I know this question was asked several times in several ways, for example:
However, none provided the answer I was hoping to find (I think...).
I'm working with a specific cloud provider where I generate a private/public key for SSH authentication . I upload the public key to the cloud instances store the private key on the client side. When I want to SSH to the cloud instances, I use the private key to open the SSH connection. By doing so, the server authenticates the client.
What prevents from a MITM attacker, that knows the public key to hijack my connection and spoof the server? All he needs is the public key, right?
I don't understand how the fingerprint validation helps in this case. Unless, there is another pair of public/private keys which can be used solely for the purpose of the server's authentication by the client.