I'm running a rails application on an ubuntu server on slicehost. I got a pingdom alert that the server was unreachable, so I tried to load the website in my browser. It showed a Passenger error, saying that rails could not authenticate a connection to mysql using username:password. (Sorry this is a little vague; I did not save the error message before reloading the page later.)
At this point I tried to SSH in, but was confronted with an error about how my host key had changed, and this might be a man-in-the-middle attack. I did not attempt to log in by clearing that host's entry in the known hosts file.
I hesitated for a few minutes, but then got another pingdom alert saying my server was up. I was able to load it in the browser.
When I tried to SSH in again, I succeeded without any warning.
Total downtime was about 20 minutes. I checked the logs for rails, apache, mysql, and syslog. Aside from a 20 minute gap in the apache and rails logs, there was nothing interesting. (Several network access attempts blocked by iptables, but no more than usual.) No access to the root directory since 2009 (I use another user with sudo access).
I'm confused about how the first ssh attempt would fail with the wrong host key, but the second one would succeed. Does that make sense?
Does that sound like a successful/attempted attack? I don't know what either of those signs would point to.
I'd appreciate it if anybody could tell me what else I might want to check.