Hey,
when going trough my vaultwarden logs i see a bunch of these messages each message with a different port. Seems to me like someone is trying to port scan. Am i correct? Do i have to worry?
[2022-07-18 10:06:40.654][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:20984 failed: received corrupt message
[2022-07-18 10:06:41.192][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:20985 failed: received corrupt message
[2022-07-18 10:06:41.697][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:20986 failed: received corrupt message
[2022-07-18 10:06:42.215][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:20987 failed: received corrupt message
[2022-07-18 10:06:42.736][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:20988 failed: received corrupt message
[2022-07-18 10:06:43.345][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:20989 failed: received corrupt message
[2022-07-18 10:06:43.962][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:20990 failed: received corrupt message
[2022-07-18 10:06:44.453][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:20991 failed: received corrupt message
[2022-07-18 10:06:44.939][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:20992 failed: received corrupt message
[2022-07-18 10:06:45.444][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:20993 failed: received corrupt message
[2022-07-18 10:06:45.948][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:20994 failed: received corrupt message
[2022-07-18 10:06:46.439][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:20995 failed: received corrupt message
[2022-07-18 10:06:46.935][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:20996 failed: received corrupt message
[2022-07-18 10:06:47.446][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:20997 failed: received corrupt message
[2022-07-18 10:06:47.959][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:20998 failed: received corrupt message
[2022-07-18 10:06:48.595][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:20999 failed: received corrupt message
[2022-07-18 10:06:49.089][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:21000 failed: received corrupt message
[2022-07-18 10:06:49.598][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:21001 failed: received corrupt message
[2022-07-18 10:06:50.109][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:21002 failed: received corrupt message
[2022-07-18 10:06:50.601][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:21003 failed: received corrupt message
[2022-07-18 10:06:51.089][rocket_http::tls::listener][WARN] tls handshake with 111.20.101.x:21004 failed: received corrupt message
I’ve already made a fail2ban ban for banning the ip if there is a bunch of it in the logs.
[INCLUDES]
before = common.conf
[Definition]
failregex = \[WARN\] tls handshake with <HOST>:\d+ failed: received corrupt message
ignoreregex =