From owner-freebsd-questions@FreeBSD.ORG Thu Nov 18 07:43:45 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 48EA216A4CE for ; Thu, 18 Nov 2004 07:43:45 +0000 (GMT) Received: from chen.org.nz (chen.org.nz [210.54.19.51]) by mx1.FreeBSD.org (Postfix) with ESMTP id 05A5443D39 for ; Thu, 18 Nov 2004 07:43:45 +0000 (GMT) (envelope-from jonc@chen.org.nz) Received: by chen.org.nz (Postfix, from userid 1000) id 4A0A5C167; Thu, 18 Nov 2004 20:43:43 +1300 (NZDT) Date: Thu, 18 Nov 2004 20:43:43 +1300 From: Jonathan Chen To: Gerard Samuel Message-ID: <20041118074343.GC92397@grimoire.chen.org.nz> References: <419A5FC0.9070307@trini0.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <419A5FC0.9070307@trini0.org> User-Agent: Mutt/1.4.2.1i cc: freebsd-questions Subject: Re: Do I need to worry about these logs? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Nov 2004 07:43:45 -0000 On Tue, Nov 16, 2004 at 03:14:56PM -0500, Gerard Samuel wrote: > This is a fresh install of 5.3 from last week. > Granted the script-kiddies has been working to break in via ssh, > when I was running 4.10, I've never seen these types of logs before. > Any clues, would be appreciated. > Thanks. > > -- snip of /var/logs/auth.log -- > Nov 16 09:06:56 hivemind sshd[7611]: reverse mapping checking > getaddrinfo for 203-150-17-44.inter.net.th failed - POSSIBLE BREAKIN Just means that the reverse-DNS entry for the incoming ssh connection hasn't been configured correctly. -- Jonathan Chen Once is dumb luck. Twice is coincidence. Three times and Somebody Is Trying To Tell You Something.