Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

An absolutely noob question I'm sure but I get an email from my web host everyday with a list of a few denied hosts and wondered exactly what this meant. I'm guessing that its a connection refused by the host because of an identification problem but what exactly could cause this issue?

Additionally, I receive the following message and wondered if someone could explain it to me:

reverse mapping - checking getaddrinfo for blah.blah.com [190.xxx.xxx.xx] failed - POSSIBLE BREAK-IN ATTEMPT! : 9 time(s)

share|improve this question

1 Answer 1

up vote 0 down vote accepted

"Denied hosts" refers to brute force attacks on your services (usually ssh). Most likely you have a software like denyhosts or fail2ban or similar that looks into the failure log and when a host reaches a predefined number of failed logins it bans it (semi-)permanently. A brute force dictionary attack usually looks like this: hacker launches some tool that checks for public services(be that ssh for simplicity) running on machines in some IP range. When such a service is discovered the tool tries very common (hence dictionary) combinations of username/passwords. Things like "root/test123" or "guest/guest" should come to mind.

You don't need to do anything besides making sure that your passwords are strong enough and you don't run any unsecured services on your box. http://en.wikipedia.org/wiki/Password_policy might be of some help in choosing strong passwords.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.