Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Whenever I SSH somewhere I get something like this in the logs:

sshd[16734]: reverse mapping checking getaddrinfo for
    1.2.3.4.crummyisp.net [1.2.3.4] failed - POSSIBLE BREAK-IN ATTEMPT!

And it is right: if I do host 1.2.3.4 it returns 1.2.3.4.crummyisp.net, but if I do host 1.2.3.4.crummyisp.net it is not found.

I have two questions:

  1. What security threat is there? How could anyone fake a one-way DNS in some threatening way?

  2. Do I have any recourse for fixing this? I'll send my ISP a bug report, but who knows where that'll go.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

What security threat is there?
How could anyone fake a one-way DNS in some threatening way?

Any party with control of a DNS reverse zone can set their PTR records to whatever they want. It's conceivable that someone could set their PTR record to legithost.example.com, and then try to brute force their way into your environment.

If you have fat-fingered users who tend to mistype their passwords, and are lacking in anti-brute-force measures, a bunch of log entries for failed passwords from legithost.example.com could be dismissed as "Oh that's just Bob - he can't type to save his life!" and give an attacker the opportunity to keep guessing passwords until they get in.

(The theoretical security benefit from this message is that the attacker can't create/change the A record for legithost.example.com in your DNS zone, so he can't silence the warning - absent a DNS poisoning attack of some kind...)


Do I have any recourse for fixing this?

Option 1: Fix your DNS so the forward (A) and reverse (PTR) records match.
Option 2: Add UseDNS no to your system's sshd_config file to shut the warning up.

share|improve this answer
    
Wait, so you can just up and say, "Yeah, my IP of 1.2.3.4 is microsoft.com. Totally." ‽ –  rking Oct 10 '12 at 16:24
1  
@rking Yes, if you control the reverse zone for 1.2.3.4 (3.2.1.in-addr.arpa) –  voretaq7 Oct 10 '12 at 18:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.