Anonymous TLS connection

Well I checked my logwatch today and noticed this

Code:

**Unmatched Entries**
        1   Jul 15 20:30:42  postfix/smtpd[9569]: Anonymous TLS connection established
from unknown[66.230.192.41]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
 
 ---------------------- Postfix End ------------------------- 

I run a couple scans like whois network-lookup and even ntop and I get host doesn't exists but when I run a traceroute it hops about 10 times then dies. And a bunch of the host names are from dalllas.(8.9.232.73 ge-6-18.car1.dallas1.level3.net) by the look at there ips i guess they are top level domain so they must be a ISP or university. Can anyone reflect on this and give me some info on how to stop it.

 

For example, to stop it, you can block that IP-address with the command:
route add -host <IP-address> reject

To undo it again, please execute:
route del -host <IP-address> reject

Where <IP-address> is the IP-address you want to block.

 

Hans, would it be possible to use fail2ban to match and block these kinds of connections?

 

I am not sure if that's possible. Maybe others can give us some advice how to handle this kind of problems.

 

Thank You for the reply. new command added to my list =)

 

I forgot about fail2ban. I have denyhost setup and that only covers ssh. I think fail2ban protects ssh, apache, proftpd, courierpop3, courierimap, sasl and a few others. There is some great tutorials on here for fail2ban and denyhost. I will definitely install it again.

 

Well it seems they are really trying to hack me... this ip is routed to the same place as the last...

Code:

**Unmatched Entries**1   Jul 17 01:36:39 postfix/smtpd[21023]: Anonymous TLS connection established
from mh1.hostmu.com[78.47.159.43]: TLSv1 with cipher ADH-AES256-SHA (256/256 bits)

but this time the system was able to run reserve lookup and I got the hostname which I have seen before.. I think on here.

 

Darm, what is all the hoobaloo ? No one is trying to "hack" you that is the howtoforge server trying to deliver mail to you.

 

well the same ips are trying to get into my ssh and radio server and why did it never come up before ??

 

if they are sshing in then thats another story but what you have shown us here so far is just mail being delivered over a TLS connection.

 

I agree thanks for the help.One more thing, Why does it come up as a unmatched entry and anonymous tls connection ?