reverse mapping attempts

[lightman47]

In the last week or two I have begun accumulating /var/log/secure entries like this with varying addresses:

sshd[8569]: reverse mapping checking getaddrinfo for 190-48-2-231.speedy.com.ar [190.48.2.231] failed - POSSIBLE BREAK-IN ATTEMPT!

It appears that Fail2ban is catching and banning them. This Apache/vstp/ssh server with no root access also runs denyhosts. Need I worry? - I guess the capital-letter warning raises my curiosity. I also realize that 'caught' attempts are a good thing.

Thank you.

[avij]

Code: Select all

$ host 190.48.2.231
231.2.48.190.in-addr.arpa domain name pointer 190-48-2-231.speedy.com.ar.

$ host 190-48-2-231.speedy.com.ar
Host 190-48-2-231.speedy.com.ar not found: 3(NXDOMAIN)

Although there is a reverse DNS entry for that IP address, the returned name does not point to the same IP address. This is the reason for the warning. I don't think you should be particularly worried about those.

[lightman47]

Yeh, the bots are pounding me regularly; I just hadn't seen this particular one until recently and got 'nervous".

Thanks.