Berkeley CSUA MOTD:Entry 22820
Berkeley CSUA MOTD
 
WIKI | FAQ | Tech FAQ
http://csua.com/feed/
2025/05/24 [General] UID:1000 Activity:popular
5/24    

2001/10/24-25 [Computer/SW/Security] UID:22820 Activity:moderate
10/24   My sshd used to accept connections from machines without matching
        reverse lookup.  Then, all of a sudden, today, it stopped.  I changed
        resolv.conf to use a nameserver with made up ptr records and it works
        fine, but the question remains, What changed?  There is no indication
        that sshd has been restarted since the machine was 60 days ago.  This
        is on solaris, using (foolishly) F-secure sshd 2.0-2 which is also the
        same as it has been.  (i did stop some services 2 days ago, but nothing
        that should effect this).
        \_ You've been hacked.
        \_ Maybe you have edited the hosts.allow or hosts.deny files and
           added or removed some rules on those? This would apply if sshd
           was compiled with support for tcp wrappers.
        \_ Or it actually _was_ doing reverse lookups and your DNS broke.