What is \u201cSSH: POSSIBLE BREAK-IN ATTEMPT!\u201d? You may receive such a warning message when you SSH to a remote host. It is not as threatening as it sounds. When you SSH to a host, a series of checks are made to make sure you are connecting to the host you are expecting to connect to. SSH does a reverse mapping on the IP you are connecting to, to see if the hostname of that server is pointing to the same IP, if it isn\u2019t, you will see the warning message \u201creverse mapping checking getaddrinfo for \u2026 POSSIBLE BREAK-IN ATTEMPT!\u201d<\/p>\n
For example, when you try to SSH to a host, you will enter something like: You can see above that we are connecting to the IP 1.1.1.1 whose hostname is abc.example.com, which isn\u2019t pointing back to the IP resulting in a warning message. Same applies the other way round, if you try to SSH to the hostname i.e. \u201cabc.example.com\u201d who\u2019s IP is 1.1.1.1, it check the reverse DNS of the IP and if it isn\u2019t pointing back to \u201cabc.example.com\u201d, you will receive the warning message.<\/p>\n If you see the \u201cPOSSIBLE BREAK-IN ATTEMPT!\u201d messages in your auth.log file it can mean someone may be trying to brute force in and you should take necessary steps to tighten the security of your server.<\/p>\n","protected":false},"excerpt":{"rendered":" What is \u201cSSH: POSSIBLE BREAK-IN ATTEMPT!\u201d? You may receive such a warning message when you SSH to a remote host. It is not as threatening as it sounds. When you SSH to a host, a series of checks are made to make sure you are connecting to the host you are expecting to connect to…. <\/p>\n
\n
\nssh root@1.1.1.1
\n<\/code>
\nand see something like:
\n
\nConnecting to 1.1.1.1
\nreverse mapping checking getaddrinfo for abc.example.com failed - POSSIBLE BREAK-IN ATTEMPT!
\nroot@abc.example.com\u2019s password:
\n<\/code><\/p>\n