Is SSH2 still vulnerable to man-in-middle attacks?

Question

With SSH using RSA public key authentication, can an attacker spoof the server IP address and connect with client to obtain client password?

Answer 1

If the client knows the fingerprint of the server they are connecting to or knows that the certificate should be signed by a trusted CA, then I am not aware of either SSH or SSH2 is vulnerable to a man in the middle where the client thinks they are connecting to an incorrect server after previously connecting. What is possible on SSH1 is for a server to masquerade as a user that has connected to them when accessing another server.

Answer 2

There's always going to be a chicken-and-egg problem -- how do you trust the ssh key of the server you're connecting to if you've never connected to it before. Some sites publish lists of all their SSH keys, some go further and PGP-sign these lists, but it all ultimately comes back to the age-old problem of distributing trust.

The latest and most promising approach is to publish SSH fingerprints for the servers in the DNS records that are then signed using DNSSec. E.g.:

$ dig +short -t sshfp fedorapeople.org
2 1 9EB13E6BEE80F5D56B4E9A029DC53CF00EF14045
1 1 5829B0460C2E9296BDBD835416C2615DCF80D22A

You can then add the following to your ~/.ssh/config

VerifyHostKeyDNS yes

You have to also configure DNSSec on your resolver for it to make any difference.