ports, subnets, DNS, NAT, the whole stack.

   Lesson list (12)

   • 01
     IP Addresses~15 min · ip, ipv4, ipv6, private-network
   • 02
     Subnets & CIDR~15 min · subnet, cidr, subnet-mask, routing
   • 03
     Ports~15 min · ports, tcp, udp, well-known
   • 04
     TCP vs UDP~15 min · tcp, udp, transport-layer, protocols
   • 05
     DNS~15 min · dns, name-resolution, hosts-file, mdns
   • 06
     DHCP~15 min · dhcp, lease, reservation, dora
   • 07
     NAT~15 min · nat, pat, port-forwarding, private-network
   • 08
     MAC Addresses~15 min · mac-address, arp, layer-2, oui
   • 09
     OSI Model Simplified~15 min · osi, tcp-ip, layers, encapsulation
   • 10
     Gateway & Routing~15 min · gateway, routing, traceroute, mtr
   • 11
     Localhost & 0.0.0.0~15 min · localhost, loopback, 0.0.0.0, binding
   • 12
     Network Diagnostics~18 min · ping, traceroute, dig, lsof, diagnostics

   ✓Quiz · 6 questions→

2. 02🔐SSH Fundamentals

   0/12 lessons

   From first connection to key-based muscle memory

   Now we leave the lab and ride the wire. SSH is the universal remote — every server, every Pi, every cloud VM speaks it. By the end of this track, password auth feels archaic and `ssh user@host` is reflex.

   Lesson list (12)

   • 01
     What Is SSH~15 min · ssh, openssh, encryption, telnet
   • 02
     First Connection~15 min · ssh, first-connection, fingerprint, ssh-dir
   • 03
     SSH Key Pairs~15 min · public-key, private-key, asymmetric-crypto, ed25519
   • 04
     Key Generation~15 min · ssh-keygen, ed25519, passphrase, rsa
   • 05
     Installing Your Public Key~15 min · ssh-copy-id, authorized-keys, permissions
   • 06
     Key-Based Authentication~15 min · authentication, passwords, audit, revocation
   • 07
     SSH Agent~15 min · ssh-agent, passphrase, keychain, agent-forwarding
   • 08
     Known Hosts~15 min · known-hosts, tofu, host-key, mitm
   • 09
     SSH on Different Ports~15 min · ssh-port, sshd-config, non-standard-port
   • 10
     Fingerprint Verification~15 min · fingerprint, tofu, out-of-band, ssh-keyscan
   • 11
     SCP Basics~15 min · scp, file-transfer, deprecated
   • 12
     SSH Debugging~15 min · ssh-debug, verbose, permission-denied, connection-refused

   ✓Quiz · 6 questions→

3. 03⚙️SSH Config Power User

   0/12 lessons

   Stop typing IPs. Start typing names.

   Once you have more than two machines, your SSH config file is the difference between fluent fleet operations and constant toil. This track turns ~/.ssh/config into a power tool — host aliases, ProxyJump, ControlMaster, port forwarding, the whole kit.

   Lesson list (12)

   • 01
     The Config File~15 min · ssh-config, precedence, ini-format
   • 02
     Host Aliases~15 min · ssh-alias, hostname, user, port
   • 03
     Full Config Block~15 min · ssh-config, directives, compression, keepalive
   • 04
     Wildcard Hosts~15 min · wildcards, host-pattern, global-defaults
   • 05
     ProxyJump~15 min · proxyjump, bastion, jump-host, ssh-tunnel
   • 06
     KeepAlive~15 min · keepalive, server-alive, nat-timeout, frozen-session
   • 07
     Multiple Keys~15 min · multiple-keys, identityfile, identitiesonly, github
   • 08
     Agent & macOS Keychain~15 min · addkeystoagent, usekeychain, macos, passphrase
   • 09
     ControlMaster — Connection Multiplexing~18 min · controlmaster, controlpath, controlpersist, multiplexing
   • 10
     LocalForward — Reach Remote Services~15 min · port-forwarding, localforward, ssh-tunnel
   • 11
     RemoteForward & DynamicForward~15 min · remoteforward, dynamicforward, socks-proxy
   • 12
     Real Fleet Config~20 min · fleet, production-config, tailscale, lan, complete-example

   ✓Quiz · 6 questions→

4. 04📂File Transfer & Sync

   0/12 lessons

   rsync until it's reflex

   scp is the toy. rsync is the tool. This track turns file transfer from "copy and pray" into deliberate, restartable, deletable, exclude-able sync — the kind that actually scales to backups, dotfiles, and 100GB datasets.

