There are some man in the middle tools for ssh, which can be used to intercept ssh sessions:
The OpenSSH fork has some problems with publickey authentication accoring to an issue ticket.
Reading the documentation of the SSH-MITM project (https://docs.ssh-mitm.at/quickstart.html) the author wrote it's possible to detect if a user wants to use publickey authentication or password authentication:
SSH-MITM is able to verify, if a user is able to login with publickey authentication on the remote server. If publickey authentication is not possible, SSH-MITM falls back to password authentication. This step does not require a forwarded agent.
For a full login on the remote server agent forwarding is still required. When no agent was forwarded, SSH-MITM can redirect the connection to a honeypot.
There is an attack explained, which is called trivial authentication. It seems this attack is related to the authentication part. In chapter about the trivial authentication attack, I found a paragraph with some relevant information:
As described in the Man in the Middle attack on public key authentication chapter, it is necessary to check all public keys against the actual target server. This is necessary to find out which key would have been used for the login.
Why are the public keys checked against the target server? Is this an error in the documentation? In my understanding, the private key is necessary to login to the server and not the publickey. Knowing the publickey does not grant access to a server.
It's also explained it should be possible to find more valuable targets:
Once the key is known, potentially better targets can be searched for.
So I have some questions:
- How is it possible to know if a user is allowed to login on a remote server with publickey authentication?
- How to get the authentication method, which will be used by the intercepted user?
- Is it really possible to find more valuable targets during a man in the middle attack and how does this attack work?