LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 02-28-2012, 03:40 PM   #1
z01krh
Member
 
Registered: May 2009
Posts: 34

Rep: Reputation: 0
ssh warning POSSIBLE BREAK-IN ATTEMPT


When I ssh to my secondary(aka mirror) server I get the following message.

Address 192.168.1.2 maps to mydomain.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!

SSH works but just wondering what that error means. Also there is a big delay in the respone from ssh to log in.

Anyone have any ideas on this?
I have tried google for hours but get a bunch of sites for hacking and no explanation.
 
Old 02-28-2012, 03:57 PM   #2
droyden
Member
 
Registered: Feb 2007
Location: UK
Posts: 150

Rep: Reputation: 19
Nothing to be worried about ssh is just saying that the IP resolves to the hostname but the.hostname doesn't resolve to the IP.
 
Old 02-28-2012, 04:30 PM   #3
suicidaleggroll
LQ Guru
 
Registered: Nov 2010
Location: Colorado
Distribution: OpenSUSE, CentOS
Posts: 5,552

Rep: Reputation: 2112Reputation: 2112Reputation: 2112Reputation: 2112Reputation: 2112Reputation: 2112Reputation: 2112Reputation: 2112Reputation: 2112Reputation: 2112Reputation: 2112
Quote:
Originally Posted by droyden View Post
Nothing to be worried about ssh is just saying that the IP resolves to the hostname but the.hostname doesn't resolve to the IP.
And in this case, the hostname looks like it's just a dummy or fill value that was thrown in there when you set up the machine.
 
Old 02-28-2012, 05:01 PM   #4
z01krh
Member
 
Registered: May 2009
Posts: 34

Original Poster
Rep: Reputation: 0
The hostname was setup exactly the way I set up my other host names in RHEL in /etc/hosts and /etc/sysconfig/network.
Why now whould it cause a problem?

Last edited by z01krh; 02-28-2012 at 05:07 PM.
 
Old 02-28-2012, 05:10 PM   #5
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 8,606
Blog Entries: 4

Rep: Reputation: 2997Reputation: 2997Reputation: 2997Reputation: 2997Reputation: 2997Reputation: 2997Reputation: 2997Reputation: 2997Reputation: 2997Reputation: 2997Reputation: 2997
Any address of the form 192.168.yyy.xxx is a so-called non-routable IP address, which means that it can only refer to a node on your private network. It seems to me that whoever wrote the code for that alarming message did not fully consider this possibility.
 
Old 02-28-2012, 05:27 PM   #6
jefro
Moderator
 
Registered: Mar 2008
Posts: 17,101

Rep: Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551Reputation: 2551
dig would not resolve mydomain.com to that ip would it?
 
Old 02-29-2012, 12:24 AM   #7
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.9, Centos 7.3
Posts: 17,411

Rep: Reputation: 2397Reputation: 2397Reputation: 2397Reputation: 2397Reputation: 2397Reputation: 2397Reputation: 2397Reputation: 2397Reputation: 2397Reputation: 2397Reputation: 2397
Probably just means reverse DNS zone has not been setup. Not that unusual in private networks.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] rsh/ssh problem: POSSIBLE BREAK-IN ATTEMPT, most probably due to DNS configuration scampsd Linux - Newbie 5 01-04-2012 09:35 AM
New to Linux, Getting a logwatch email about Possible Break In Attempt Blueleaf Linux - Newbie 3 11-15-2010 01:04 PM
reverse mapping checking getaddrinfo for ... failed - POSSIBLE BREAK-IN ATTEMPT eteck Linux - Server 1 08-29-2010 11:02 AM
Break-In attempt on www.centos.org unSpawn Linux - Security 0 07-08-2009 07:16 PM
Possible Break In Attempt stlyz3 Linux - Security 2 08-05-2005 10:37 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 08:24 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration