UPDATE: The source of this problem has thankfully turned out to be a buggy mobile SSH client used on 2 different devices not a MITM attack. However, I'd still appreciate a full answer to the original question: Namely, in the event of a genuine MITM attack, what steps should an administrator take after detecting it? Does the presence of a genuine MITM attacker effectively make SSH access to that server impossible for as long as they attempt to intercept traffic? Is changing the sshd port sufficient as a response?
ORIGINAL QUESTION: I'd appreciate some advice on what steps I should take in dealing with this.
On attempting to connect to my home server today over SSH using pub key auth (password access is disabled), I received the 'fingerprint has changed' message. As I have a copy of the server's public key fingerprint on me, I can see they don't match.
Does this mean I am unable to connect to the server over SSH indefinitely without jeopardising security? Can I combat the attack in any way? While I've always been aware of the potential for SSH MITM attacks, and there is plenty of reading available on detecting such an attack, I cannot find any advice on countering / dealing with it once it's underway.
Thank you in advance.
UPDATE: The SSH host's public key and the copy I have are identical. But when connecting remotely (using either DDNS or direct IP), the 'Authenticity of host can't be established' message shows a different fingerprint to the server's. I need advice on how I connect to the server via SSH from now on in light of somebody potentially doing something nefarious. Do I simply change the SSH server port? Should I generate new keys?