What is "gethostby*.getanswer: asked for.."

cnmoore · 04-24-2011, 10:58 AM

These showed up in my logwatch today. Never saw them before and haven't a clue what they are. No idea what ip130.208-100-19.vswitch.static.steadfast.net is or what gethostby is.

Under SSHD

Code:

 **Unmatched Entries**
 gethostby*.getanswer: asked for "ip130.208-100-19.vswitch.static.steadfast.net  IN A", got type "39" : 6 time(s)
 Address 85.17.189.146 maps to hosted-by.leaseweb.com , but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! : 2 time(s)
 gethostby*.getanswer: asked for "ip130.208-100-19.vswitch.static.steadfast.net  IN AAAA", got type "39" : 4 time(s)

What's happening here? And what is type "39"? (I trust that it means "Error! go away!")

And where can I read up on this? Thanks -

Tinkster · 04-25-2011, 05:41 PM

What it boils down to is that the guys at static.steadfast.net/leaseweb.com seem to be
using a not yet wholly codified DNS mechanism, one that's not fully satisfying clarity;
the way I see it DNAMEs are bad; others will debate that in favour of the few benefits
they provide.

Form your own opinion, read:
http://en.wikipedia.org/wiki/List_of_DNS_record_types
and
http://tools.ietf.org/html/rfc2672
http://tools.ietf.org/html/rfc4592#page-16

Cheers,
Tink

cnmoore · 04-25-2011, 06:17 PM

Quote:

Originally Posted by Tinkster

What it boils down to is that the guys at static.steadfast.net/leaseweb.com seem to be
using a not yet wholly codified DNS mechanism, one that's not fully satisfying clarity;
the way I see it DNAMEs are bad; others will debate that in favour of the few benefits
they provide.

Form your own opinion, read:
http://en.wikipedia.org/wiki/List_of_DNS_record_types
and
http://tools.ietf.org/html/rfc2672
http://tools.ietf.org/html/rfc4592#page-16

Cheers,
Tink

Thanks, Tink.
But my newbie question is: what was the site trying to do? Why is this under SSHD? Were they trying to log in via SSH? (which would have been rejected) And what is code "39"? Is there a place that lists the codes?

Tinkster · 04-25-2011, 09:26 PM

39 is explained in the first link I posted.

Why those people are trying to connect to your server I cannot answer. Is
there anything ELSE in sshd log that pertains to those IPs?

Or are you trying to ssh to them?

cnmoore · 04-25-2011, 10:00 PM

Quote:

Originally Posted by Tinkster

39 is explained in the first link I posted.

Aha! I see now. Those are DNS codes.

Quote:

Why those people are trying to connect to your server I cannot answer. Is
there anything ELSE in sshd log that pertains to those IPs?

Yes:

Code:

--------------------- SSHD Begin ------------------------

 Failed logins from:
   85.17.189.146 (hosted-by.leaseweb.com ): 2 times
      root/password: 2 times
   208.100.19.130 (ip130.208-100-19.vswitch.static.steadfast.net ): 2 times
      root/password: 2 times

So SSHD does a DNS lookup on every failed login? And gethostby() is the function it calls to do that?
(Extensive search for gethostby yielded a lot of hits but no enlightenment).

Tinkster · 04-26-2011, 12:02 AM

Yup & yup ... unless DNS causes too much traffic, and you tell sshd not to by
disabling that feature by editing sshd_config, and setting UseDNS no.

Cheers,
Tink

cnmoore · 04-26-2011, 01:01 AM

Thanks so much for your help to my understanding. I love this forum.
Cheers,
Coly