IP spoofing is the creation of IP packets using someone else's IP address. DNS spoofing is the substitution of a different IP address for a DNS name. DNS spoofing is commonly achieved by corrupting the DNS database of the DNS server your computer connects to in order to match human readable computer names to physical IP addresses. In both instances, the computer you are connecting to is not the server you expect. This can be used, for example, to trick you into giving your server user name and password to the computer acting as the impostor. Alternatively, the impostor might simply act as a conduit whilst talking to the real server on your behalf. This is called a "Man-in-the-middle attack" and is commonly used to intercept network traffic without the knowledge of the original participants. SecEx protects against IP and DNS spoofing by recording each server's public host key. During subsequent connection attempts, the known host key is compared to the host key offered by the server. While an impostor might well offer the same public host key as the server whose identity it is trying to assume, it will fail the subsequent authentication challenge without the corresponding private key owned by the real server. 
When connecting to a server for the first time, there is no reasonable and universal method of ensuring the key's authenticity. They key is therefore accepted by default. If you have any reason to believe that the server you are connecting to has been compromised, you should contact the server's administrator and personally verify the host key fingerprint. The host key fingerprint appears in the log window in verbose mode when logging on to the server. 
|