I'm using a combination of /etc/hosts.deny and ufw on my ubuntu 10.04.04 server. Most days, I see failed ssh attempts from machines in the .com.cn domain, reported like so:
Failed logins from: 126.96.36.199 (188.8.131.52.broad.km.yn.dynamic.163data.com.cn): 1 time
However, in /etc/hosts.deny, I have this rule:
Shouldn't this be blocking the connection before it even hits ssh? I've tested it via blocking my home machine, and it certainly denies me a connection right away before I get a login prompt (and yes, I've moved my ssh keys away so those aren't involved).
Is this working as intended?
Edit: James Sneeringer prompted me to look more closely at the logs, and perhaps I see why this is happening. From auth.log:
Nov 5 09:38:40 mymachine sshd: warning: /etc/hosts.deny, line 21: can't verify hostname: getaddrinfo(184.108.40.206.broad.km.yn.dynamic.163data.com.cn, AF_INET) failed Nov 5 09:38:44 mymachine sshd: reverse mapping checking getaddrinfo for 220.127.116.11.broad.km.yn.dynamic.163data.com.cn [18.104.22.168] failed - POSSIBLE BREAK-IN ATTEMPT! Nov 5 09:38:45 mymachine sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=22.214.171.124 user=root Nov 5 09:38:47 mymachine sshd: Failed password for root from 126.96.36.199 port 37245 ssh2 Nov 5 09:38:47 mymachine sshd: Connection closed by 188.8.131.52
This implies to me that if sshd isn't sure about the IP->name lookup, then it errs on the side of caution and does not block that host. Is that right?