I have an ssh server. earlier toady, I was about to login to my server, when I got a message that said something along the lines of "Someone may be trying to do something nasty" and indicating a man in the middle attack.

I did not proceed to login. Instead, I shifted to a different network, and logged in. From the alternate network, I did not get the message about something nasty happening.

I have seen this in the past when I do something like change the login key. All the other boxes with expired keys baulk that something nasty might be happening. Until I update the keys.

This time, I have not changed anything. later, when I went to write up this question I tried to login again from the same machine that previously gave me the warning. This time, I did not get the message. I opted to not login anyhow.

For now, I do have physical access to the PC, it is running Debian 8. I forget if I have fail2ban running, but my firewall is on, and Im not using the default ssh port, only certain users (not root) can login.

how concerned should I be? what should I do in this situation?

  • 2
    You are going to have to be more specific with the error message. A vague recollection of the problem is not going to help us be accurate with a risk assessment.
    – schroeder
    Apr 27, 2015 at 17:25
  • @schroeder I think he got the common ssh client warning on the server key change.
    – peterh
    Apr 27, 2015 at 19:32
  • @peterh I believe you might be correct, but we shoudn't have to guess.
    – schroeder
    Apr 27, 2015 at 21:01
  • @schroeder Yes, agreed.
    – peterh
    Apr 27, 2015 at 22:15
  • By "the login key," do you mean the server host key? If so, this is standard (and proper) behavior.
    – cpast
    Apr 27, 2015 at 22:38

1 Answer 1


The most common reason for this is that you are connected to an enterprise network that has active proxying, data loss prevention, filtering or similar. In order to do that for the increasing number of encrypted sessions, "clever" security devices perform a man-in-the-middle attack on your connection by replacing the normal certificate with their own. So now you have an encrypted session with the security device rather than the ultimate end point. The security device makes the onward secure connection itself.

The smarter security devices understand known secure endpoints such as banks and don't bother to intercept their traffic, treating them as trusted end points. Many of these devices perform dynamic risk calculations where you might sometimes get an intercept and sometimes not.

That would certainly cause you to get a warning from PUTTY.

The rule is, never accept a new server signature unless you are absolutely certain you caused it!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .