Re: openssh-3.7.1p2 "Nasty PTR record"

From: Graham Vincent (graham_at_gpv.co.nz)
Date: 09/26/03 

Date: Fri, 26 Sep 2003 13:48:32 +1200

On Fri, 26 Sep 2003 01:20:36 +0200, peter pilsl wrote:

> Graham Vincent wrote:
>
>> Hello.
>>
>> I've just upgraded openssh on my server from 3.6.1p1 to 3.7.1.p1
>> and now to 3.7.1.p2
>>
>> When I ssh into the box it is generating the following message in
>> /var/log/secure:
>>
>> Sep 26 09:44:23 starship sshd[24746]: Accepted password for fred
>> from 192.168.1.5 port 32772 ssh2
>> Sep 26 09:44:23 starship sshd[24746]: Nasty PTR record
>> "ufo.gpv.co.nz" is set up for 192.168.1.5, ignoring
>>
>> (names and numbers changed due to paranoia).
>>
>> This seems to be coming from the canohost.c file in the ssh source
>> and hasn't occurred with previous versions of ssh on this box.
>>
>> I'm running bind-9.2.2 (on the same machine) and as far as I can
>> tell everything is fine with the configuration files. Apart from
>> the message everything seems to be working OK.
>>
>
> resolving for the mentioned name and ip are ok ?
>
> dig hostname
> dig -x ip
>
> it looks like if sshd has some problems to reverselookup the hostname or
> the lookups do not match or so ..
>

Looks OK to me:

; <<>> DiG 9.2.2 <<>> ufo.gpv.co.nz
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52938
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;ufo.gpv.co.nz. IN A

;; ANSWER SECTION:
ufo.gpv.co.nz. 1 IN A 192.168.1.5

;; AUTHORITY SECTION:
gpv.co.nz. 1 IN NS starship.gpv.co.nz.

;; ADDITIONAL SECTION:
starship.gpv.co.nz. 1 IN A 192.168.1.4

;; Query time: 7 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fri Sep 26 13:40:13 2003
;; MSG SIZE rcvd: 86

; <<>> DiG 9.2.2 <<>> -x 192.168.1.5
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20939
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;5.1.168.192.in-addr.arpa. IN PTR

;; ANSWER SECTION:
5.1.168.192.in-addr.arpa. 86400 IN PTR ufo.gpv.co.nz.

;; AUTHORITY SECTION:
1.168.192.in-addr.arpa. 86400 IN NS starship.gpv.co.nz.

;; ADDITIONAL SECTION:
starship.gpv.co.nz. 1 IN A 192.168.1.4

;; Query time: 8 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fri Sep 26 13:40:23 2003
;; MSG SIZE rcvd: 110

I forgot to mention that there were no special options selected
when I built ssh - just a ./configure;make;make install.

Graham

Relevant Pages

  • Re: openssh-3.7.1p2 "Nasty PTR record"
    ... >> This seems to be coming from the canohost.c file in the ssh source ... ;; global options: printcmd ... ;; MSG SIZE rcvd: 86 ...
    (comp.security.ssh)
  • Re: newb question about zsh
    ... > I get the 'Sorry' msg. ... I'll be a barbecued monkey's butt!! ... I can su via ssh, ... wrong password, so I tried many times, on two separate boxes. ...
    (comp.unix.bsd.openbsd.misc)
  • Re: NIC NETDEV WATCHLOG strange error
    ... max4 wrote in news:Xns946E6AEDBECADmaxnowherecom@ ... > i got a msg ... > i had to reboot twice so that i can connect again via ssh ...
    (comp.os.linux.hardware)
  • Re: Unix & Linux Security Log Format ??
    ... > the only type of msg that indicates illegal intrusion..... ... No, that means somebody tried to ssh in as root, and didn't get the ... Much more likely is an attempt to buffer-overflow a known hole in some ...
    (comp.security.unix)