Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm having lots of the following HTTP requests in my Apache access log:

178.91.64.43 - - [17/May/2012:16:33:22 +0400] "\x80z\x01\x03\x01" 200 65900 "-" "-"

My site stops working because of them. So, I just block all such IPs with my csf firewall. I am on CentOS 5.8 with Apache 2.2.4.

Can you help me understand what these requests are? I am not able to google anything and just need a point from which to start in order to resolve this issue.

Thank you.

Update.

Web server is listening to the port 443.

   tcp  0    0 :::443    :::*    LISTEN      0   2686146530 19775/httpd
share|improve this question
add comment

2 Answers

up vote 6 down vote accepted

That looks like someone trying to connect using SSL to a non-SSL port (i.e. https://).

Either the connecting clients are getting something wrong, or perhaps your web server is listening on port 443, but not for SSL connections?

You could create an Apache customlog using %p somewhere in the output, and track which port those connections are actually turning up on. If they're on port 443 then your config is potentially the issue, if they're on port 80, I'm not sure what to suggest.

share|improve this answer
    
Web server does listen to the port 443 as we have a site with the SSL certificate. What should I do to prevent such connects? Could you please suggest something? –  Andrew May 17 '12 at 15:27
1  
As long as the only thing listening on 443 is a properly configured Apache vhost with SSL enabled, there's no much you can do. The assumption is something is connecting on port 80 but trying to talk SSL. –  EightBitTony May 17 '12 at 17:58
2  
I've been getting this on my server ever since I opened it up to the web. I found the same answer, some client trying to connect SSL to an unencrypted socket. You can't stop it completely because it is in effect "User Error". However I only get it for a limited number of IPs. You could just IP ban those IPs in the firewall. –  couling May 17 '12 at 18:01
add comment

It looks like someone tries to connect via ssl to non-ssl port.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.