SSH Reverse Lookup Errors

[Michael Williams_6]

Hi all,

I've just upgraded a system from SLES8 to SLES9 and I'm getting strange SSH behaviour I did not get before.

When I log in on SSH, I get a painfully slow pause between entering my username/password (or SSH key). And I get the following error message in my messages file:

Aug 23 09:41:58 alchnfs1 sshd[24643]: fatal: Timeout before authentication for ::ffff:10.1.101.1
Aug 23 09:47:45 alchnfs1 sshd[24942]: reverse mapping checking getaddrinfo for ad-lac8345.alchemetrics.local failed - POSSIBLE BREAKIN ATTEMPT!

However, when I try to reverse map that same address on the command line, it works fine:

alchnfs1:/var/log # nslookup
Note: nslookup is deprecated and may be removed from future releases.
Consider using the `dig' or `host' programs instead. Run nslookup with
the `-sil[ent]' option to prevent this message from appearing.
> ad-lac8345.alchemetrics.local
Server: 10.1.8.1
Address: 10.1.8.1#53

Name: ad-lac8345.alchemetrics.local
Address: 10.1.101.1
> 10.1.101.1
Server: 10.1.8.1
Address: 10.1.8.1#53

1.101.1.10.in-addr.arpa name = ad-lac8345.alchemetrics.local.

Does anyone have any ideas where the problem is? I've tried using modify sshd_config to ignore reverse mapping, but it looks like this has been depreciated :-(

[Steven E. Protter]

When you upgrade your os the rsa signatures are no longer valid. This probably has nothing to do with your reverse lookup.

You need to delete the old entries in the $HOME/.ssh/known_hosts file for the machines you are connecting to.

The inconsistent DNS behavior is something that should be looked at as far as the DNS records, but is not the cause of the error message.

SEP

[Michael Williams_6]

Sorry - upgrade is mis-leading these were fresh built machines with a plan to upgrade our other hosts..!

I am also connecting using PuTTY from a Windows host, and there are no keys saved, but this behaviour also happens from our SLES8 hosts...

M

[Gopi Sekar]

check the routing and network configurations on the new SLES 9 servers. this might occur if the routing information is bad (non existing route) or wrong DNS configurations also.

I believe there is one variable in /proc which can be enabled/disabled to instruct kernel to reverse name look up all the IP addresses. Try to disable reverse name look up

Regards,
Gopi

[Gopi Sekar]

check in your /etc/sysctl.conf file for this key:
net.ipv4.conf.default.rp_filter = 1

if it is set to one try setting it to zero, reload sysctl by 'sysctl -p'.

The above value will disable source route verification which I believe does the reverse mapping.

Word of warning, you are touching proc file system and this change is permanent (it will be persistent even after reboot), so be ready to revert it back to old state if this does not solve your problem.

Hope this helps,
Gopi

[Michael Williams_6]

Thanks Gopi - but that is set to 0 already :-(

[Ivan Ferreira · Accepted solution]

Try editing the /etc/sshd/sshd_config file and set:

UseDNS no

Default is yes. Restart the service

service sshd reload

[Michael Williams_6]

Ivan, you are a saint - that's the puppy!

[Michael Williams_6]

All working as expected now!