Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just typed a wrong password for login to ssh @ root.

I went to


But the file is empty ( tho its filesize is: 32 Byte )

Ok in auth.log is spammed this:

reverse mapping checking getaddrinfo for [] failed - POSSIBLE BREAK-IN ATTEMPT!
Feb 21 03:44:22 ns3xxxx9 sshd[7497]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=  user=root

What's that?

share|improve this question
up vote 9 down vote accepted

You can (by default) check for these failures in /var/log/auth.log

share|improve this answer
thanks +1, Do you know what those log lines mean? (watch first post adds) – dynamic Feb 21 '11 at 12:02
The getaddrinfo error just means that something was strange with the DNS records for that IP/hostname. Not a serious error, really. The second line is where they fail to login as root. – signine Mar 1 '11 at 18:59

The first line means that a connection attempt was received from an IP address. The ssh server attemped to reverse-resolve the address and got a hostname (, but when it attempted to forward-resolve that hostname to get back to the original IP address, it failed. This isn't fatal, it usually means someone else has screwed up their DNS, but ssh lets you know that that log entry has failed a basic can-I-be-relied-on test.

The second line means someone from the same IP address tried to ssh in as root, and failed.

If you get too many of the second kind of entry and want to make things harder for people, I wrote a piece on techniques for dealing with automated ssh password guessing that may interest you, though it doesn't cover fail2ban and similar technologies (because I don't like them).

share|improve this answer
thanks +1. But Is that possible that Linux doenst' support automated "block" login if someone makes x fail attempts? I don't want to install fail2ban! – dynamic Feb 21 '11 at 12:20
OpenSSH (not "Linux", the kernel isn't responsible for this) will not automatically block logins from a given address after a certain number of failures. There do exist rate-limiting configuration variables you can use inside sshd's config file (man sshd_config), or you can use fail2ban, or you can use one of the ideas in my tech note. The joy of free software is that the power and the responsibility are both yours: go for it. – MadHatter Feb 21 '11 at 12:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.