| View previous topic :: View next topic |
| Author |
Message |
eddieparker
Tux's lil' helper
Joined: 09 Sep 2004
Posts: 147
|
 Posted: Wed Dec 19, 2007 7:13 pm Post subject: postfix/smtpd: hex dump in log |
 |
|
Hey!
I've been trying to solve this for a while now, but Google just ain't helping me out.
I've recently switched to using logsentry, which gleefully sends me e-mails on every weird occurrence in my logs -- for which I'm grateful.
However, I'm noticing a lot of spam in my logs from postfix/smtpd, with what appears to be SSL related stuff:
| Code: |
Dec 18 16:15:27 [postfix/smtpd] initializing the server-side TLS engine
Dec 18 16:15:27 [postfix/smtpd] connect from [connection-point]
Dec 18 16:15:28 [postfix/smtpd] setting up TLS connection from [connection-point]
Dec 18 16:15:28 [postfix/smtpd] SSL_accept:before/accept initialization
Dec 18 16:15:28 [postfix/smtpd] read from 080C6C78 [080D2740] (11 bytes => -1 (0xFFFFFFFF))
Dec 18 16:15:28 [postfix/smtpd] SSL_accept:error in SSLv2/v3 read client hello A
Dec 18 16:15:28 [postfix/smtpd] read from 080C6C78 [080D2740] (11 bytes => 11 (0xB))
Dec 18 16:15:28 [postfix/smtpd] 0000 16 03 01 00 a9 01 00 00|a5 03 01 ........ ...
Dec 18 16:15:28 [postfix/smtpd] read from 080C6C78 [080D274B] (163 bytes => -1 (0xFFFFFFFF))
Dec 18 16:15:28 [postfix/smtpd] SSL_accept:error in SSLv3 read client hello B
- Last output repeated twice -
Dec 18 16:15:28 [postfix/smtpd] read from 080C6C78 [080D274B] (163 bytes => 163 (0xA3))
Dec 18 16:15:28 [postfix/smtpd] 0000 00 01 a7 36 ab 22 61 38|5d 70 7b c1 ba 06 a6 40 ...6."a8 ]p{....@
Dec 18 16:15:28 [postfix/smtpd] 0010 8a 2c ee 95 9f 1e 54 14|e8 4e 6d 7c 1c 67 73 fc .,....T. .Nm|.gs.
Dec 18 16:15:28 [postfix/smtpd] 0020 20 1d e8 4f 5a 9a b4 16|53 a1 34 6b f4 9d fd e9 ..OZ... S.4k....
Dec 18 16:15:28 [postfix/smtpd] 0030 7d b9 d1 3e be 86 ff d9|0e f9 74 e5 31 90 51 d9 }..>.... ..t.1.Q.
Dec 18 16:15:28 [postfix/smtpd] 0040 a9 00 38 c0 0a c0 14 00|39 00 38 c0 0f c0 05 00 ..8..... 9.8.....
Dec 18 16:15:28 [postfix/smtpd] 0050 35 c0 07 c0 09 c0 11 c0|13 00 33 00 32 c0 0c c0 5....... ..3.2...
Dec 18 16:15:28 [postfix/smtpd] 0060 0e c0 02 c0 04 00 04 00|05 00 2f c0 08 c0 12 00 ........ ../.....
Dec 18 16:15:28 [postfix/smtpd] 0070 16 00 13 c0 0d c0 03 fe|ff 00 0a 01 00 00 24 00 ........ ......$.
Dec 18 16:15:28 [postfix/smtpd] 0080 00 00 0e 00 0c 00 00 09|6c 6f 63 61 6c 68 6f 73 ........ localhos
Dec 18 16:15:28 [postfix/smtpd] 0090 74 00 0a 00 08 00 06 00|17 00 18 00 19 00 0b 00 t....... ........
Dec 18 16:15:28 [postfix/smtpd] 00a0 02 01 ..
Dec 18 16:15:28 [postfix/smtpd] 00a2 - <SPACES/NULLS>
Dec 18 16:15:28 [postfix/smtpd] SSL_accept:SSLv3 read client hello B
Dec 18 16:15:28 [postfix/smtpd] SSL_accept:SSLv3 write server hello A
Dec 18 16:15:28 [postfix/smtpd] SSL_accept:SSLv3 write certificate A
Dec 18 16:15:28 [postfix/smtpd] SSL_accept:SSLv3 write key exchange A
Dec 18 16:15:28 [postfix/smtpd] SSL_accept:SSLv3 write server done A
|
What worries me mostly is the giant hex dump. (This is one of the smaller sections). Is there any reason this is occuring? From the log, I can't see why it's doing this, and it would be a major pain to filter out - besides which, I'm assuming it's indicative of an error of some sort.
Can someone kindly point me in the right direction?
Potentially useful information:
- I'm using courier-imap-ssl, postfix, with a self-signed cert
- I'm tunneling using PuTTY, so all my connections come from 'localhost'
- ... That's all I can think of. |
|
| Back to top |
|
 |
eddieparker
Tux's lil' helper
Joined: 09 Sep 2004
Posts: 147
|
| Posted: Thu Dec 20, 2007 2:18 am Post subject: |
|
|
Ah, so some more Googling has helped: this page [1] seems to describe my issue:
| Code: |
# To get additional information during the TLS setup and negotiations
# you can increase the loglevel from 0..4:
# 0: No output about the TLS subsystem
# 1: Printout startup and certificate information
# 2: 1 + Printout of levels during negotiation
# 3: 2 + Hex and ASCII dump of negotiation process
# 4: 3 + Hex and ASCII dump of complete transmission after STARTTLS
# Use loglevel 3 only in case of problems. Use of loglevel 4 is strongly
# discouraged.
#
# smtpd_tls_loglevel = 0
|
It seems to be set to '3' in mine. Is that really a sane default? (I'm just asking - I'm no network guru)
Anyhow, before that I still seem to be getting my "SSL_accept:error in SSLv2/v3 read client hello A". Letsee if Google can help me with that, or if someone else can point me in the right direction.
Thanks!
-e-
[1] http://www.aet.tu-cottbus.de/personen/jaenicke/postfix_tls/doc/conf.html |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Networking & Security
