I got the following error connecting to my server via ssh:
The authenticity of host '[ip address]:port ([ip address]:port)' can't be established.
ECDSA key fingerprint is SHA256:[thefingerprintwhichichanged].
I connected anyway and am reasonably confident I know the reason for the changed fingerprint.
But suppose I was being MitM'd...
Scenario
I usually use key pair to connect to my with password login disabled. I connected via SSH, fingerprint did not match but I used the previously used key pair to connect. While connected over SSH I logged into database and changed some entries. I then logged out.
Questions
- How would that attack work and what could the attacker learn or do?
- Can he read data sent to server, can he read data sent by server?
- Can he change any data?
- Can he perform commands on server that I did not?
- Can he ever login again?
- Can he ever redo the actions I performed while I was being MitM'd?