Is it possible for an SSH MITM to attack only if the key isn't in the known_hosts?
First of all, the answer depends on your SSH client. Let's assume you are using latest OpenSSH client. The SSH2 protocol starts like this:
Client -> Server: Initiate connection, send client software version + SSH version
Server -> Client: Server software version and SSH version
Client -> Server: Client supported algorhitms
Server -> Client: Server supported algorhitms
Client -> Server: Diffie-Hellmann key exchange init
Server -> Client: Diffie-Hellmann parameters and server key!
Let's say known_hosts contains the known good RSA key, but the server sent an ECDSA key. OpenSSH detects a key change!
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
78:16:03:b0:88:c3:9b:a7:7d:34:87:a5:8b:36:f1:4f.
Please contact your system administrator.
Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending RSA key in /root/.ssh/known_hosts:1
ECDSA host key for 127.0.0.1 has changed and you have requested strict checking.
Host key verification failed.
Now the question is: Is StrictHostKeyChecking
set to yes
in your SSH config?
And last but not least, if you are worried about being hacked by an SSH MiTM, I suggest you authenticate with SSH keys instead of using passwords. It is much more secure, and your password is safe (as long as you don't use the password for sudo
:) or something else).