TLS handshaking: SSL_accept() failed: error:1407609C:SSL

Discussion in 'General' started by artur_gib, Jul 29, 2012.

  1. artur_gib

    artur_gib New Member

    Hello

    I am using ISPConfig 3.0.4.6, Ubuntu Server 12.04. For the last 2 days I've noticed connections from various ip addresses (dovcot pop3/imap) but without login attempts. After every time there is an error message about TLS handshaking. I tried to google it but no success. Please have a look at the log:

    Jul 29 11:00:02 mail dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
    Jul 29 11:00:02 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
    Jul 29 11:00:03 mail postfix/smtpd[2685]: connect from localhost.localdomain[127.0.0.1]
    Jul 29 11:00:03 mail postfix/smtpd[2685]: lost connection after CONNECT from localhost.localdomain[127.0.0.1]
    Jul 29 11:00:03 mail postfix/smtpd[2685]: disconnect from localhost.localdomain[127.0.0.1]
    Jul 29 11:02:21 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=120.35.35.243, lip=192.168.1.10, TLS handshaking: SSL_accept() failed: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request
    Jul 29 11:05:01 mail postfix/smtpd[3081]: connect from localhost.localdomain[127.0.0.1]
    Jul 29 11:05:01 mail dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
    Jul 29 11:05:01 mail postfix/smtpd[3081]: lost connection after CONNECT from localhost.localdomain[127.0.0.1]
    Jul 29 11:05:01 mail postfix/smtpd[3081]: disconnect from localhost.localdomain[127.0.0.1]
    Jul 29 11:05:01 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
    Jul 29 11:05:04 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=153.19.196.4, lip=192.168.1.10, TLS handshaking: SSL_accept() failed: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request
    Jul 29 11:10:01 mail postfix/smtpd[3175]: connect from localhost.localdomain[127.0.0.1]
    Jul 29 11:10:01 mail dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
    Jul 29 11:10:01 mail postfix/smtpd[3175]: lost connection after CONNECT from localhost.localdomain[127.0.0.1]
    Jul 29 11:10:01 mail postfix/smtpd[3175]: disconnect from localhost.localdomain[127.0.0.1]
    Jul 29 11:10:01 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
    Jul 29 11:15:02 mail dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
    Jul 29 11:15:02 mail postfix/smtpd[3251]: connect from localhost.localdomain[127.0.0.1]
    Jul 29 11:15:02 mail postfix/smtpd[3251]: lost connection after CONNECT from localhost.localdomain[127.0.0.1]
    Jul 29 11:15:02 mail postfix/smtpd[3251]: disconnect from localhost.localdomain[127.0.0.1]
    Jul 29 11:15:02 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
    Jul 29 11:20:02 mail postfix/smtpd[3322]: connect from localhost.localdomain[127.0.0.1]
    Jul 29 11:20:02 mail dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
    Jul 29 11:20:02 mail postfix/smtpd[3322]: lost connection after CONNECT from localhost.localdomain[127.0.0.1]
    Jul 29 11:20:02 mail postfix/smtpd[3322]: disconnect from localhost.localdomain[127.0.0.1]
    Jul 29 11:20:02 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
    Jul 29 11:25:01 mail dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
    Jul 29 11:25:01 mail postfix/smtpd[3391]: connect from localhost.localdomain[127.0.0.1]
    Jul 29 11:25:01 mail postfix/smtpd[3391]: lost connection after CONNECT from localhost.localdomain[127.0.0.1]
    Jul 29 11:25:01 mail postfix/smtpd[3391]: disconnect from localhost.localdomain[127.0.0.1]
    Jul 29 11:25:01 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
    Jul 29 11:29:58 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=85.103.173.6, lip=192.168.1.10, TLS handshaking: SSL_accept() failed: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request
    Jul 29 11:30:01 mail dovecot: imap-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
    Jul 29 11:30:01 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=127.0.0.1, lip=127.0.0.1, secured
    Jul 29 11:30:01 mail postfix/smtpd[3467]: connect from localhost.localdomain[127.0.0.1]
    Jul 29 11:30:01 mail postfix/smtpd[3467]: lost connection after CONNECT from localhost.localdomain[127.0.0.1]
    Jul 29 11:30:01 mail postfix/smtpd[3467]: disconnect from localhost.localdomain[127.0.0.1]
    Jul 29 11:30:15 mail dovecot: pop3-login: Disconnected (no auth attempts): rip=180.112.0.106, lip=192.168.1.10, TLS handshaking: SSL_accept() failed: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request

    Any idea what it is?

    Thanks for help

    Artur
     
  2. pititis

    pititis Member

    Hello,

    Don't worry. That's a guy/scan drone sending http headers like "GET /" to your pop3/imap server.

    Cheers
     
  3. artur_gib

    artur_gib New Member

    Thank you very much. I thought so but wasn't sure.

    Artur
     

Share This Page