3

If a user connects to an SSH server using an rsa private key, but does not confirm the server's fingerprint. What kind of information can a man in the middle attack get from the session?

2 Answers 2

3

If they want the connection to go through all the way to the legitimate server: absolutely nothing. (Well, nothing a passive observer can't learn.) The endpoints establish a shared secret via DH, which is part of the data signed with the public key. (Source.) Consequently, if the attacker subverts (MITMs) the DH key agreement, the authentication will fail. If they don't subvert the DH key agreement, then they can't read the traffic being passed.

Now, if you don't verify the RSA key, I can still allow your authentication as a MITM, and provide an interface where I pretend you're interacting with the remote server. For example, if you're performing an SCP, I can still steal a copy of the file you're transferring. I can log you in to a shell where I ask "you must change your password" and ask for old/new passwords, and use it to phish SSH.

3

Good answer from David. Beware though of agent forwarding (with the -A flag on the command line, or the ForwardAgent option in a configuration file). If you have it enabled (it is not by default) and you connect to a hostile server (because you didn’t check the fingerprint), you’re screwed.

This will not leak your private key, but will allow the attacker to use it at will:

An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.

(From man ssh_config)

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .