4 ms·

The first time you connect to an SSH server, your client will display that server's key, and prompt for instructions. Notably, SSH will not automatically conne

The first time you connect to an SSH server, your client will display that server's key, and prompt for instructions. Notably, SSH will not automatically connect. It asks first. That's why it's useful. Additionally, SSH is such a niche tool that its users can be expected to be security-minded -- for example, by checking that the fingerprint matches the expected string instead of just clicking through. If browsers automatically trusted a page the first time they hit, attackers can just redirect the user to http://paypa1.com/ http://paypa1.com/ and feed them a fancy, green-url certificate.

Udo 16y ago
Replicating SSH's UI is not the point here. > Notably, SSH will not automatically connect. It asks first. That's why it's useful. How many sysadmins really do check their newly installed server's fingerprint? They just type "yes" on first connect and grab the server's certificate. I believe very few people actually do manual loopups when SSH pops the first-connection warning. Most hosting providers will send you cleartext passwords for your server by email. When you log onto that server for the first time, there is no easy way to tell if you're the victim of an elaborate MITM attack. So that's happening right now. > If browsers automatically trusted a page the first time they hit, attackers can just redirect the user to http://paypa1.com/ http://paypa1.com/ and feed them a fancy, green-url certificate. Indeed they can. Nobody's suggesting otherwise. By the way, I can do that today, by registering a cert for paypa1.com, just to see how many people actually take a second look at the content of the certificate.
- tptacek 16y ago
  You really need to start looking more carefully at those SSH messages. In particular, the fact that you get an SSH warning when a site's key suddenly changes is 99% of the security value of SSH. It was an old Usenix conference trick --- I think it's Dug Song's, but I'm not really sure --- to snarf people's SSH logins by capitalizing on their lack of interest in those messages. It's a trivial attack.
  - Udo 16y ago
    I wasn't talking about ignoring any SSH warnings that occur when a site's key suddenly changes. Really, look at my comments, that's not at all what I said, is it? You are misrepresenting my position and then attacking me for it.
    - burgerbrain 16y ago
      There is not a difference between your fingerprint changing, and you not having existing knowledge to compare it to. Your action in either case should be the same.
      - Steuard 16y ago
        I disagree. If I get a warning out of the blue, yeah, I take it seriously: something unexpected is going on, and I'm not going to trust the server until I know what it is. But if I know there's going to be a server upgrade overnight and I get an SSH warning in the morning, I figure odds are good that it's because of the new server rather than a coincidentally timed MITM attack. That's not perfect security, certainly, but as long as MITM attacks are rare it doesn't cost you that much of SSH's value. (All bets are off if someone is targeting your organization specifically, of course: they'd presumably have heard about the server changes in advance and take that opportunity to attack. If I considered that a serious concern in my circumstances then I'd ramp up my security level across the board.)
- justincormack 16y ago
  I have had security conscious hosting providers who have done a proper fingerprint validation over the phone half each way for ssh fingerprints. Its rare though. Sign of a good provider...
cabacon 16y ago
However, see-also DNSSEC and http://benctechnicalblog.blogspot.com/2011/03/sshfp-dns.html http://benctechnicalblog.blogspot.com/2011/03/sshfp-dns.html Though I guess DNSSEC puts you back at PKI ...

Udo 16y ago

Replicating SSH's UI is not the point here. > Notably, SSH will not automatically connect. It asks first. That's why it's useful. How many sysadmins really do check their newly installed server's fingerprint? They just type "yes" on first connect and grab the server's certificate. I believe very few people actually do manual loopups when SSH pops the first-connection warning. Most hosting providers will send you cleartext passwords for your server by email. When you log onto that server for the first time, there is no easy way to tell if you're the victim of an elaborate MITM attack. So that's happening right now. > If browsers automatically trusted a page the first time they hit, attackers can just redirect the user to http://paypa1.com/ http://paypa1.com/ and feed them a fancy, green-url certificate. Indeed they can. Nobody's suggesting otherwise. By the way, I can do that today, by registering a cert for paypa1.com, just to see how many people actually take a second look at the content of the certificate.

tptacek 16y ago
You really need to start looking more carefully at those SSH messages. In particular, the fact that you get an SSH warning when a site's key suddenly changes is 99% of the security value of SSH. It was an old Usenix conference trick --- I think it's Dug Song's, but I'm not really sure --- to snarf people's SSH logins by capitalizing on their lack of interest in those messages. It's a trivial attack.
- Udo 16y ago
  I wasn't talking about ignoring any SSH warnings that occur when a site's key suddenly changes. Really, look at my comments, that's not at all what I said, is it? You are misrepresenting my position and then attacking me for it.
  - burgerbrain 16y ago
    There is not a difference between your fingerprint changing, and you not having existing knowledge to compare it to. Your action in either case should be the same.
    - Steuard 16y ago
      I disagree. If I get a warning out of the blue, yeah, I take it seriously: something unexpected is going on, and I'm not going to trust the server until I know what it is. But if I know there's going to be a server upgrade overnight and I get an SSH warning in the morning, I figure odds are good that it's because of the new server rather than a coincidentally timed MITM attack. That's not perfect security, certainly, but as long as MITM attacks are rare it doesn't cost you that much of SSH's value. (All bets are off if someone is targeting your organization specifically, of course: they'd presumably have heard about the server changes in advance and take that opportunity to attack. If I considered that a serious concern in my circumstances then I'd ramp up my security level across the board.)
justincormack 16y ago
I have had security conscious hosting providers who have done a proper fingerprint validation over the phone half each way for ssh fingerprints. Its rare though. Sign of a good provider...

cabacon 16y ago

However, see-also DNSSEC and http://benctechnicalblog.blogspot.com/2011/03/sshfp-dns.html http://benctechnicalblog.blogspot.com/2011/03/sshfp-dns.html Though I guess DNSSEC puts you back at PKI ...