I have an SSH server, where users can login to with their username and password. I want to prevent attacks that try to steal the user's passwords.
Is there a way to prevent an impersonation attack on my SSH server?
The attack scenario:
- User connects to my SSH server for the first time or from a new PC (from public/compromised network).
- An attacker in the network impersonates my SSH server.
- The attacker sends his public key instead of the real server key to the user.
- The user accepts the key, assuming it is the real key.
- The user sends the attacker his password in the authentication stage.
I know that my SSH server can use a certificate, but the attacker can still do the same attack since users don't know that they aren't supposed to get a key and they are used to accept the key in the first connection.
So I'm wondering what method to use to prevent the attack.