Linode Forum
Linode Community Forums
 FAQFAQ    SearchSearch    MembersMembers      Register Register 
 LoginLogin [ Anonymous ] 
Post new topic  Reply to topic
Author Message
PostPosted: Mon Jul 25, 2011 6:55 am 
Offline
Senior Member

Joined: Wed May 13, 2009 1:32 pm
Posts: 737
Location: Italy
As title,
in my log it seems that I have a lot of Anonumous TLS connection established...

1 Anonymous TLS connection established from zulu1491.startdedicated.com[188.138.116.171]: TLSv1 with cipher ADH-AES256-SHA (256/256 bits)
1 Anonymous TLS connection established from unknown[114.202.2.139]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
1 Anonymous TLS connection established from mx.sourceforge.net[216.34.181.68]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
1 Anonymous TLS connection established from hqemgate04.nvidia.com[216.228.121.35]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
1 Anonymous TLS connection established from fan.fandolab.com[184.172.165.107]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
1 Anonymous TLS connection established from ares.shiny.it[195.210.96.31]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
1 Anonymous TLS connection established from adsl-67-113-118-6.dsl.sndg02.pacbell.net[67.113.118.6]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)



What does it means?
Is this a security issues?
Why postfix should establish a connection with this guys?


Top
   
PostPosted: Mon Jul 25, 2011 8:06 am 
Offline
Senior Member

Joined: Fri Dec 10, 2010 6:21 am
Posts: 144
sblantipodi wrote:
Why postfix should establish a connection with this guys?


From the log entries it sounds like these guys are connecting to you rather than the other way around.


Top
   
PostPosted: Mon Jul 25, 2011 8:33 am 
Offline
Senior Member

Joined: Wed May 13, 2009 1:32 pm
Posts: 737
Location: Italy
hawk7000 wrote:
sblantipodi wrote:
Why postfix should establish a connection with this guys?


From the log entries it sounds like these guys are connecting to you rather than the other way around.


I don't understood what do you want to mean?
What does it means that they are connecting to me?


Top
   
 Post subject:
PostPosted: Mon Jul 25, 2011 8:42 am 
Offline
Senior Member

Joined: Fri May 02, 2008 8:44 pm
Posts: 1121
An "anonymous TLS connection" is any TLS connection that doesn't use a client certificate. Since most TLS connections only use a server certificate, there's nothing strange about this. It's not like the client is anonymous anyway; you have their hostnames and IP addresses.

mx.sourceforge.net is a mail server. I don't know about the other ones, but if this is a Postfix log, they're probably trying to send you e-mail. Are you getting any spam from these addresses?


Top
   
 Post subject:
PostPosted: Mon Jul 25, 2011 9:13 am 
Offline
Senior Member

Joined: Wed May 13, 2009 1:32 pm
Posts: 737
Location: Italy
hybinet wrote:
An "anonymous TLS connection" is any TLS connection that doesn't use a client certificate. Since most TLS connections only use a server certificate, there's nothing strange about this. It's not like the client is anonymous anyway; you have their hostnames and IP addresses.

mx.sourceforge.net is a mail server. I don't know about the other ones, but if this is a Postfix log, they're probably trying to send you e-mail. Are you getting any spam from these addresses?


zen.spamhaus blocks spam before seeing it into my mailbox but I received some spam from this email address.

if its nothing to warry about, I'm ok.


Top
   
 Post subject:
PostPosted: Mon Jul 25, 2011 9:43 am 
Offline
Senior Member
User avatar

Joined: Sat Aug 30, 2008 1:55 pm
Posts: 1739
Location: Rochester, New York
The lines surrounding the log entries in question are key to understanding what the log entries mean. They'll tell you the sender and recipient(s), as well as the ultimate disposition for the messages. Context is everything.

_________________
Code:
/* TODO: need to add signature to posts */


Top
   
 Post subject:
PostPosted: Mon Jul 25, 2011 11:41 am 
Offline
Senior Member

Joined: Wed May 13, 2009 1:32 pm
Posts: 737
Location: Italy
hoopycat wrote:
The lines surrounding the log entries in question are key to understanding what the log entries mean. They'll tell you the sender and recipient(s), as well as the ultimate disposition for the messages. Context is everything.


That output is the output of this command:
Code:
echo "Statistics"
egrep 'postfix\/smtpd' ${LOGFILE} | egrep -v 'NOQUEUE:|connect from|client=' | sed -e 's/.*smtpd\[[0-9]*\]: //' -e 's/lost connection.*/lost connection/' -e 's/warning.*/warning/' -e 's/timeout.*/timeout/' -e 's/too many errors.*/too many errors/' -e 's/.*reject.*/other reject/' | sort | uniq -c | sort -rg


Top
   
Display posts from previous:  Sort by  
Post new topic  Reply to topic


Who is online

Users browsing this forum: No registered users and 4 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum

Search for:
Jump to:  
RSS

Powered by phpBB® Forum Software © phpBB Group