3

I know this question was asked several times in several ways, for example:

Can an SSH server fingerprint be spoofed?

What stops an SSH server from MITMing logins?

However, none provided the answer I was hoping to find (I think...).

I'm working with a specific cloud provider where I generate a private/public key for SSH authentication . I upload the public key to the cloud instances store the private key on the client side. When I want to SSH to the cloud instances, I use the private key to open the SSH connection. By doing so, the server authenticates the client.

What prevents from a MITM attacker, that knows the public key to hijack my connection and spoof the server? All he needs is the public key, right?

I don't understand how the fingerprint validation helps in this case. Unless, there is another pair of public/private keys which can be used solely for the purpose of the server's authentication by the client.

Thanks

Improve this question

1 Answer 1

Reset to default
4

Short answer: No. The attacker needs the private key too.

The SSH protocol uses encryption to secure the transmission. So, it will employ a public and private key. It's possible to someone to send you a spoofed public key, but without the corresponding private key, they will not be able to decrypt the communication, the handshake will fail and your client will disconnect.

But if the attacker have both the public and private keys, they can intercept every communication between you and the server.

Improve this answer
11
  • Thank you but please note that in my case, the private key is held by the client and not the server since the client is the one that needs to be authenticated. If you'll look on how AWS and Google Cloud work; they ask you to upload only the public key to the VM instances in the cloud.
    – Lior Ohana
    Nov 11, 2015 at 14:02
  • 2
    @LiorOhana, both client and server have public and private keys. The server always has a key pair, unrelated to the key pair a client must have to perform key-based auth. The server's key pair is what drives the fingerprint which identifies the server.
    – gowenfawr
    Nov 11, 2015 at 14:15
  • @LiorOhana If you log onto your server, you can see the server keys on /etc/ssh/ssh_host_*...
    – ThoriumBR
    Nov 11, 2015 at 14:22
  • Perfect! that covers the last sentence in my question. Thank you very much.
    – Lior Ohana
    Nov 11, 2015 at 14:25
  • 1
    Yes, basically it's how it works. There are some other ways to authenticate and send the challenge, but this is what is done most of the time.
    – ThoriumBR
    Apr 14, 2022 at 0:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .