Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a CentOS 5.x box running on a VPS platform. My VPS host misinterpreted a support inquiry I had about connectivity and effectively flushed some iptables rules. This resulted in ssh listening on the standard port and acknowledging port connectivity tests. Annoying.

The good news is that I require SSH Authorized keys. As far as I can tell, I don't think there was any successful breach. I'm still very concerned about what I'm seeing in /var/log/secure though:

Apr 10 06:39:27 echo sshd[22297]: reverse mapping checking getaddrinfo for failed - POSSIBLE BREAK-IN ATTEMPT!
Apr 10 13:39:27 echo sshd[22298]: Received disconnect from 11: Bye Bye
Apr 10 06:39:31 echo sshd[22324]: Invalid user edu1 from
Apr 10 06:39:31 echo sshd[22324]: reverse mapping checking getaddrinfo for failed - POSSIBLE BREAK-IN ATTEMPT!
Apr 10 13:39:31 echo sshd[22330]: input_userauth_request: invalid user edu1
Apr 10 13:39:31 echo sshd[22330]: Received disconnect from 11: Bye Bye
Apr 10 06:39:35 echo sshd[22336]: Invalid user test1 from
Apr 10 06:39:35 echo sshd[22336]: reverse mapping checking getaddrinfo for failed - POSSIBLE BREAK-IN ATTEMPT!
Apr 10 13:39:35 echo sshd[22338]: input_userauth_request: invalid user test1
Apr 10 13:39:35 echo sshd[22338]: Received disconnect from 11: Bye Bye
Apr 10 06:39:39 echo sshd[22377]: Invalid user test from
Apr 10 06:39:39 echo sshd[22377]: reverse mapping checking getaddrinfo for failed - POSSIBLE BREAK-IN ATTEMPT!
Apr 10 13:39:39 echo sshd[22378]: input_userauth_request: invalid user test
Apr 10 13:39:39 echo sshd[22378]: Received disconnect from 11: Bye Bye

What exactly does "POSSIBLE BREAK-IN ATTEMPT" mean? That it was successful? Or that it didn't like the IP the request was coming from?

share|improve this question
up vote 64 down vote accepted

Unfortunately this in now a very common occurrence. It is an automated attack on SSH which is using 'common' usernames to try and break into your system. The message means exactly what it says, it does not mean that you have been hacked just that someone tried.

share|improve this answer
Thanks Lain. That makes me feel better. I'm really glad I require authorized keys for ssh. =) – Mike B Apr 17 '11 at 18:31
"reverse mapping checking getaddrinfo for" is more about source IP/hostname crafted. The same crafted traffic is trying bad user names, but bad user names doesn't generate the "POSSIBLE BREAK-IN ATTEMPT" message. – poisonbit Apr 17 '11 at 18:34
@MikeyB: You may want to look at adding fail2ban to you system. THis can be configured to block the IP addresses of these attackers automatically. – Iain Apr 17 '11 at 18:35
@poisonbit: Your right it means that there is a reverse lookup that then doesn't in turn resolve to an A record but in the round it's all part of the same automated attack. – Iain Apr 17 '11 at 18:38
Note that 'reverse mapping failed' can simply mean that the user's ISP hasn't configured reverse DNS correctly, which is quite common. See @Gaia 's answer. – Wilfred Hughes Oct 9 '13 at 13:52

The "POSSIBLE BREAK-IN ATTEMPT" part specifically, is related to the "reverse mapping checking getaddrinfo failed" part. It means the person who was connecting didn't have forward and reverse DNS configured correctly. This is quite common, especially for ISP connections, which is where the "attack" was probably coming from.

Unrelated the the "POSSIBLE BREAK-IN ATTEMPT" message, the person is actually trying to break in using common user names and passwords. Do not use simple passwords for SSH; in fact the best idea to to disable passwords altogether and use SSH keys only.

share|improve this answer
If it's generated by a (valid) connection via an ISP, you can add an entry to your /etc/hosts file to get rid of this reverse mapping error. Obviously you'd only do this if you knew that the error is benign and want to clean up your logs. – artfulrobot Aug 10 '12 at 9:22

"What exactly does "POSSIBLE BREAK-IN ATTEMPT" mean?"

This means that the netblock owner did not update the PTR record for a static IP within their range, and said PTR record is outdated, OR an ISP does not setup proper reverse records for its dynamic IP customers. This is very common, even for large ISPs.

You end up getting the msg in your log because someone coming from an IP with improper PTR records (due to one of the reasons above) is trying to use common usernames to try SSH into your server (possibly bruteforce attack, or maybe an honest mistake).

To disable these alerts, you have two choices:

1) If you have a static IP, add your reverse mapping to your /etc/hosts file (see more info here):

2) If you have a dynamic IP and really want to make those alerts go away, comment out the "GSSAPIAuthentication yes" in your /etc/ssh/sshd_config file.

share|improve this answer
commenting GSSAPIAuthentication does not help in my case ( – SET Jan 3 '14 at 0:57
This seems to be a more accurate answer. – Litmus Jun 9 '14 at 9:18
This is a more accurate answer, @mike-b – Gaia Aug 19 '15 at 11:59

You can make your logs easier to read and check by turning off reverse lookp-ups in sshd_config (UseDNS no). This will prevent sshd from logging the "noise" lines containing "POSSIBLE BREAK-IN ATTEMPT" leaving you to concentrate on the slightly more interesting lines containing "Invalid user USER from IPADDRESS".

share|improve this answer
What is the downside to disabling sshd reverse lookups on a server connected to the public Internet? Is there any upside at all to leaving this option enabled? – Eddie Nov 6 '13 at 15:48
@Eddie I don't think the DNS lookups performed by sshd serves any useful purpose. There are two good reasons to disable the DNS lookups. The DNS lookups can slow down login if the lookups time out. And the "POSSIBLE BREAK-IN ATTEMPT" messages in the log are misleading. All that message really means is that the client has misconfigured DNS. – kasperd Jul 1 '15 at 10:12
@kasperd UseDNS is needed, if one needs / wants to use hostnames in the from= directive in authorized_keys files. – gf_ May 15 at 19:08

It's not necessary a successful login, but what it says "posible" and "attempt".

Some bad boy or script kiddie, is sending you crafted traffic with a false origin IP.

You can add origin IP limitations to your SSH keys, and try something like fail2ban.

share|improve this answer
Thanks. I have iptables set to only allow ssh connectivity from select sources. I also have fail2ban installed and running. – Mike B Apr 17 '11 at 18:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.