Skip to main content

Reverse Mapping failed for SSHD

http://www.electrictoolbox.com/reverse-mapping-possible-break-in-ssh/


See snippet below...
Connecting from the command line, you might enter something like this:
1ssh my.example.com
and get some output like this:
1Connecting to my.example.com...
2reverse mapping checking getaddrinfo for 192-168-1-243.foo.bar.net failed - POSSIBLE BREAK-IN ATTEMPT!
3chris@my.example.com's password:
What this is telling us is that although we are connecting to my.example.com the IP address of the server we are connecting to actually maps back to 192-168-1-243.foo.bar.net in this example. When this actually happened to me, it's because the reverse DNS had not been set up for the server (which would map e.g. 192.168.1.243 to my.example.com as well as vice versa).

Hosts file solution

Because I knew this reverse mapping was OK, I can add an entry to my hosts file and it will stop the error message from happening. For the above example, I would add the following to my hosts file:
1192.168.1.243  my.example.com

Comments

Popular posts from this blog

NMAP

It's been about 15 years since I used NMAP, I forgot how useful the tool is. To find out what services are running on an IP address simply use something like nmap -n -v -p1-10000 x.x.x.x -n tells nmap not to do name resolution (saves about 13 seconds if the IP you're scanning isn't in DNS_ -v verbose -p1-10000 says scan ports 1 to 10,000 (otherwise nmap will only scan the first 1000 ports)