> I assume the point is that if you care about who's connecting, you > should set the option which only allows known host keys to connect. > If you don't, then you probably shouldn't care about reverse-lookups > matching particularly... The two "authentication" methods are mutually independent. For example, I may be able to steal a host key and fudge my PTR record, but if PARANOID is on, I can't get in unless the forward matches.