SSH errors from archives trigger

[Arnoldas Šareckis]

Same here (ubuntu.mirror.vu.lt):

root at debian:/var/log# cat auth.log | grep error
Nov 15 18:42:42 debian sshd[10419]: error: RSA_public_decrypt failed:
error:0407006A:lib(4):func(112):reason(106)
Nov 15 19:25:09 debian sshd[10891]: error: RSA_public_decrypt failed:
error:0407006A:lib(4):func(112):reason(106)
Nov 15 20:29:44 debian sshd[11490]: error: RSA_public_decrypt failed:
error:0407006A:lib(4):func(112):reason(106)
Nov 16 00:00:49 debian sshd[13657]: error: RSA_public_decrypt failed:
error:0407006A:lib(4):func(112):reason(106)
Nov 16 02:43:46 debian sshd[15421]: error: RSA_public_decrypt failed:
error:0407006A:lib(4):func(112):reason(106)
Nov 16 02:51:45 debian sshd[15578]: error: RSA_public_decrypt failed:
error:0407006A:lib(4):func(112):reason(106)
Nov 16 04:14:12 debian sshd[16585]: error: RSA_public_decrypt failed:
error:0407006A:lib(4):func(112):reason(106)
Nov 16 06:23:26 debian sshd[17918]: error: RSA_public_decrypt failed:
error:0407006A:lib(4):func(112):reason(106)
Nov 16 07:31:46 debian sshd[18883]: error: RSA_public_decrypt failed:
error:0407006A:lib(4):func(112):reason(106)


....


Nov 17 12:04:54 debian sshd[14234]: error: RSA_public_decrypt failed:
error:0407006A:lib(4):func(112):reason(106)
Nov 17 12:19:51 debian sshd[14275]: error: RSA_public_decrypt failed:
error:0407006A:lib(4):func(112):reason(106)
Nov 17 13:39:25 debian sshd[18045]: error: RSA_public_decrypt failed:
error:0407006A:lib(4):func(112):reason(106)
Nov 17 16:18:04 debian sshd[21245]: error: RSA_public_decrypt failed:
error:0407006A:lib(4):func(112):reason(106)




On Thu, 2011-11-17 at 16:31 +0200, Imre Gergely wrote:
> On 11/16/2011 07:05 PM, Lance Albertson wrote:
> > I started noticing in the last few days that our archive mirror has
> > stopped being up to date automatically. Upon further investigation I
> > noticed something odd in our sshd logs from the ubuntu ftpsync client
> > trying to connect:
> > 
> > Nov 16 15:51:34 ftp-osl.osuosl.org sshd[10504]: Address 91.189.92.172
> > maps to sadashbia.canonical.com, but this does not map back to the
> > address - POSSIBLE BREAK-IN ATTEMPT!
> > Nov 16 15:51:35 ftp-osl.osuosl.org sshd[10504]: error:
> > RSA_public_decrypt failed: error:0407006A:lib(4):func(112):reason(106)
> > 
> > Nothing major has changed on this machine recently, especially during
> > the window this started to happen. I first started to see this error at
> > Nov 15 17:25:03 UTC. Is this a known issue or did something change
> > recently one your end that may be causing this?
> > 
> > Thanks-
> > 
> 
> I'm getting the same errors
> 
> Nov 17 16:17:47 elf sshd[23375]: Address 91.189.92.172 maps to
> sadashbia.canonical.com, but this does not map back to the address -
> POSSIBLE BREAK-IN ATTEMPT!
> Nov 17 16:17:47 elf sshd[23376]: Postponed publickey for ubuntu from
> 91.189.92.172 port 41612 ssh2
> Nov 17 16:17:47 elf sshd[23375]: error: RSA_public_decrypt failed:
> error:0407006A:lib(4):func(112):reason(106)
> Nov 17 16:17:48 elf sshd[23376]: Connection closed by 91.189.92.172
> 
> The first one I've got on nov 15
> 
> Nov 15 18:42:37 elf sshd[8775]: Address 91.189.92.173 maps to
> sadashbia.canonical.com, but this does not map back to the address -
> POSSIBLE BREAK-IN ATTEMPT!
> Nov 15 18:42:37 elf sshd[8776]: Postponed publickey for ubuntu from
> 91.189.92.173 port 59157 ssh2
> Nov 15 18:42:37 elf sshd[8775]: error: RSA_public_decrypt failed:
> error:0407006A:lib(4):func(112):reason(106)
> Nov 15 18:42:37 elf sshd[8776]: Connection closed by 91.189.92.173
> Nov 15 19:24:53 elf sshd[9426]: Address 91.189.92.172 maps to
> sadashbia.canonical.com, but this does not map back to the address -
> POSSIBLE BREAK-IN ATTEMPT!
> Nov 15 19:24:53 elf sshd[9427]: Postponed publickey for ubuntu from
> 91.189.92.172 port 40551 ssh2
> Nov 15 19:24:54 elf sshd[9426]: error: RSA_public_decrypt failed:
> error:0407006A:lib(4):func(112):reason(106)
> Nov 15 19:24:54 elf sshd[9427]: Connection closed by 91.189.92.172
> 
> -- 
> Imre Gergely
> ISP Support Engineer
> UPC Romania | http://www.upc.ro
> subkeys.pgp.net 0x34525305
> 


--
Best regards,
Arnoldas Sareckis
Vilnius University