When I SSH into it through my local network, and when I actually go and check with ssh-keygen I get 1 rsa fingerprint. And when I try to SSH in though my public IP I get a different host fingerprint shown in putty. This host fingerprint does not appear to be the fingerprint of any of the host keys (or even client keys, I checked) on my server. It is totally unknown to me.

Am I the victim of an attempted man-in-the-middle attack? And if so, is there anything I can do so that I can actually SSH into my server remotely without compromising my server's security?

  • Different host key fingerprint = different host key = you are connecting to a different server! This is how you can tell that someone has intercepted your SSH connection.
    – user253751
    Mar 2 '20 at 12:50

Welp, I'm an idiot. It turns out I forgot to change the port I was connecting to from 22 to the port I set to port forward from on my router. Strange that my router accepts its own ssh connections on port 22 though.

  • 2
    A lot of routers provide a ssh server for remote administration. If you don't need it, you should disable it, or at the very least make sure it has a strong password and doesn't use a well-known default password.
    – Najkin
    Mar 2 '20 at 9:26
  • Thanks! I didn't know this, I'll look into it :) Mar 2 '20 at 9:29
  • Although not clear, it sounds sort of like you successfully SSH'd into your router using the same password as your computer? If so, you should not be using the same password for both! Mar 2 '20 at 21:52
  • No, I never went past the warning of a different host-key fingerprint. Anyway I'm using keyfiles for my own computers, and have no idea what the SSH password for my router is, though I ought to find that out and disable SSH on the router or change it. Mar 3 '20 at 23:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.