Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite
1

How do you improve the security of your ssh session against a man-in-the-middle attack?

share|improve this question
2  
This question is pretty vague and open-ended. Are you asking specifically about MITM attacks or about good security practices more generally? Have you glanced through questions with the ssl tag to see if there's anything that matches what you are looking for? – D.W. Nov 5 '12 at 6:27
I am specifically asking about MITM attacks and the best way to remove/minimised the threat – Paperghost Nov 5 '12 at 6:58

2 Answers

up vote 3 down vote accepted

Make sure you pay attention to the warnings about changes to the server's public key. If you get a warning like this, say "no" and check the public key fingerprint through out-of-band means; don't say "yes" unless you have verified the public key fingerprint somehow.

If you never connect to new hosts, you can set

StrictHostKeyChecking yes

in your ~/.ssh/config configuration file (or in /etc/ssh/ssh_config). However this may be annoying if you frequently connect to new machines.

Read the section VERIFYING HOST KEYS of the ssh man page.

Read How do RSA fingerprints protect from MITM attacks? on this site.

Use a SSH private key, not a password, to authenticate.

share|improve this answer
up vote 2 down vote

Always authenticate with public keys (better yet, turn off password authentication entirely in /etc/ssh/sshd_config), this should thwart any MITM attack against OpenSSH.

Here is a short explanation that goes into more detail: http://www.gremwell.com/ssh-mitm-public-key-authentication

share|improve this answer
No, the choice of user authentication methods is not important. It is both necessary and sufficient for the client to authenticate the server. Turing off password authentication can be a good idea but the threat is not a MITM against the SSH connection but a leak of the password through another channel (shoulder surfing, use of the password in an insecure protocol, …). – Gilles Nov 5 '12 at 13:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.