I have a little $7.20/y VPS, and the fingerprint for the ECDSA key has changed three times on me. This time, it happened shortly after I reinstalled the server (same day, in fact.) I always disable password login, and make sure you can't log in with passwords. After a while, I tried logging into my server, and I got the standard error telling me about the attack. I went ahead and disabled it, and was told that the host key for the domain I was logging into was different to the one for the IP. This nearly solidifies the idea of the attack by itself, but then I was prompted for a password. What tips do you have on stopping this? I always keep UFW enabled, and only allow SSH, and public/private key authentication is the only way to get into the server (without finding an exploit, ofc.)

  • 7
    Have you asked your hosting company? Maybe they shuffled your instance around and it broke the fingerprint. – schroeder Feb 5 '16 at 16:11
  • 4
    Reinstalling the server likely creates a new host key, so it should have changed immediately after reinstallation. – Michael Karcher Feb 5 '16 at 18:02
  • 2
    The host key is generated upon installation of openssh-server. If you reinstalled the server, the host key will change unless you manually restore the one you had previously. With that in mind, nothing in your post sounds particularly unusual. – tlng05 Feb 5 '16 at 19:27
  • Exactly what @tlng05 said. – cremefraiche Feb 8 '16 at 5:58
  • 1
    The IP address might have changed? – Wadih M. Mar 7 '16 at 7:37

When a change in the fingerprint of the key is detected, it can mean a few things:

  • the key on the server genuinely changed - this is normal after an OS reinstallation and can happen after the sshd reinstallation
  • someone is posing as your server, trying a MitM attack. This is possible only with password-based authentication.

Your comment about a password-based authentication suddenly appearing out of the blue would hint about the second case.

As a side note, there is no added value for someone who already hacked into your server to change the ssh key as it will raise an alert.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.