> [the attacker] cannot pretend to be the client to the server Isn't the most common way of identifying ssh clients still just public key authorization? Meanin

> [the attacker] cannot pretend to be the client to the server Isn't the most common way of identifying ssh clients still just public key authorization? Meaning the attacker can MITM the real client connecting to the server, satisfy the real client's request, and then likely carry on doing whatever it likes. edit: actually no - I can see where my intuition is wrong (out of date from the time of widespread password auth). If the ssh server only accepts input that's been effectively signed by the authentication key, then there's no way for the MITM to send its own requests. Yet another reason to not use password auth.