Because you're telling it the connection is secure
When you connect to an SSH server for the first time, you get this message:
The authenticity of host '<host> (<IP Address>)' can't be established.
<algorithm> key fingerprint is <hash>.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])?
When you type yes
, you're told: Warning: Permanently added '<host>' (<algorithm>) to the list of known hosts.
Here, you've marked this connection as secure, and that you trust that you're connecting to the actual machine. When you reconnect, if the server presents the same key, no warnings are shown. If you were to connect to a MITM server the first time, you would get this same message—there's no magic way for your computer to detect if any given SSH server is who you think it is or not. If you didn't spend the time to manually check the machine's fingerprint on a separate channel, you would blindly trust it and be none the wiser.
However, if you were to reconnect to a server and someone intercepted your connection, you would get this:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the <algorithm> key sent by the remote host is
<hash>.
Please contact your system administrator.
Add correct host key in /home/<username>/.ssh/known_hosts to get rid of this message.
Offending RSA key in /home/<username>/.ssh/known_hosts:<line number>
Host key for <host> has changed and you have requested strict checking.
Host key verification failed.
Here, you can see quite explicitly that it's warning you about this exact attack—it explicitly says "man-in-the-middle attack" on the 3rd text line, and doesn't allow you to connect.
The big picture is that encrypted communications don't matter if you never verify that the person you're talking with is who you think they are. SSH even makes you explicitly tell it that you are sure. To verify it, you should run ssh-keyscan <host>
on a trusted computer—for example, one plugged directly into it, or even better, ssh-keyscan localhost
on the target machine itself. Then, either type fingerprint
at the prompt and paste in its output, or verify it manually and only then type yes
.