Re: what does this message means

[Bill Moran]

On Mon, 27 Mar 2006 09:28:33 +0500 (PKT)
Imran Imtiaz [EMAIL PROTECTED] wrote:

 I got the following in my daily security check logs. what does it mean?
 
 Mar 26 14:27:17 darkstar sshd[90821]: reverse mapping checking getaddrinfo 
 for genesis-27-156-16-del.genesipr.com failed - POSSIBLE BREAKIN ATTEMPT!

I means that whoever logged in came from an address with broken DNS.
Specifically, their reverse DNS doesn't match their forward DNS.

Unfortunately, these days it's not a good indicator of how dangerous
the origin is, as a lot of people seem incapable of correctly configuring
DNS.  But it is an indicator that you'll have difficulty tracking
down the source of the login.

-- 
Bill Moran
Collaborative Fusion Inc.
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]

RE: what does this message means

[fbsd_user]

It means a attacker who has camouflaged his real identity found
your ssh port open and was trying to gain access, but ssh's
security did its job and denied access just like it's designed to
do.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Imran
Imtiaz
Sent: Sunday, March 26, 2006 11:29 PM
To: freebsd-questions@freebsd.org
Subject: what does this message means


I got the following in my daily security check logs. what does it
mean?

Mar 26 14:27:17 darkstar sshd[90821]: reverse mapping checking
getaddrinfo for genesis-27-156-16-del.genesipr.com failed - POSSIBLE
BREAKIN ATTEMPT!
Mar 26 14:27:22 darkstar sshd[90823]: reverse mapping checking
getaddrinfo for genesis-27-156-16-del.genesipr.com failed - POSSIBLE
BREAKIN ATTEMPT!
Mar 26 14:27:26 darkstar sshd[90825]: reverse mapping checking
getaddrinfo for genesis-27-156-16-del.genesipr.com failed - POSSIBLE
BREAKIN ATTEMPT!
Mar 26 14:27:30 darkstar sshd[90827]: reverse mapping checking
getaddrinfo for genesis-27-156-16-del.genesipr.com failed - POSSIBLE
BREAKIN ATTEMPT!
Mar 26 14:27:35 darkstar sshd[90836]: reverse mapping checking
getaddrinfo for genesis-27-156-16-del.genesipr.com failed - POSSIBLE
BREAKIN ATTEMPT!

regards,
Imran

___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to
[EMAIL PROTECTED]

___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]