1

I've installed some new networking equipment: firewall, switches, vlans, etc. I won't mention the brand name here, because I don't want to cause them harm by my suspicions.

Right after doing this, I was able to RDP to a server inside my LAN without being prompted for a finger print change.

One day later, however, as I try to connect to that same server, it is now prompting me to accept a new certificate because the fingerprint has changed.

I have a suspicion that the new networking equipment is trying to gather the credentials of my servers by intercepting my RDP sessions in a manner that would be otherwise transparent except for the fact that I'm being prompt to accept a changed certificate.

How can I confirm that this finger print change's source is something that has occurred on the server I'm connecting to, and not due to the new networking equipment trying to do a man in the middle attack to catalog credentials on my network (that it should not be curious about)?

1

This can be narrowed down to a single device by first investigating the certificate on the server itself (access the console and RDP localhost to get the current certificate). Then, with a client computer, move farther away one network device at a time.

Once you've found the culprit, investigate the configuration: it could be a legitimate feature you have turned on by accident.

  • 2
    Or the server had a self-issued certificate which expired after 365 days, and the server generated a new one. (If OP's servers had CA-issued certificates, there would have been no "fingerprint prompt".) – grawity Apr 1 at 10:29
  • True. This answer is more about methods for finding the reason, not guessing what it could be. :) – Esa Jokinen Apr 1 at 10:37
  • 1
    Some steps about finding the cert would have been nice in this answer, but I did find the cert and the new finger print did indeed match what was on the server. So no man in the middle here. Thank you. – Lonnie Best Apr 1 at 11:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.