When when I ssh into my server from windows using putty without using public key authentication I get no indication of a "BREAK IN ATTEMPT" in /var/log/auth.log

However when I use DSA keys and set the appropriate path for the private key in putty:


Private key file for authenticationBrowse...

I am able to ssh into my server with public key authentication, however the /var/log/auth.log adds the following line to the log file

Address maps to dd-wrt, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!

Should this message be expected when I use public key authentication and my private key is on my windows comp/I use putty to ssh?

NOTE: My server and windows computer are both on the same LAN

  • Are you sure that message is from a login attempt on the same LAN? That message would indicate that the attempt is coming from the dd-wrt router. Dec 29, 2011 at 21:10

1 Answer 1


This is not an error or a hack. The message you are seeing is because of the reverse lookup performed which will return a host name. It works like this, assuming that you are ssh'ing to host1 with ip from host2:
lookup(host1) returns
but rev_lookup( might not return host1 but dd-wrt which is/was another host on the network. Check your DHCP server, it might help

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .