ssh login reverse mapping failed, should I worry?

michaelsanford · 10-06-2005, 08:50 AM

Code:

Address 67.71.152.11 maps to 10.152.71.61.in-addr.arpa, but this
does not map back to the address - POSSIBLE BREAKIN ATTEMPT!

I just got this when logging in to my Slackware box from my campus wifi (first time I've used the campus wifi, new system). Could that be the culprit?

PS 67.71.152.11 is the address of my server as reported by ifconfig | grep ppp0.

TruckStuff · 10-06-2005, 04:44 PM

It just means that the reverse DNS for your campus wifi is not properly configured and SSH could not determine a hostname for the IP in question. Personally, I don't know why SSH gripes about this, but I'm sure there is a (somewhat) legitimate reason somewhere.

ppuru · 10-06-2005, 05:34 PM

From the sshd_config manpages

Quote:

UseDNS Specifies whether sshd should lookup the remote host name
and check that the resolved host name for the remote IP
address maps back to the very same IP address.
The default is "yes"

michaelsanford · 10-16-2005, 09:27 AM

I had a feeling it was UseDNS, but I'm never sure whether it's the sshd or ssh that outputs those messages (i.e., I wasn't totally sure whether it was my end or the server end that was complaining about the DNS entry being wrong).

Thanks.