Make sure you pay attention to the warnings about changes to the server's public key. If you get a warning like this, say "no" and check the public key fingerprint through out-of-band means; don't say "yes" unless you have verified the public key fingerprint somehow.
If you never connect to new hosts, you can set
StrictHostKeyChecking yes
in your ~/.ssh/config configuration file (or in /etc/ssh/ssh_config). However this may be annoying if you frequently connect to new machines.
Read the section VERIFYING HOST KEYS of the ssh man page.
Read How do RSA fingerprints protect from MITM attacks? on this site.
Use a SSH private key, not a password, to authenticate.
If you are in control of your own infrastructure, setupyou can look into setting up ssh certificates for both hosts and users. This can allowallows the ssh client to verify the identity of the ssh server. This may be the best solution against man-in-the-middle attacks, as it eliminates the need for users to check fingerprints carefully. Realistically, many users probably won't bother to check, so ssh certificates may be a more usable and more reliable defense.
