sshd complains: POSSIBLE BREAK-IN ATTEMPT

Josef Wolf jw at raven.inka.de
Tue Sep 11 21:21:39 UTC 2007


Hello,

When I try to connect from one of my hosts to a recently installed
feisty, the connection hangs for about 5 seconds.  After this delay, the
connection is establised, but I get following warning in auth.log:

   reverse mapping checking getaddrinfo for raven.wolf.local failed - POSSIBLE BREAK-IN ATTEMPT!

"dig raven.wolf.local" correctly resolves the given host to 192.168.1.12
and "dig -x 192.168.1.12" correctly gives raven.wolf.local.

What is going wrong here?  What does the warning trying to say to me?
I have never seen such a problem with my debian (sarge) boxes.

Below I attached the relevant debug output from "sshd -dddd".

Any ideas what is screwed up wrong here?

debug1: userauth-request for user me service ssh-connection method none
debug1: attempt 0 failures 0
debug3: mm_getpwnamallow entering
debug3: mm_request_send entering: type 7
debug3: monitor_read: checking request 7
debug3: mm_answer_pwnamallow
debug3: auth_shadow_acctexpired: today 13767 sp_expire -1 days left -13768
debug3: account expiration disabled
debug3: Normalising mapped IPv4 in IPv6 address
debug3: Trying to reverse map address 192.168.1.12.
debug3: mm_getpwnamallow: waiting for MONITOR_ANS_PWNAM
debug3: mm_request_receive_expect entering: type 8
debug3: mm_request_receive entering
reverse mapping checking getaddrinfo for raven.wolf.local failed - POSSIBLE BREAK-IN ATTEMPT!
debug3: Normalising mapped IPv4 in IPv6 address
debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1
debug3: mm_request_send entering: type 8
debug2: monitor_read: 7 used once, disabling now
debug3: mm_request_receive entering
debug2: input_userauth_request: setting up authctxt for me
debug3: mm_inform_authserv entering
debug3: mm_request_send entering: type 3





More information about the ubuntu-users mailing list