SSH errors from archives trigger

[Imre Gergely]

On 11/16/2011 07:05 PM, Lance Albertson wrote:
> I started noticing in the last few days that our archive mirror has
> stopped being up to date automatically. Upon further investigation I
> noticed something odd in our sshd logs from the ubuntu ftpsync client
> trying to connect:
> 
> Nov 16 15:51:34 ftp-osl.osuosl.org sshd[10504]: Address 91.189.92.172
> maps to sadashbia.canonical.com, but this does not map back to the
> address - POSSIBLE BREAK-IN ATTEMPT!
> Nov 16 15:51:35 ftp-osl.osuosl.org sshd[10504]: error:
> RSA_public_decrypt failed: error:0407006A:lib(4):func(112):reason(106)
> 
> Nothing major has changed on this machine recently, especially during
> the window this started to happen. I first started to see this error at
> Nov 15 17:25:03 UTC. Is this a known issue or did something change
> recently one your end that may be causing this?
> 
> Thanks-
> 

I'm getting the same errors

Nov 17 16:17:47 elf sshd[23375]: Address 91.189.92.172 maps to
sadashbia.canonical.com, but this does not map back to the address -
POSSIBLE BREAK-IN ATTEMPT!
Nov 17 16:17:47 elf sshd[23376]: Postponed publickey for ubuntu from
91.189.92.172 port 41612 ssh2
Nov 17 16:17:47 elf sshd[23375]: error: RSA_public_decrypt failed:
error:0407006A:lib(4):func(112):reason(106)
Nov 17 16:17:48 elf sshd[23376]: Connection closed by 91.189.92.172

The first one I've got on nov 15

Nov 15 18:42:37 elf sshd[8775]: Address 91.189.92.173 maps to
sadashbia.canonical.com, but this does not map back to the address -
POSSIBLE BREAK-IN ATTEMPT!
Nov 15 18:42:37 elf sshd[8776]: Postponed publickey for ubuntu from
91.189.92.173 port 59157 ssh2
Nov 15 18:42:37 elf sshd[8775]: error: RSA_public_decrypt failed:
error:0407006A:lib(4):func(112):reason(106)
Nov 15 18:42:37 elf sshd[8776]: Connection closed by 91.189.92.173
Nov 15 19:24:53 elf sshd[9426]: Address 91.189.92.172 maps to
sadashbia.canonical.com, but this does not map back to the address -
POSSIBLE BREAK-IN ATTEMPT!
Nov 15 19:24:53 elf sshd[9427]: Postponed publickey for ubuntu from
91.189.92.172 port 40551 ssh2
Nov 15 19:24:54 elf sshd[9426]: error: RSA_public_decrypt failed:
error:0407006A:lib(4):func(112):reason(106)
Nov 15 19:24:54 elf sshd[9427]: Connection closed by 91.189.92.172

-- 
Imre Gergely
ISP Support Engineer
UPC Romania | http://www.upc.ro
subkeys.pgp.net 0x34525305