reverse mapping checking getaddrinfo failed - POSSIBLE BREAK-IN ATTEMPT!

Weird problem has just developed.I was trying to port tunnel via relay through an intermediate ssh server. I have to do this because I got tired of script kiddie attacks filling my secure.log so I use port ≠ 22 at home. But my employer's preventers of information services block outbound traffic to destination ports other than the well known ports (and some well known ports too). So I have to ssh to an intermediate server then from there I can ssh to home, like this:

from work:
ssh -L10548:localhost:50548 intermediate.server.com
from intermediate server:
ssh -p56789 -L50548:localhost:548 home.network.com

The ssh session sets up just fine and I have full shell access to home. But when I try to ⌘k to afp://localhost:10548 I get a pair of error messages in the shell that says:

channel 4: open failed: administratively prohibited: open failed
channel 5: open failed: administratively prohibited: open failed

(the channel numbers change but the message is the same)

This worked just fine as recently as maybe two weeks ago (the last time I did this) and had been working fine for years. I can't think of a darned thing that I may have done to anything to have changed anything.

On the machine at home to which I am trying to afp, it's /var/log/secure.log has some entries, that correspond to the time of my remote login (uses DSA key exchange), that read:

Sep 14 07:55:11 iMac sshd[614]: reverse mapping checking getaddrinfo for intermediateServerHostName [intermediate.Server.IP.address] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep 14 07:55:20 iMac sshd[614]: Accepted publickey for jv from intermediate.Server.IP.address port 25553 ssh2

Again, the shell session is successful, that's how I retrieved this info out of secure.log. It's just the forward port tunnels that aren't working. Although, the nastygram is annoying...

I get the same reverse mapping nastygram when concatenating the two ssh commands without "-L" port forward tunnel option.

Not seeing this behavior when connecting from another machine on the same home network with no intermediate server.

I tried a lot of different things last night, so my memory is a little fuzzy now, but I think I was successful with tunneled AFP mount when connecting from a home machine to another machine on the home network acting as an intermediate server. But when connecting from home machine to this (external) intermediate server then back into home network, I got the same nastygram and failure to ⌘k to afp://localhost:10548. At least I think that I seem to recall that that's what happened...

Looks like something to do with reverse mapping of something to this particular (and only one available to me and that I would trust) intermediate server but not exactly sure what it all means or how to fix it. So, does anyone have a clue what might be going on that would be allowing me to have a full access shell session but unable to tunnel ports all of a sudden? What is this reverse mapping nastygram? Is there something like a known_hosts file that I could delete? (I already took out all my .ssh/known_hosts files at the remote client, intermediate server and home ssh server, that didn't help).

Thanks

2008 Mac Pro (10.6.4), 2008 MacBook aluminum (10.6.4), 2007 iMac (10.6.4), and, 2001 Quicksilver (10.5.8)

Posted on Sep 14, 2010 7:30 AM

Reply
9 replies

Sep 14, 2010 5:18 PM in response to j.v.

The reverse mapping relates purely to reverse DNS lookups of the respective hostnames/IP addresses.

Somewhere along the line the reverse lookup for the intermediate server changed, and that's what's generating those messages. I wouldn't expect it to break the tunneling, but stranger things have been known to happen. 🙂

Sep 14, 2010 5:31 PM in response to j.v.

j.v. wrote:
I tried a lot of different things last night, so my memory is a little fuzzy now, but I think I was successful with tunneled AFP mount when connecting from a home machine to another machine on the home network acting as an intermediate server.

Redid this just a few minutes ago, so yes, my recollection was accurate.
But when connecting from home machine to this (external) intermediate server then back into home network, I got the same nastygram and failure to ⌘k to afp://localhost:10548.

Redid this just a few minutes ago, too, and that recollection was accurate as well.
Same ol' reverse mapping nastygram....

