With SSH using RSA public key authentication, can an attacker spoof the server IP address and connect with client to obtain client password?

  • 2
    Any secure connection is vulnerable to a man-in-the-middle attack. All you need to do is claim you are the other end of the connection and prove you are ( which is easy enough if the certificate is also faked ). In some cases a secured connection might be very hard and is literally not vulerable to a Man in the Middle Attack for that reason.**The word any is used to actually say that any secured connection is vulerable to this type of attack. Its all comes down to trust, and digital trust can be forged, happens all the time.** – Ramhound Jan 24 '13 at 17:52

There's always going to be a chicken-and-egg problem -- how do you trust the ssh key of the server you're connecting to if you've never connected to it before. Some sites publish lists of all their SSH keys, some go further and PGP-sign these lists, but it all ultimately comes back to the age-old problem of distributing trust.

The latest and most promising approach is to publish SSH fingerprints for the servers in the DNS records that are then signed using DNSSec. E.g.:

$ dig +short -t sshfp fedorapeople.org
2 1 9EB13E6BEE80F5D56B4E9A029DC53CF00EF14045
1 1 5829B0460C2E9296BDBD835416C2615DCF80D22A

You can then add the following to your ~/.ssh/config

VerifyHostKeyDNS yes

You have to also configure DNSSec on your resolver for it to make any difference.

  • It might be necessary for OpenSSH client itself to be linked against ldns, too. – grawity Jan 26 '13 at 14:26

If the client knows the fingerprint of the server they are connecting to or knows that the certificate should be signed by a trusted CA, then I am not aware of either SSH or SSH2 is vulnerable to a man in the middle where the client thinks they are connecting to an incorrect server after previously connecting. What is possible on SSH1 is for a server to masquerade as a user that has connected to them when accessing another server.

  • "What is possible on SSH1 is for a server to masquerade as a user that has connected to them when accessing another server." WTF. Wouldn't have expected such a mistake from such a big protocol. – CodesInChaos Jan 24 '13 at 16:00
  • 4
    Yeah, don't use SSH1. This vulnerability has been known for over 10 years -- kb.cert.org/vuls/id/684820 . Most modern systems require SSH2. – mricon Jan 24 '13 at 16:44
  • @CodesInChaos - yeah, I was surprised too. I didn't know about that until I was doing some quick research about this question. Apparently the protocol started out as just wanting to conceal what was being exchanged on the network and didn't actual worry about mutual authentication that much. – AJ Henderson Jan 24 '13 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.