From owner-freebsd-security@freebsd.org Sat Jul 21 11:57:15 2018 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 23CFC10484EF for ; Sat, 21 Jul 2018 11:57:15 +0000 (UTC) (envelope-from list1@gjunka.com) Received: from msa1.earth.yoonka.com (yoonka.com [88.98.225.149]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "msa1.earth.yoonka.com", Issuer "msa1.earth.yoonka.com" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id B78898732F for ; Sat, 21 Jul 2018 11:57:14 +0000 (UTC) (envelope-from list1@gjunka.com) Received: from ultrabook.yoonka.com (p5DD75328.dip0.t-ipconnect.de [93.215.83.40]) (authenticated bits=0) by msa1.earth.yoonka.com (8.15.2/8.15.2) with ESMTPSA id w6LBvClt003765 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO) for ; Sat, 21 Jul 2018 11:57:13 GMT (envelope-from list1@gjunka.com) X-Authentication-Warning: msa1.earth.yoonka.com: Host p5DD75328.dip0.t-ipconnect.de [93.215.83.40] claimed to be ultrabook.yoonka.com Subject: Re: Possible break-in attempt? To: freebsd-security@freebsd.org References: <594ba84b-0691-8471-4bd4-076d0ae3da98@gjunka.com> <368EABCF-A10A-49E9-9473-7753F6BEAA50@patpro.net> <8EDDBDB2-77F5-4CF5-8744-41BEA187C08A@FreeBSD.org> <201807201905.w6KJ59hn079229@donotpassgo.dyslexicfish.net> <2E502F45-E6F6-44D7-AE9E-9B8B08C1CEBE@nuos.org> From: Grzegorz Junka Message-ID: Date: Sat, 21 Jul 2018 11:57:07 +0000 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: <2E502F45-E6F6-44D7-AE9E-9B8B08C1CEBE@nuos.org> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-GB-large X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 21 Jul 2018 11:57:15 -0000 On 21/07/2018 11:03, Chad Jacob Milios wrote: >> On Jul 20, 2018, at 3:05 PM, Jamie Landeg-Jones wrote: >> >> Dimitry Andric wrote: >> >>> For each incoming IP address, sshd does a reverse lookup, and if that >>> results in a hostname, it does another lookup of that hostname, to see >>> if *that* result matches the original incoming IP address. If it does >>> not, you get this scary warning in syslog about a "possible break-in >>> attempt!". >>> >>> In my opinion, this is fairly misleading, since almost always the actual >>> cause is badly configured DNS, a very common occurrence. In addition, >>> matching forward and reverse DNS records is no guarantee at all that the >>> incoming IP address is in any way trustworthy. >> I'm not sure which version this made it into, but they actually removed this >> over 2 years ago. It's not in the openssh that ships with FreeBSD 11.2: >> >> | commit e690fe85750e93fca1fb7c7c8587d4130a4f7aba >> | Author: dtucker@openbsd.org >> | Date: Wed Jun 15 00:40:40 2016 +0000 >> | >> | upstream commit >> | >> | Remove "POSSIBLE BREAK-IN ATTEMPT!" from log message >> | about forward and reverse DNS not matching. We haven't supported IP-based >> | auth methods for a very long time so it's now misleading. part of bz#2585, >> | ok markus@ >> | >> | Upstream-ID: 5565ef0ee0599b27f0bd1d3bb1f8a323d8274e29 >> >> cheers, Jamie > adding: > > UseDNS no > > has the added benefit of avoiding a grueling delay when YOU are the one behind an IP address with a misconfigured reverse DNS mapping (which is horribly common on consumer networks). It goes into /etc/ssh/sshd_config and has been among my initial configuration to every FreeBSD box i’ve stood up for a decade. > > openssh-portable (in ports, produced by the paranoid fellows at OpenBSD) has actually switched to adopt this, UseDNS no, as their default configuration for, i think its been a couple years now. This is in addition to dropping the message from their log output if UseDNS yes. > > There is no point to this foolishly alarming message. Be mindful of the OTHER ways you must surely have in place to keep your sshd hard against attack. > Good to know. But the documentation says setting to no prevents from using DNS in known_hosts. When I look into my known_hosts I see many dns-only names, e.g. github.com among others. GrzegorzJ