SAV for Linux Outbound Ports Required

Hello Ng ZhiYun,

updating should work then unless curl is more liberal regarding SSL connections. If Sophos updating still fails you should check the certificate on the SSL connection.

Christian

Hi

Do you know how to check which and where is the cert that the sophos AV is using?

Also another thing that i notice is that.

I am able to run the update manually but if scheduled it will have the error when only port 443 is enabled

Hello Hello Ng ZhiYun,,

manual and scheduled updates should use the same mechanism, can't imagine that one constantly fails and the other succeeds. Wonder if there are significant differences in the log (other than success/failure).

Furthermore, curl normally checks the certificate thus I wonder why it did not complain. Anyway, you can check whether different certificate chains are returned using openssl s_client -connect dci.sophosupd.com:443 -verify 5, enter an uppercase Q to close the connection.

Christian

Hi,

I manage to  find out which is the port that is causing the issue.

Is port 8888 . I think this is the specific port that they use for SSL communication instead of the normal 443

Hello Hello Ng ZhiYun,

never heard of this. I'll ask DouglasLeederwhat he thinks of this.

Christian

Nothing I can think of in SAVLinux would use port 8888. It's too low to be the client port number I think. 

All of the SDDS update traffic goes on ports 443 and 80.

The only thing I can imagine is some kind of port redirect going on, but I don't know of any software that actually does that.

Does all these sources do not use port 8888?

Updating from versions - SAV: 9.16.2, Engine: 3.79.0, Data: 5.78 Updating Sophos Anti-Virus....

Updating SAVScan on-demand scanner

Updating Virus Engine and Data

Updating Manifest

Update completed.

Updated to versions - SAV: 9.16.2, Engine: 3.79.0, Data: 5.78 Successfully updated Sophos Anti-Virus from sdds:SOPHOS

I  monitored the traffic from the firewall and packets to destination port 8888 address 149.5.232.18

Once i enable the traffic to port 8888.

It resolves the SSL error

Port 8888 on 149.5.232.18 is an SSL connection. The certificate is Fortinet.

fds1.fortinet.com

A self-signed certificate chain - so probably some sort of non-web-browser connection.

Search for 'fds1.fortinet.com 8888' on google does seem to suggest that they use that port.

Are you running some kind of Fortinet tool?

Oh.

Yup we have a fortinet firewall