Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 19 Oct 2005 10:00:13 +0400
From:      dawnshade <dawnshade@mail.ru>
To:        freebsd-questions@freebsd.org
Subject:   Re: possible breakin attempt?
Message-ID:  <200510191000.13507.dawnshade@mail.ru>
In-Reply-To: <20051018171938.GB2305@zeus.itg.uiuc.edu>
References:  <20051018171938.GB2305@zeus.itg.uiuc.edu>

next in thread | previous in thread | raw e-mail | index | archive | help
On Tuesday 18 October 2005 21:19, Anthony Philipp wrote:
> Hello,
>
> In my daily emails from my box I noticed this:
>
> Oct 17 16:13:03 lupin sshd[51861]: reverse mapping checking getaddrinfo for
> 211-234-119-139.kidc.net failed - POSSIBLE BREAKIN ATTEMPT! Oct 17 16:13:05
> lupin sshd[51863]: reverse mapping checking getaddrinfo for
> 211-234-119-139.kidc.net failed - POSSIBLE BREAKIN ATTEMPT! Oct 17 16:13:08
> lupin sshd[51865]: reverse mapping checking getaddrinfo for
> 211-234-119-139.kidc.net failed - POSSIBLE BREAKIN ATTEMPT! Oct 17 16:13:21
> lupin sshd[51869]: reverse mapping checking getaddrinfo for
> 211-234-119-139.kidc.net failed - POSSIBLE BREAKIN ATTEMPT! Oct 17 16:13:21
> lupin sshd[51867]: reverse mapping checking getaddrinfo for
> 211-234-119-139.kidc.net failed - POSSIBLE BREAKIN ATTEMPT! Oct 17 16:13:30
> lupin sshd[51873]: reverse mapping checking getaddrinfo for
> 211-234-119-139.kidc.net failed - POSSIBLE BREAKIN ATTEMPT! Oct 17 16:13:32
> lupin sshd[51875]: reverse mapping checking getaddrinfo for
> 211-234-119-139.kidc.net failed - POSSIBLE BREAKIN ATTEMPT! Oct 17 16:13:34
> lupin sshd[51871]: reverse mapping checking getaddrinfo for
> 211-234-119-139.kidc.net failed - POSSIBLE BREAKIN ATTEMPT! Oct 17 16:13:37
> lupin sshd[51877]: reverse mapping checking getaddrinfo for
> 211-234-119-139.kidc.net failed - POSSIBLE BREAKIN ATTEMPT! Oct 17 16:13:37
> lupin sshd[51879]: reverse mapping checking getaddrinfo for
> 211-234-119-139.kidc.net failed - POSSIBLE BREAKIN ATTEMPT! Oct 17 16:13:40
> lupin sshd[51881]: reverse mapping checking getaddrinfo for
> 211-234-119-139.kidc.net failed - POSSIBLE BREAKIN ATTEMPT! Oct 17 16:13:43
> lupin sshd[51883]: reverse mapping checking getaddrinfo for
> 211-234-119-139.kidc.net failed - POSSIBLE BREAKIN ATTEMPT! Oct 17 16:13:55
> lupin sshd[51885]: reverse mapping checking getaddrinfo for
> 211-234-119-139.kidc.net failed - POSSIBLE BREAKIN ATTEMPT!
>
> I was just wondering exactly how dangerous this is, and what I can
> do about it.
>
> Thanks for any additional help!


just connections to sshd from ip which have reverse name, but not have A 
record in DNS provider.
Usually for DSL, dialup hosts.
see man ssd_config for directive UseDNS or just block tcp/22 from not trusted 
hosts.





Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200510191000.13507.dawnshade>