3 ms·
> But the key you are talking about the SSH client recognising is the server key right? Correct > which is why I said that if someone who is able to redirect
by dependenttypes 7y ago
> But the key you are talking about the SSH client recognising is the server key right?
Correct
> which is why I said that if someone who is able to redirect your SSH connection to a different server
I will try to be more clear. Often when I am away I use ssh to connect to my desktop pc which has a dynamic IP address. Even though I have already stored the public key of my server in known_hosts it keeps asking me to verify if I trust its public key every time that it changes IP address without even mentioning that it has met said public key before. So if I am not careful enough I might end up accepting the public key regardless, even if I am being MITMed.
- pingyong 7y agoThis misunderstanding could have been avoided by formulating your initial statement like this: >openssh makes the situation worse because +even+ if the key is already in your host file and it's just the ip/domain that changed it will not tell you that it recognises the key.
- rekoil 7y agoAh, yes, I've always found that to be a little strange. It is cryptographically possible for the server to establish to the client that it is who it says it is, just on a different IP Sorry for the confusion, I misread your initial comment, thought you were saying it does what we're saying would be a good behaviour, and was confused as to why you thought this was a problem, but it was just I who was confused!