I'm curious about the security of RSA signing with the same public private key pair when the same message is sent multiple times. It's my understanding that once you generate the hash of the message you wish to send, that you then sign this message with your RSA private key, then transfer both this signed hash and the original message. The receiver then uses the original message to generate their own hash and compare against the result of decrypting the signed hash with the server's public key. Now that you know my understanding of the process on to the question.
Scenario: A client connects to a server and retrieves a command as well as a signed hash of this command. The server's public key is hard coded into the client. Only this server should be able to issue commands, commands will be reused
1) Is it possible for an attacker to simply log the hash of a command and then replay this hash on a server of their own thus defeating signing?
2) Assuming question one is correct how can this be prevented, I can't see a random index, being added on the end of the command, working because the server must send the original message thus exposing the "secret index" that was intended to change the hash each time.
I understand how RSA is secure when data is only sent once, but when it's sent multiple times how is it/can it be made secure? I'm looking for a possible solution. Thanks for reading.