Webfilter debian deb repositories "Malware 'Unscannable"

Hello,
The first errors could be caused by problems with certificate handling:
"Dieser Server konnte nicht beweisen, dass er ftp.de.debian.org ist. Sein Sicherheitszertifikat stammt von debian.inf.tu-dresden.de. Mögliche Gründe sind eine fehlerhafte Konfiguration oder ein Angreifer, der deine Verbindung abfängt."
The message "Malware 'Unscannable'" usually means that encrypted files / code components are being transferred that the firewall cannot examine.
There are also tracking pixels that trigger this.
Strange if this doesn't happen when using another mirror.
Sandboxing also leads to download errors for us, which no longer exist 20 minutes later.

Hi Dirk, good point - the certificate mismatch could be part of the root cause here.

Though the links are http - I can see some of them as https links in the firewall logs.

that's my entry URL ftp.de.debian.org/.../

it is the sophos community frontend making https links out of http links.

also my URL posted above was http originally

ugly but not impossible

Hi LHerzog

Please check under Web-->General Settings, disable Block unrecognized SSL protocols for test 

Regards

thanks for your idea Bharat J. Do you think it will have any impact for http downloads?

How long has this been happening and which version of firmware are you using?

Ian

I have a user complaint that is about 4 weeks old and we're using SFOS 19.5.3

The underlying problem is that file is not scannable (or rather it times out during scan).  I don't know about these specific files but .deb and .hpi files are actually archives.  Some of them contain >10,000 files within themselves - each file within the archive gets separately virus scanned.  I know one of the packages I looked at had internally testing for zipbombs and then contained within it had a zipbomb.

Around Jan 2024 we added some additional archive support into the sophos virus scanner.  Previously some of these files may have virus scanned quickly because we were not opening inside the archive.  Now we are scanning inside.

Now the scans do complete eventually and the files get downloaded -- if you download and scan one file at a time.  IIRC apt-get normally does this, it does the downloads sequentially.  But some people use apt-fast to try and speed up by downloading multiple files at a time - which causes multiple virus scans at a time.  This is where the timeouts start happening.

So there are two solutions
1) if using apt-fast or other system that does multiple downloads try switching back to apt-get
2) use exceptions to skip virus scanning

For example
^([A-Za-z0-9.-]*\.)?debian\.org/.*\.deb$

^([A-Za-z0-9.-]*\.)?ubuntu\.com/.*\.deb$


For Support - Internal KB-000044985