2

Imagine a scenario(don't know if it's possible):

Before I connect to my newly-bought VPS for the first time, somebody has been spying on my network connection and trying to employ MITM attack when I try to ssh a server. For the first time of ssh connection, given the server ssh public key fingerprint, how do I know it's the real server I want to connect to? How do you guys ensure this? (Everytime I connect to a new VPS, I type yes.)

3

Connect to the server using the administration console from the control panel of the provider, generate the server SSH keys, save the fingerprint. When you connect to it by SSH later, compare the fingerprint with the one you saved before.

But the chances of someone spying on you specifically to intercept and change the fingerprint of your recently commissioned are pretty small.

  • Ok I got it. Btw, I see a video mention using ssh-keyscan, does it have anything to do with this scenario I describe? – Rick Jun 26 at 2:50
  • You could use ssh-keyscan to get the server fingerprint from a couple of places. Unless the attacker intercepted every connection, you would detect the fingerprint differences. But even so, using the console is safer. – ThoriumBR Jun 26 at 9:19
  • But the chances of someone spying on you are pretty small. - I'd be cautious claiming that... – forest Jul 14 at 7:27
  • In 2 decades sysadmining around, from banks to universities to government servers, I'd never ever witnessed or heard of anyone who got a hijacked SSH connection. – ThoriumBR Jul 14 at 23:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.