Thread Info
  • State Suggested Answer
  • +6 person also asked this people also asked this
  • Locked Locked
  • Replies 36 replies
  • Answers 3 answers
  • Subscribers 13 subscribers
  • Views 298779 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Quarantine Report uses HTTP links instead of HTTPS

Costas

Hello everyone,

We are using UTM version 9.510-5 on hardware appliances.

After updating to version 9.510-5 on Aug 16, 2018, all users started complaining about not being able to release their rejected emails from the quarantine. When clicking on the Release link within Quarantine Report, the browsers (Chrome and Mozilla) display this page:

Bad Request

Your browser sent a request that this server could not understand.
Reason: You're speaking plain HTTP to an SSL-enabled server port.
Instead use the HTTPS scheme to access this URL, please.

Additionally, a 400 Bad Request error was encountered while trying to use an ErrorDocument to handle the request.

The IE11 simply displays a Web page not found (404) message.

I figured out, the Release and Whitelist links within Quarantine Report point to a URL similar to this:

http://firewall:3840/release.plc?proto=pop3&id=233473&secure=39bf55d252ef2ca8e9be4fc5bfa75140

Then, I pasted this link into my browser and changed http to https. It worked just fine, and I got back a normal message from UTM.

Can anybody suggest where in UTM there is a setting to configure the Release and Whitelist links within Quarantine Report sent by email (see image below) to be https instead of http? I seem to have checked everything: Management, Email Protection, and all other sections...

Will appreciate any advice!



This thread was automatically locked due to age.
Parents
  • 0

    To clarify...

    I'm not seeing this.  Quarantine reports use https in 9.510-5.  That's why I suspect that you have a unique situation that Support should look at.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Thank you Bob,

    I will contact support on Monday and post back the results.

  • 0 in reply to Costas

    Not seeing this anywhere.  Please insist on escalation of your case at Sophos Support.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Thank you Bob,

    This was already escalated to Sophos global escalation specialists (GES) level on Aug 24th. The latest reply I received referred to their "development team" who was unable to replicate the issue.

    Can it be escalated even further?

  • 0 in reply to Costas

    I suppose that there's a danger of the following causing further damage, but it's no big loss as the alternative is re-imaging and restoring.  You can copy the logs off and back later if you need them.  Do get some backups off the UTM before you start, making sure that, in addition to the latest, you also have one that is old enough to restore to the version of the ISO that you will re-image from.

    What happens if you do this block of commands and then re-apply the 9.510 Up2Date?

    # Version change trick
    echo ' 9.509003'>/etc/version
    cd /var/up2date/sys
    wget http://ftp.astaro.com/pub/UTM/v9/up2date/u2d-sys-9.509003-510005.tgz.gpg
    # Prepare to apply in WebAdmin
    /sbin/auisys.plx --showdesc

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Just as comment:

    I had the same problem with version 9.510-5, that the http-Link in the Sophos E-Mail for Blocked messages gave a Bad Request Error in the browser. (This was today.)

    Since I went to "E-Mail-Protection->Quarantine Report->Advanced" and entered a Hostname and clicked apply (the second step suggested by Heinrich), the same http-Links started to redirect automatically to a https-Address. (just now)

    This solves my problem.

  • 0 in reply to Bertram Neumann

    Thank you Bertram,

    I did try this a few days ago, after reading Heinrich's reply, it did not work for me.

    Today, your message inspired me to do it again, but no, it still did not work.

  • 0 in reply to BAlfson

    Bob,

    Unfortunately, I am not feeling too comfortable with Linux to do your proposed version change trick. The load on the system is significant and the company operates 18 hours a day...

    I know, I can always roll it back to the previous release, but I am very curious to get a solution from Sophos. If it is going to take another week, I will be ready to roll back.

    Thank you!

  • 0 in reply to Costas

    Yes, you can roll  back to the prior version, but that requires you to re-image from ISO, thus losing logs and reporting.  My suggestion has worked for others in the past when there was a hiccup with an Up2Date like you've apparently had.

    The reason for the version change trick is that the 9.509-to-9.510 Up2Date won't install if the version is already 9.510.  The wget line downloads the 9.509-to-9.510 Up2Date package into the /var/up2date/sys directory.  The final line unpacks and prepares the Up2Date package so that you can [Apply] it in WebAdmin.

    I wouldn't be hesitant to ask Sophos Support to run these commands if you're not comfortable doing this yourself.

    Also, if my company were your reseller (not possible since you're not in the USA), I'd be all over Support to tell us where the template is for the release URL.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    This sounds very promising actually.

    Can you give more details as how to start?

    1. Connect a monitor and keyboard to UTM

    2. Login as root?

    3. ...

  • 0 in reply to Costas

    I prefer to use PuTTy to work at the command line as it will allow you to copy the block of commands above, left-click in the terminal screen and right-click to paste and execute the commands.  Download PuTTy from the author's site: http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html.

    You will need to allow SSH on the 'Shell Access' tab of 'System Settings' and to put "Internal (Network)" or your IP into 'Allowed Networks'.

    1. Start PuTTy, put the LAN IP of the UTM into the 'Host Name' field and click [Open].
    2. Accept the servers host key.
    3. Login as loginuser.
    4. su -
    5. Enter the password for root.
    6. Copy the block of commands above and paste them into the terminal screen.
    7. When finished, enter exit to log out.
    8. Install the Up2Date in WebAdmin.

    Let us know how it goes!

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to siggi_r

    OK, I have the same problem and maybe an important hint.

    I just found out the following:

    If I receive SPAM in a POP3-Quarantine, the link is wrong (http)

    If I receive SPAM via SMTP, the link works correctly (https)

    Maybe that's why SOPHOS can't find the problem, because they test SMTP and not POP3?

Reply
  • 0 in reply to siggi_r

    OK, I have the same problem and maybe an important hint.

    I just found out the following:

    If I receive SPAM in a POP3-Quarantine, the link is wrong (http)

    If I receive SPAM via SMTP, the link works correctly (https)

    Maybe that's why SOPHOS can't find the problem, because they test SMTP and not POP3?

Children
Unfiltered HTML