Return to Answer

install ssh-mitm on linux:

Start ssh-mitm and redirect session to a honeypot if publickey authentication failed:

ssh-mitm --remote-host target:22 --fallback-host user:password@honeypot:22

If the user is allowed to login with publickey authentication, but no agent was forwarded, ssh-mitm redirects to the honeypot.

Install SSH-MITM on linux:

Start SSH-MITM and redirect session to a honeypot if publickey authentication failed:

ssh-mitm server --remote-host target --remote-port 22 --fallback-host honeypot --fallback-username honeypotuser --fallback-password honeypotpasswd 

If the user is allowed to login with publickey authentication, but no agent was forwarded, SSH-MITM redirects to the honeypot.

Conclusion:

Disclosure: I have developed SSH-MITM, which is a mitm server for SSH connections. This server is used to verify if the described mitigation strategies can reduce the risk of mitm attacks on ssh. I have also written the patch for PuTTY to mitigate trivial authentications without the trust sigils.

Proof of Concept MitM Attack

If you want to test your configuration, you can use SSH-MITM, which is an audit server for ssh connections.

install ssh-mitm on linux:

python3 -m venv ~/sshenv
source ~/sshenv/bin/activate
pip install ssh-mitm

Start ssh-mitm and redirect session to a honeypot if publickey authentication failed:

ssh-mitm --remote-host target:22 --fallback-host user:password@honeypot:22

This configuration checks, if the user is allowed to login with publickey authentication. If the user is not allowed, password authentication is used.

If the user is allowed to login with publickey authentication, but no agent was forwarded, ssh-mitm redirects to the honeypot.

Conclusion:

Disclosure: I the author of SSH-MITM, which is a mitm server for SSH connections. This server is used to verify if the described mitigation strategies can reduce the risk of mitm attacks on ssh. I have also written the patch for PuTTY to mitigate trivial authentications without the trust sigils.

When using Linux you should use PuTTY>0.71 in combination with the OpenSSH agent, because PuTTY is able to detect spoofing attacks. When using a vesion <0.76 you have to use the trust sigils. Since 0.76 PuTTY is able to close the session if a spoofing attack is detected.

When using PuTTY>=0.76, you must use Disable "trivial" authentication (SSH-2 only. This option can be found under "Connection -> SSH -> Auth".

When using Linux you should use PuTTY>0.71 in combination with the OpenSSH agent. Since version 0.71 PuTTY is able to detect spoofing attacks.

When using a vesion <0.76 you can detect spoofing attacks with the trust sigils. Since 0.76 PuTTY has a new option to close the session if a spoofing attack was detected.

When using PuTTY>=0.76, you should use Disable "trivial" authentication (SSH-2 only). This option can be found under "Connection -> SSH -> Auth".