   Lesson list (12)

   • 01
     SCP Review~12 min · scp, limits
   • 02
     SFTP~12 min · sftp, interactive, ftp-like
   • 03
     rsync — Why It Wins~15 min · rsync, delta-transfer, fundamentals
   • 04
     rsync Essentials~15 min · rsync, flags, archive-mode
   • 05
     rsync over SSH (and the Trailing Slash)~15 min · rsync, ssh, trailing-slash
   • 06
     Excluding Files~12 min · rsync, exclude, rsyncignore
   • 07
     Dry Run & --delete Safety~12 min · dry-run, delete, safety, backup
   • 08
     Partial & Resume~10 min · rsync, partial, resume, P-flag
   • 09
     Backup Patterns with --link-dest~18 min · backup, link-dest, incremental, snapshots
   • 10
     Dotfiles Sync~15 min · dotfiles, rsync, git
   • 11
     tar + SSH Pipe~10 min · tar, ssh, pipe, many-small-files
   • 12
     Performance Tuning~18 min · performance, 10gbe, compression, bwlimit, ciphers

   ✓Quiz · 6 questions→

5. 05🔧Network Tools & Diagnostics

   0/13 lessons

   The toolbox you reach for when something is broken

   Every operator carries the same handful of tools — ping, traceroute, dig, curl, lsof, nmap, tcpdump, iperf3. This track makes each reflexive: which one to grab in the first 10 seconds, what to read in its output, when to stop and reach for the next.

   Lesson list (13)

   • 01
     ping~12 min · ping, icmp, rtt, packet-loss
   • 02
     traceroute & mtr~15 min · traceroute, mtr, hops, path-tracing
   • 03
     curl Basics~12 min · curl, http, headers, redirect
   • 04
     curl Advanced — APIs & Auth~15 min · curl, post, json, api, auth
   • 05
     wget~10 min · wget, download, mirror
   • 06
     netstat & ss~12 min · netstat, ss, listening-ports, connections
   • 07
     lsof -i~12 min · lsof, ports, process, eaddrinuse
   • 08
     nmap~15 min · nmap, port-scan, discovery, ethics
   • 09
     dig & nslookup~12 min · dig, nslookup, dns, record-types
   • 10
     arp~10 min · arp, mac-address, lan-discovery
   • 11
     tcpdump~15 min · tcpdump, packet-capture, wireshark
   • 12
     networksetup (macOS)~12 min · networksetup, macos, static-ip, dns, mtu
   • 13
     Speed Testing — iperf3 & friends~15 min · iperf3, speedtest, throughput, 10gbe

   ✓Quiz · 6 questions→

6. 06🛡️VPN & Remote Access

   0/12 lessons

   Reach your machines from anywhere

   Coffee shop, hotel, vacation house — your fleet should still be reachable. WireGuard and Tailscale make that work without port forwards or static IPs. This track covers both, with the practical setup you'll actually use.

   Lesson list (12)

   • 01
     Why VPN~12 min · vpn, remote-access, nat, private-network
   • 02
     WireGuard Overview~12 min · wireguard, vpn-protocol, noise-protocol
   • 03
     WireGuard Concepts~12 min · wireguard, concepts, peer, allowedips
   • 04
     WireGuard Setup~18 min · wireguard, wg-quick, keys, config
   • 05
     Tailscale — Zero-Config WireGuard~12 min · tailscale, mesh, magicdns, nat-traversal
   • 06
     Tailscale Setup & Stable IPs~12 min · tailscale, stable-ip, cgnat-range
   • 07
     MagicDNS~10 min · magicdns, tailscale, hostnames
   • 08
     Tailscale HTTPS Certificates~12 min · tailscale, https, tls, lets-encrypt
   • 09
     Tailscale SSH~12 min · tailscale-ssh, identity-auth, session-recording
   • 10
     Tailscale ACLs & Grants~15 min · tailscale, acl, tags, grants
   • 11
     Headscale — Self-Hosted Tailscale~12 min · headscale, self-hosted, tailscale-alternative
   • 12
     SSH Tunneling as Mini-VPN~12 min · ssh-tunnel, socks, wake-on-lan

