Bug#395535: the error is in the hosts.deny file
The error is in the hosts.deny file.
It should be:
The "PARANOID" "client" is described thusly in the man page (hosts_access):
"Matches any host whose name does not match its address."
This means if the host is in the DNS server, it will happily connect. This
apears that ssh is not paying attention to the hosts.deny file.
This is probably not what you want.
Jean Robertson, McGill University (514) 398-8117