topic Re: SSH Reverse Lookup Errors in Operating System - Linux

SSH Reverse Lookup Errors

Michael Williams_6 — Tue, 23 Aug 2005 04:13:46 GMT

Hi all,

I've just upgraded a system from SLES8 to SLES9 and I'm getting strange SSH behaviour I did not get before.

When I log in on SSH, I get a painfully slow pause between entering my username/password (or SSH key). And I get the following error message in my messages file:

Aug 23 09:41:58 alchnfs1 sshd[24643]: fatal: Timeout before authentication for ::ffff:10.1.101.1
Aug 23 09:47:45 alchnfs1 sshd[24942]: reverse mapping checking getaddrinfo for ad-lac8345.alchemetrics.local failed - POSSIBLE BREAKIN ATTEMPT!

However, when I try to reverse map that same address on the command line, it works fine:

alchnfs1:/var/log # nslookup
Note: nslookup is deprecated and may be removed from future releases.
Consider using the `dig' or `host' programs instead. Run nslookup with
the `-sil[ent]' option to prevent this message from appearing.
> ad-lac8345.alchemetrics.local
Server: 10.1.8.1
Address: 10.1.8.1#53

Name: ad-lac8345.alchemetrics.local
Address: 10.1.101.1
> 10.1.101.1
Server: 10.1.8.1
Address: 10.1.8.1#53

1.101.1.10.in-addr.arpa name = ad-lac8345.alchemetrics.local.

Does anyone have any ideas where the problem is? I've tried using modify sshd_config to ignore reverse mapping, but it looks like this has been depreciated :-(

Re: SSH Reverse Lookup Errors

Steven E. Protter — Tue, 23 Aug 2005 05:19:37 GMT

When you upgrade your os the rsa signatures are no longer valid. This probably has nothing to do with your reverse lookup.

You need to delete the old entries in the $HOME/.ssh/known_hosts file for the machines you are connecting to.

The inconsistent DNS behavior is something that should be looked at as far as the DNS records, but is not the cause of the error message.

SEP

Re: SSH Reverse Lookup Errors

Michael Williams_6 — Tue, 23 Aug 2005 05:37:15 GMT

Sorry - upgrade is mis-leading these were fresh built machines with a plan to upgrade our other hosts..!

I am also connecting using PuTTY from a Windows host, and there are no keys saved, but this behaviour also happens from our SLES8 hosts...

M

Re: SSH Reverse Lookup Errors

Gopi Sekar — Tue, 23 Aug 2005 06:00:00 GMT

check the routing and network configurations on the new SLES 9 servers. this might occur if the routing information is bad (non existing route) or wrong DNS configurations also.

I believe there is one variable in /proc which can be enabled/disabled to instruct kernel to reverse name look up all the IP addresses. Try to disable reverse name look up

Regards,
Gopi

Re: SSH Reverse Lookup Errors

Gopi Sekar — Tue, 23 Aug 2005 07:18:19 GMT

check in your /etc/sysctl.conf file for this key:
net.ipv4.conf.default.rp_filter = 1

if it is set to one try setting it to zero, reload sysctl by 'sysctl -p'.

The above value will disable source route verification which I believe does the reverse mapping.

Word of warning, you are touching proc file system and this change is permanent (it will be persistent even after reboot), so be ready to revert it back to old state if this does not solve your problem.

Hope this helps,
Gopi

Re: SSH Reverse Lookup Errors

Michael Williams_6 — Tue, 23 Aug 2005 07:27:02 GMT

Thanks Gopi - but that is set to 0 already :-(

Re: SSH Reverse Lookup Errors

Ivan Ferreira — Tue, 23 Aug 2005 07:53:51 GMT

Try editing the /etc/sshd/sshd_config file and set:

UseDNS no

Default is yes. Restart the service

service sshd reload

Re: SSH Reverse Lookup Errors

Michael Williams_6 — Tue, 23 Aug 2005 08:15:17 GMT

Ivan, you are a saint - that's the puppy!

Re: SSH Reverse Lookup Errors

Michael Williams_6 — Tue, 23 Aug 2005 08:16:00 GMT

All working as expected now!