   ✓Quiz · 6 questions→

7. 07🖥️Multi-Machine Fleet Management

   0/14 lessons

   Run a 9-Mac fleet without losing your mind

   When you have 5+ machines, ad-hoc SSH stops scaling. This track is the cwkPippa-tested operating model — SSH config + host lists + shell loops, with optional Ansible escalation. Plus the 10GbE/Thunderbolt LAN backbone that makes the fleet feel like one big machine.

   Lesson list (14)

   • 01
     The Problem~10 min · fleet, scale, automation
   • 02
     SSH Config Mastery for Fleets~15 min · ssh-config, host-lists, groups
   • 03
     Parallel SSH~15 min · parallel-ssh, shell-loops, gnu-parallel
   • 04
     pssh — Purpose-Built Parallel SSH~12 min · pssh, pscp, fleet
   • 05
     Remote Execution & Quoting~12 min · remote-exec, quoting, heredoc
   • 06
     Ansible Basics~18 min · ansible, agentless, modules, inventory
   • 07
     Ansible Playbook Example~18 min · ansible, playbook, yaml, tasks
   • 08
     Dotfiles Strategy~12 min · dotfiles, deploy, version-control
   • 09
     Package Management with Brewfile~12 min · brewfile, homebrew, consistency
   • 10
     Fleet Monitoring~18 min · monitoring, morning-check, cron
   • 11
     NAS & Shared Storage~15 min · nas, nfs, smb, synology
   • 12
     10GbE Networking~18 min · 10gbe, jumbo-frames, mtu, networking-hardware
   • 13
     Thunderbolt Bridge~12 min · thunderbolt, bridge, p2p, static-ip
   • 14
     Naming & Architecture~12 min · naming, documentation, architecture-doc

   ✓Quiz · 6 questions→

8. 08🔒Security Hardening

   0/14 lessons

   Make your fleet boring to attackers

   Once your fleet is reachable, it's a target. This track is the deliberate hardening pass — keys-only auth, firewall, fail2ban, certificates, file perms, audit, incident response. Each layer is small; the layered defense is what makes a personal fleet boring to scan and impossible to brute force.

   Lesson list (14)

   • 01
     Disable Password Authentication~12 min · sshd, passwordauth, kbdinteractive, lockout
   • 02
     Key-Only Access & Restrictions~12 min · authorized_keys, key-restrictions, from, command
   • 03
     Fail2ban — Auto-Block Brute Force~15 min · fail2ban, brute-force, linux, logwatching
   • 04
     Port Changing — Noise, Not Security~10 min · sshd, non-default-port, obscurity
   • 05
     Firewall Basics~15 min · ufw, pf, firewall, default-deny
   • 06
     Two-Factor SSH (TOTP)~15 min · 2fa, totp, google-authenticator, pam
   • 07
     SSH Certificates~18 min · ssh-ca, certificates, principal, expiration
   • 08
     Auditing — Who Logged In, When~12 min · audit, last, auth.log, log-show
   • 09
     Key Rotation~15 min · rotation, expiration, ca-issued
   • 10
     Jump Hosts / Bastion~15 min · bastion, jump-host, proxyjump, audit-point
   • 11
     File Permissions~12 min · permissions, ssh-perms, silent-failure
   • 12
     SSH Hardening Checklist~18 min · sshd-config, hardening, comprehensive
   • 13
     Security Scanning — ssh-audit~10 min · ssh-audit, scanning, weak-algorithms
   • 14
     Incident Response~18 min · incident, compromise, forensics, recovery

   ✓Quiz · 6 questions→