Timeline for How to correctly secure a ssh session against MITM attack?
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 23, 2016 at 14:28 | comment | added | Paŭlo Ebermann | @Gilles did you read the link posted by Charles? It looks like public-key authentication actually protects against a MitM attack by including the session-identifier in the signature, which is different between client–MitM and MitM–server. (Though it does not protect against an attacker just pretending to be the real server). | |
| Jan 22, 2015 at 20:35 | comment | added | Gilles 'SO- stop being evil' |
@LonnieBest Yes if the client doesn't already know the server's key, no if the client already does. This holds whether the client authenticates with a key or with a password or any other method. If the MITM happens and is not detected, then with a password, the attacker can initiate new connections to the server, which I think can't happen with the key. However the MITM can also infect the server with malware (e.g. add a key to the authorized_keys file), which is more detectable than grabbing the password but bad anyway.
|
|
| Jan 22, 2015 at 20:24 | comment | added | Lonnie Best | @Gilles : If you are connecting via ssh, using a key (not typing in username and password), can a MITM acquire what is necessary to become an invisible intermediary between you and a ssh server? | |
| Nov 5, 2012 at 13:01 | comment | added | Gilles 'SO- stop being evil' | No, the choice of user authentication methods is not important. It is both necessary and sufficient for the client to authenticate the server. Turing off password authentication can be a good idea but the threat is not a MITM against the SSH connection but a leak of the password through another channel (shoulder surfing, use of the password in an insecure protocol, …). | |
| Nov 5, 2012 at 6:10 | review | First posts | |||
| Nov 5, 2012 at 7:43 | |||||
| Nov 5, 2012 at 5:50 | history | answered | Charles Boyd | CC BY-SA 3.0 |