Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was wondering why I'm connection to a server with SSH, it does a reverse DNS lookup on the IP of the remote server.

I have found comments telling that it was for security reason, lots of tutorial showing how to disable it but no explanation.

Thank you

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

SSHD can be configured to block access to clients whose forward(A) and reverse(PTR) records don't map to each other.

When the connection request comes in the daemon checks the reverse record of the IP: 192.168.1.1 = PTR my.domain.com

It can then check the forward lookup record of the host: my.domain.com = A 192.168.1.1

If my.domain.com doesn't resolve to 192.168.1.1 then it can block the connection.

This is because it is easy to setup your own reverse zone and map a PTR record to whatever host name you would like, but to map the host name to the IP would require you to have access to the authoritative server for that zone. IE one more thing a hacker would have to do to gain access.

share|improve this answer
    
Thank you for that explanation –  Martin Trigaux Nov 26 '10 at 23:23
add comment

Not sure about why SSH does it specifically, but if you configure a box to only allow connections from host.xyz.com, anyone can configure a box and call it host.xyz.com, but if you can have a forward DNS entry for host.xyz.com that points to 1.2.3.4 and a PTR for 4.3.2.1.in-addr.arpa that points to host.xyz.com then it's a much better indication that you truly are host.xyz.com.

share|improve this answer
add comment

I'm not 100% certain of the answer to this question, but I imagine it is to either:

  • Display the right title in the title bar
  • To see if there is a private key installed for this host.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.