Sep 14, 2010 5:58 PM in response to Camelot

So ssh depends on reverse DNS? Is this something that my ssh server would be storing and comparing against on subsequent ssh connections?
Somewhere along the line the reverse lookup for the intermediate server changed

What does this mean? Is this reverse lookup the same as
dig +short {intermediate server name}

and then
dig +short -x {returned IP address from above "dig" of intermediate server name}

and comparing the initial input to the final answer?

When I do that, I get two host names back for the dig -x, the first is the one I use, and the second one is an old deprecated host name. This "dig/dig -x" routine has returned two host names like that for at least a year. But is that what a reverse DNS lookup is doing? Or is this an ssh function confined to the ssh server (and being stored in some obscure file someplace on the ssh server? Not that it necessarily means anything, but work and home are using different DNS and shell connections from both locations are exhibiting the same behavior. I hate to lose the connection capability and would hate to have a similar thing happen when directly connecting from my personal laptop when on the road (gotta tunnel my mail client through localhost:10025 and localhost:10143 through ssh in order to access my home mail server)

Thanx, Camelot, for your help!

Sep 27, 2010 11:28 AM in response to j.v.

Do these .ssh/config options help?

man ssh_config
...
CheckHostIP
If this flag is set to ``yes'', ssh(1) will additionally check
the host IP address in the known_hosts file. This allows ssh to
detect if a host key changed due to DNS spoofing. If the option
is set to ``no'', the check will not be executed. The default is
``yes''.
...
VerifyHostKeyDNS
Specifies whether to verify the remote key using DNS and SSHFP
resource records. If this option is set to ``yes'', the client
will implicitly trust keys that match a secure fingerprint from
DNS. Insecure fingerprints will be handled as if this option was
set to ``ask''. If this option is set to ``ask'', information on
fingerprint match will be displayed, but the user will still need
to confirm new host keys according to the StrictHostKeyChecking
option. The argument must be ``yes'', ``no'', or ``ask''. The
default is ``no''. Note that this option applies to protocol
version 2 only.
See also VERIFYING HOST KEYS in ssh(1).
...

Oct 1, 2010 11:12 PM in response to BobHarris

Aren't these (ssh_config) options client configuration settings? I'm seeing these errors in the final end server's /var/log/secure.log so would initially suspect a setting in ssh d_config, but don't really recognize a viable candidate in sshd_config.

It may just be that access from work via concatenating connections through this particular intermediate ssh server is impossible, but at least direct access when on the road still works fine. All I can figure is that I am screwed when trying to do a concatenated session via this particular intermediate server, and that there must be a connection between this reverse mapping failure and the fact that
dig +short -x `dig +short $remotehostname`
returns two host names, the current hostname $remotehostname and a deprecated host name $deprecatedhostname (although when I
dig +short $deprecatedhostname
that returns a null string. Must be a misconfigured DNS over which I have no control. Frustrating....

Oct 2, 2010 7:32 AM in response to j.v.

I've got 2 1/2 more ideas.

1) If you invoked your ssh session using -v -v -v (3 -v's),
and then make your AFP connection, does ssh session issue
any additional diagnostic information?

1.5) Make your first ssh session without the -v's, BUT
start the 2nd ssh session on the intermediate system using
-v -v -v. Again does the middle ssh session issue any
additional diagnostic information when you make your AFP
connection?

2) What happens if you use a single ssh connection with
a different tunnel:

ssh -L10548:home.network.com:548 intermediate.server.com
open afp://localhost:10548

WARNING: you may want to reject this idea (except as an experiment)
because you ONLY have a secure tunnel from your local Mac to
intermediate.server.com, and from their intermediate.server.com is
just port forwarding your connection request to home.network.com
port 548. If intermediate.server.com to home.network.com is over
the public Internet, then this is the part you would prefer having
encrypted in a tunnel, but alas the above tunnel only goes half way.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

reverse mapping checking getaddrinfo failed - POSSIBLE BREAK-IN ATTEMPT!

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.