3

I have a little $7.20/y VPS, and the fingerprint for the ECDSA key has changed three times on me. This time, it happened shortly after I reinstalled the server (same day, in fact.) I always disable password login, and make sure you can't log in with passwords. After a while, I tried logging into my server, and I got the standard error telling me about the attack. I went ahead and disabled it, and was told that the host key for the domain I was logging into was different to the one for the IP. This nearly solidifies the idea of the attack by itself, but then I was prompted for a password. What tips do you have on stopping this? I always keep UFW enabled, and only allow SSH, and public/private key authentication is the only way to get into the server (without finding an exploit, ofc.)

5
  • 7
    Have you asked your hosting company? Maybe they shuffled your instance around and it broke the fingerprint.
    – schroeder
    Feb 5, 2016 at 16:11
  • 4
    Reinstalling the server likely creates a new host key, so it should have changed immediately after reinstallation. Feb 5, 2016 at 18:02
  • 2
    The host key is generated upon installation of openssh-server. If you reinstalled the server, the host key will change unless you manually restore the one you had previously. With that in mind, nothing in your post sounds particularly unusual.
    – tlng05
    Feb 5, 2016 at 19:27
  • Exactly what @tlng05 said. Feb 8, 2016 at 5:58
  • 1
    The IP address might have changed?
    – Wadih M.
    Mar 7, 2016 at 7:37

1 Answer 1

1

When a change in the fingerprint of the key is detected, it can mean a few things:

  • the key on the server genuinely changed - this is normal after an OS reinstallation and can happen after the sshd reinstallation
  • someone is posing as your server, trying a MitM attack. This is possible only with password-based authentication.

Your comment about a password-based authentication suddenly appearing out of the blue would hint about the second case.

As a side note, there is no added value for someone who already hacked into your server to change the ssh key as it will raise an alert.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .