Bug#989276: openssh-server: unhelpful error message when fail to reverse look up client IP during HostbasedAuthentication because UseDNS is off

Package: openssh-server
Version: 1:8.4p1-5
Tags: upstream

Dear maintainers,

When doing host-based authentication, sshd tries to look up the hostname
of the IP that's connecting and compares it to the hostname the client
sends, but if UseDNS is off (as it is by default), this will always
fail.  So if you're using host-based authentication you need to either
turn UseDNS on or disable the reverse look up.

The error message that you get in this situation, however, is not likely
to lead you to do one of those two things:

sshd[2540]: userauth_hostbased mismatch: client sends HOSTNAME, but we resolve 128.100.X.Y to 128.100.X.Y

To most readers, this suggests that a look up is being performed but is
failing to return any hostname, so the user is likely to start looking
at their /etc/hosts.  But the problem is actually that sshd is not even
trying to perform any look up.

Further discussion:
https://utcc.utoronto.ca/~cks/space/blog/sysadmin/OpenSSHUseDNSErrorAnnoyance

-- 
Sean Whitton

-----BEGIN PGP SIGNATURE-----

iQJNBAEBCgA3FiEEm5FwB64DDjbk/CSLaVt65L8GYkAFAmC0D68ZHHNwd2hpdHRv
bkBzcHdoaXR0b24ubmFtZQAKCRBpW3rkvwZiQD3ZD/40TjAezJn3CniqlvZaUVai
BL8TanvI013Mt5e3aALhHnWuVtzGrLpzJyh6RF5t5+AaVQWJHlwFWWPNSBr3Wjd2
bcKIEAnz3lxW5UgmaJDlCQkZwGm/nO4HIj1RPotVNvaSCJem2KvMjo5J7Wf1gKIV
T2DC1skxUESW0wGwlPDbk48ikfW6XnHx9ncXb9VW/ucivR1hnjwAM5Uyuc2gZ9Nh
ilUSP/ZizC+28J61Qso98tgY+JPcX59z1V4yYptCU/BJSfO81xByvvTTodRcWmKY
1WpPuaE1Gqd7SimfO35o5k6Yjzwz2irWj/5k7seRRmVSeTq23t6oz504MZZZ81ES
oSIsVi+1uJK915n6wPQOMlBN1wYs9s29Zlcaf9WHA/rKK/DwiWgD62wj+l/yLffx
JNhFNwOa9n0UTww10aDiHuXpKTbYprb3zLtjXsKsyS2BjIWhckfIOykXrAoCoo3/
8rmhI+bchcYVOX8diCDwoVOEQpDZZziaVeNWHEHEBdbfgESfvT1fpcmLd09F66b7
dAzEwHIeUx2F50eNO299Uz0RgX/c/XWDlaHErcB4T3B/G4b7RdQdhMhAgpzdkrfn
KVBj00GnGSsG53qo5oKq9DAhQ2JX2K89I0WrwpY7dyTd1sA6Bi08nwlBkjwGN127
gOz+cnd4wddRyUV5fCllNQ==
=Pwo+
-----END PGP SIGNATURE-----