How do you improve the security of your ssh session against a man-in-the-middle attack?
Make sure you pay attention to the warnings about changes to the server's public key. If you get a warning like this, say "no" and check the public key fingerprint through out-of-band means; don't say "yes" unless you have verified the public key fingerprint somehow.
If you never connect to new hosts, you can set
~/.ssh/config configuration file (or in
/etc/ssh/ssh_config). However this may be annoying if you frequently connect to new machines.
Read the section VERIFYING HOST KEYS of the ssh man page.
Read How do RSA fingerprints protect from MITM attacks? on this site.
Use a SSH private key, not a password, to authenticate.
Always authenticate with public keys (better yet, turn off password authentication entirely in
/etc/ssh/sshd_config), this should thwart any MITM attack against OpenSSH.
Here is a short explanation that goes into more detail: http://www.gremwell.com/ssh-mitm-public-key-authentication
In a MITM typically the attacker is pretending to be the real server. The attacker isn't going to pass along the real server's public key because it doesn't have the corresponding private key; therefore the assumption "We assume that MITM attacker has already managed to circumvent the server host key validation and tricked the peers into establishing the connection" means that the client has established an SSH connection terminated at the attacker. The attacker in turn is establishing a connection to the real server and presenting its own public key.
The session ID thing is a complete red herring because the attacker simply won't pass that along; it will establish one legitimate client connection and terminate the client's connection, and proxy input/output between the two connections.