Tools
A user is receiving two different Server SSH fingerprints for every login attempt in Serv-U
This article described an issue when a user is receiving two different Server SSH fingerprints for every login attempt in Serv-U
First published date
9/22/2020 11:25 PM
Last published date
9/22/2020 11:25 PM
Overview
In this issue, a user is having an issue when connecting to Serv-U Application. This User is receiving two different Server public keys or SSH fingerprints for every login attempt.
Product section
Serv-U Managed File Transfer & Serv-U FTP Server
Cause
– A form of attack that looks like a Man-In-The-Middle and intercepts the connection of the User and forges the certificate.
– A Firewall is causing the incorrect keys
– A Firewall is causing the incorrect keys
Resolution
1. Verify if there is a Firewall that doing SSH Deep inspection.
2. This behavior is a victim or form of attack that looks like a Man-In-The-Middle. Check if what (or who) intercepts the connection of the User and forges the certificate. A possible is a Network Appliance or a hacker. Coordinate this to the dedicated Security Team.