I have a little $7.20/y VPS, and the fingerprint for the ECDSA key has changed three times on me. This time, it happened shortly after I reinstalled the server (same day, in fact.) I always disable password login, and make sure you can't log in with passwords. After a while, I tried logging into my server, and I got the standard error telling me about the attack. I went ahead and disabled it, and was told that the host key for the domain I was logging into was different to the one for the IP. This nearly solidifies the idea of the attack by itself, but then I was prompted for a password. What tips do you have on stopping this? I always keep UFW enabled, and only allow SSH, and public/private key authentication is the only way to get into the server (without finding an exploit, ofc.)
When a change in the fingerprint of the key is detected, it can mean a few things:
- the key on the server genuinely changed - this is normal after an OS reinstallation and can happen after the sshd reinstallation
- someone is posing as your server, trying a MitM attack. This is possible only with password-based authentication.
Your comment about a password-based authentication suddenly appearing out of the blue would hint about the second case.
As a side note, there is no added value for someone who already hacked into your server to change the ssh key as it will raise an alert.