HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials

HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials (http://www.howtoforge.com/forums/index.php)
-   General (http://www.howtoforge.com/forums/forumdisplay.php?f=25)
-   -   TLS handshaking: SSL_accept() failed: error:1407609C:SSL (http://www.howtoforge.com/forums/showthread.php?t=58116)

artur_gib 29th July 2012 12:16

TLS handshaking: SSL_accept() failed: error:1407609C:SSL
 
Hello

I am using ISPConfig 3.0.4.6, Ubuntu Server 12.04. For the last 2 days I've noticed connections from various ip addresses (dovcot pop3/imap) but without login attempts. After every time there is an error message about TLS handshaking. I tried to google it but no success. Please have a look at the log:

Jul 29 11:00:02 mail dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jul 29 11:00:02 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jul 29 11:00:03 mail postfix/smtpd[2685]: connect from localhost.localdomain[127.0.0.1]
Jul 29 11:00:03 mail postfix/smtpd[2685]: lost connection after CONNECT from localhost.localdomain[127.0.0.1]
Jul 29 11:00:03 mail postfix/smtpd[2685]: disconnect from localhost.localdomain[127.0.0.1]
Jul 29 11:02:21 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=120.35.35.243, lip=192.168.1.10, TLS handshaking: SSL_accept() failed: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request
Jul 29 11:05:01 mail postfix/smtpd[3081]: connect from localhost.localdomain[127.0.0.1]
Jul 29 11:05:01 mail dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jul 29 11:05:01 mail postfix/smtpd[3081]: lost connection after CONNECT from localhost.localdomain[127.0.0.1]
Jul 29 11:05:01 mail postfix/smtpd[3081]: disconnect from localhost.localdomain[127.0.0.1]
Jul 29 11:05:01 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jul 29 11:05:04 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=153.19.196.4, lip=192.168.1.10, TLS handshaking: SSL_accept() failed: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request
Jul 29 11:10:01 mail postfix/smtpd[3175]: connect from localhost.localdomain[127.0.0.1]
Jul 29 11:10:01 mail dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jul 29 11:10:01 mail postfix/smtpd[3175]: lost connection after CONNECT from localhost.localdomain[127.0.0.1]
Jul 29 11:10:01 mail postfix/smtpd[3175]: disconnect from localhost.localdomain[127.0.0.1]
Jul 29 11:10:01 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jul 29 11:15:02 mail dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jul 29 11:15:02 mail postfix/smtpd[3251]: connect from localhost.localdomain[127.0.0.1]
Jul 29 11:15:02 mail postfix/smtpd[3251]: lost connection after CONNECT from localhost.localdomain[127.0.0.1]
Jul 29 11:15:02 mail postfix/smtpd[3251]: disconnect from localhost.localdomain[127.0.0.1]
Jul 29 11:15:02 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jul 29 11:20:02 mail postfix/smtpd[3322]: connect from localhost.localdomain[127.0.0.1]
Jul 29 11:20:02 mail dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jul 29 11:20:02 mail postfix/smtpd[3322]: lost connection after CONNECT from localhost.localdomain[127.0.0.1]
Jul 29 11:20:02 mail postfix/smtpd[3322]: disconnect from localhost.localdomain[127.0.0.1]
Jul 29 11:20:02 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jul 29 11:25:01 mail dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jul 29 11:25:01 mail postfix/smtpd[3391]: connect from localhost.localdomain[127.0.0.1]
Jul 29 11:25:01 mail postfix/smtpd[3391]: lost connection after CONNECT from localhost.localdomain[127.0.0.1]
Jul 29 11:25:01 mail postfix/smtpd[3391]: disconnect from localhost.localdomain[127.0.0.1]
Jul 29 11:25:01 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jul 29 11:29:58 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=85.103.173.6, lip=192.168.1.10, TLS handshaking: SSL_accept() failed: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request
Jul 29 11:30:01 mail dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jul 29 11:30:01 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
Jul 29 11:30:01 mail postfix/smtpd[3467]: connect from localhost.localdomain[127.0.0.1]
Jul 29 11:30:01 mail postfix/smtpd[3467]: lost connection after CONNECT from localhost.localdomain[127.0.0.1]
Jul 29 11:30:01 mail postfix/smtpd[3467]: disconnect from localhost.localdomain[127.0.0.1]
Jul 29 11:30:15 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=180.112.0.106, lip=192.168.1.10, TLS handshaking: SSL_accept() failed: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request

Any idea what it is?

Thanks for help

Artur

pititis 29th July 2012 21:32

Hello,

Don't worry. That's a guy/scan drone sending http headers like "GET /" to your pop3/imap server.

Cheers

artur_gib 3rd August 2012 08:57

Thank you very much. I thought so but wasn't sure.

Artur


All times are GMT +2. The time now is 23:30.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.