How to detect if a connection is intercepted with SSH-MITM?

[manfred-kaiser]

Question:

How can I detect if my SSH connection is being intercepted by a Man-in-the-Middle attack using SSH?

Answer:

To detect a potential SSH MITM attack, you can use a master channel in combination with a secondary connection through the same socket. Here's how to set it up and what to look for:

1. Establish a Master Session:

Open an SSH master session by running the following command:

ssh -M -S /tmp/ssh_socket user@host

The -M flag initiates the master mode for connection sharing, and -S specifies the path for the control socket.

2. Connect a Second Time Using the Same Socket:

While the master session is active, open a second SSH session using the control socket:

ssh -S /tmp/ssh_socket user@host

This connection will attempt to reuse the existing master session's socket.

3. Monitor the Behavior of the Master Session:

Pay attention to the behavior of the master session after initiating the second connection. If the master session becomes non-responsive or terminates unexpectedly, this could indicate that the connection is being intercepted by a MITM attack.

This method relies on observing disruptions in the master session, which are indicative of potential MITM activities. It's important to test this in a safe environment to avoid misinterpreting normal connection issues as security breaches.