SSHD reverse mapping fails, but nslookup, dig, and host resolve correctly

Question

I just set up a dhcp/dns server to manage my home network. After I got everything up and running (and maybe before - I wasn't paying close attention), I noticed that logging into ssh was slow. I started sshd in debug mode with /sbin/sshd -ddd and fired up a second PuTTy instance.

Of course, the culprit was immediately obvious:

debug3: Trying to reverse map address 10.0.0.22.
reverse mapping checking getaddrinfo for mt.local [10.0.0.22] failed - POSSIBLE BREAK-IN ATTEMPT!

It couldn't reverse map my IP to my hostname. Which is peculiar, considering that the DNS records are all in order according to nslookup:

[root@media] # nslookup mt.local
Server:        10.0.0.2
Address:       10.0.0.2#53

Name:   mt.local
Address: 10.0.0.22

[root@media] # nslookup 10.0.0.22
Server:        10.0.0.2
Address:       10.0.0.2#53

22.0.0.10.in-addr.arpa  name = mt.local

host:

[root@media] # host mt.local
mt.local has address 10.0.0.22
[root@media] # host 10.0.0.22
22.0.0.10.in-addr.arpa domain name pointer mt.local.

and dig:

[root@media] # dig mt.local

; <<>> DiG 9.9.4-P2-RedHat-9.9.4-12.P2.fc20 <<>> mt.local
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12144
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;mt.local.                      IN      A

;; ANSWER SECTION:
mt.local.               300     IN      A       10.0.0.22

;; AUTHORITY SECTION:
local.                  300     IN      NS      media.local.

;; ADDITIONAL SECTION:
media.local.            300     IN      A       10.0.0.2

;; Query time: 0 msec
;; SERVER: 10.0.0.2#53(10.0.0.2)
;; WHEN: Tue Jul 15 23:02:34 EDT 2014
;; MSG SIZE  rcvd: 89

[root@media] # dig -x 10.0.0.22

; <<>> DiG 9.9.4-P2-RedHat-9.9.4-12.P2.fc20 <<>> -x 10.0.0.22
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5476
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;22.0.0.10.in-addr.arpa.                IN      PTR

;; ANSWER SECTION:
22.0.0.10.in-addr.arpa. 300     IN      PTR     mt.local.

;; AUTHORITY SECTION:
0.0.10.in-addr.arpa.    300     IN      NS      media.local.

;; ADDITIONAL SECTION:
media.local.            300     IN      A       10.0.0.2

;; Query time: 1 msec
;; SERVER: 10.0.0.2#53(10.0.0.2)
;; WHEN: Tue Jul 15 23:03:59 EDT 2014
;; MSG SIZE  rcvd: 109

And, for the sake of verbosity, my /etc/resolv.conf:

search local
nameserver 10.0.0.2

I can't find any reason that reverse mapping should fail. And I can't find any reason for it to hang so long before it does fail - the DNS server is only 0.5 ms away.

Yeah, I know I could just turn reverse mapping off, but that's not really the point. I appreciate any and all assistance!

I should probably note that this is on a 10.0.0.0/24 network; modem/gateway is at 10.0.0.1; dns/dhcp/the box I'm talking about (media) is at 10.0.0.2; and my desktop (mt) is at 10.0.0.22. Local domain is .local, and I have reverse DNS mapping tied to DHCP.

Answer 1

The problem turned out to be both simple and stupid, and was caused by operator error. Apparently, in my infinite wisdom, I had the following configuration (in my dhcpd.conf) for the static lease for mt:

host mightyturing {
     hardware ethernet <MAC>;
     option host-name "mightyturing";
     ddns-hostname "mt";
     fixed-address 10.0.0.22;
};

So SSHD was right - the reverse map doesn't match the set hostname. Changing the ddns-hostname to "mightyturing" fixed it. Changing option host-name to mt probably would have worked as well.

At least, I think that was the problem... it stopped hanging after fixing the dhcp config and renewing my IP.

Regardless, thank you all for your time :)

Answer 2

.local is often considered a 'special' domain. avahi/bonjour/mdns etc use it as the domain name, and while you don't say what you are using to serve DNS, I guess it's not avahi.

What does the 'hosts' line in /etc/nsswitch.conf look like?

nslookup, host, and dig will be using your configured resolvers, however ssh will be using nsswitch.conf, which will give it a list of options to step through. One of those options may be mdns or mdns4, eg:

hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4 mdns

I suggest either changing your local domain name to something other than .local, or removing any mdns* entries from the hosts: line in nsswitch.conf, eg:

hosts:          files dns