What are the possible causes of a changed ssh fingerprint?

Some context: after finding a sensitive vulnerability in a governmental system and disclosing it to them, something happened which I don't remember happening before. When connecting to the VPS I used to verify the vulnerability, my ssh client complained about the key; the fingerprint did not match the one saved. I verified the one saved was still there, and after immediately rebooting the VPS it matched again.

What are the chances this is due to malicious interference?

  • Did you save the old key before reboot ? It may have been a path problem. The keys suppose to be in .ssh/known_hosts. – Overmind Nov 28 '17 at 6:41
  • In this case I used putty on Windows, the fingerprint was saved in a registry key so that might not be applicable – J.A.K. Nov 28 '17 at 10:25

The correct assumption in this case is that you are connecting to a different server.

  • Maybe a MitM attack or
  • maybe your DNS is spoofed or
  • maybe your data center has just removed your machine for a second because they got a call from the government and you are accidentally trying to connect to their "server unreachable" catchall machine or
  • maybe your server has crashed under the sudden load and the aforementioned holds or ...

There are plenty of reasons you might be connecting to the wrong machine and you should definitely not proceed.

There are a couple of harmless reasons as well, false positives that make people sometimes connect anyway.

False positives I can think of right now:

  • The server has removed an old ciphersuite which it doesn't want to support anymore.
  • The server IP has changed and you have "CheckHostIP yes" in your config (default on many systems).
  • You have connected to the same server using a different hostname (think about something like gitlab) since the default ciphersuites have changed. (This is really obscure but I have run into it.)

Do note that as described here public key authentication prevents MitM attacks. It does of course not prevent you from simply logging into the wrong machine and then typing in your sudo password. So caution is still required.

| improve this answer | |
  • Great enumeration of the possible causes, it might very well be the hosting company redirecting to a catch-all. That would definitely be a more likely explanation than some infrastructure-level tampering by a state actor. Thanks! – J.A.K. Nov 28 '17 at 10:59

This could absolutely be caused by an on-path attacker launching a man-in-the-middle attack and attempting to impersonate your VPS's SSH server. They wouldn't have the host key, so they would just present their own, which would trigger a warning. Another common reason this error triggers is when the IP address of the server you are SSHing to has changed. The known_hosts file essentially encodes IP,SSH Host Key Fingerprint,host name. If the IP or SSH Key Fingerprint change for a hostname, you will get a warning.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.