1

I've been SSHing into my VPS for months with no problems and this morning it returned this familiar message:

The authenticity of host '[hostname]' can't be established.
ECDSA key fingerprint is 05:39:ac:73:c3:ba:f4:16:57:74:66:c0:a1:81:6a:fa.
Are you sure you want to continue connecting (yes/no)? ^C

I have not reinstalled or in any way changed my server's key. Is there a way to check whether I'm connecting to the real server or a spoofed one? If I do accept this new fingerprint, and connect to the server, what are the potential risks? How would I quickly find out whether there is a man in the middle of our communication?

Improve this question
3
  • Has the hostname changed? Have you started connecting via IP instead of hostname or vice versa? Does your VPS host admin have access to change the key or is it your key? Could your local cache of known keys be corrupted or missing? – Ben Jan 8 '14 at 16:52
  • @Ben I connect via the IP address and a custom port, both of which have not changed. The host admin probably has access to the VPS as an instance but not the OS on it. I filed a ticket with them and they said there was nothing they could do and recommended a reinstall of the OS. My local cache seems to be fine. The entry in ~/.ssh/known_hosts has not been changed from the times I logged in before. – mart1n Jan 8 '14 at 17:03
  • If you can get the host key somehow (perhaps through your service provider), you can check its fingerprint with ssh-keygen -lf /path/to/host_public_key – Johnny Jan 8 '14 at 22:52
2

I have not reinstalled or in any way changed my server's key. Is there a way to check whether I'm connecting to the real server or a spoofed one?

If the key and hostname on/of the server hasn't changed, then you are connecting to the wrong server. If you need to check whether the key really did change, you need a different mechanism to access the server, perhaps someone with local physical access to read the fingerprint to you. If they have physical access, they can typically get on the OS. Some hypervisors even just have root run a command and give you a root shell on the OS.

If I do accept this new fingerprint, and connect to the server, what are the potential risks?

You risk giving your authentication credentials to someone else's server, thereby allowing someone else to access your server as you. You also enable this "someone else" to MitM your connection to your server, and monitor what you do from now on.

How would I quickly find out whether there is a man in the middle of our communication?

Assume there is once you see the "key does not match" message. Only once you've proven that the key really has changed on your system (as described above in this answer) should you assume that there's no MitM or DNS error, or other problem in the communication path.

Improve this answer
6
  • Nice answers, thank you. Though, getting physical access to the VPS is close to impossible since it's just an OpenVZ template running somewhere in a rack in Netherlands. Does an update of the openssh package recreate the key or is there any action that I might have performed last time on the server, which resulted in a key change? – mart1n Jan 8 '14 at 22:42
  • Also, just to clarify, I don't actually know whether the key on the server has changed or not because I can't think of a secure side channel to use to log in and verify it. – mart1n Jan 8 '14 at 22:53
  • @mart1n, i am not familiar enough with the finer details of OpenSSH to know exactly what operations change the key, though I would not expect a package update to change such data. – atk Jan 8 '14 at 23:25
  • Regarding physical access, you might be able to get the hosting provider to access the system, or you might look into what remote management options they offer. – atk Jan 8 '14 at 23:26
  • Yep, that seems to be my only option. Thanks for your help! – mart1n Jan 8 '14 at 23:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.