This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Strange skype and socks5 behavior

Have configured Skype to use Socks5 with "Automatic detect settings".On the client Win 10 machine I have a proxy agent which sets system proxy address depending on network.

When starting Skype, I get this in the UTM socks log

2016:07:07-15:39:34 fw sockd[29168]: info: pass(1): tcp/accept [: 192.168.1.10.65433 192.168.1.1.1080
2016:07:07-15:39:34 fw sockd[29168]: info: block(1): tcp/accept ]: 192.168.1.10.65433 192.168.1.1.1080: error after having read 24 bytes: access denied by AUA

What have I done wrong?



This thread was automatically locked due to age.
  • Glad I'm personally still on Skype 7.21.  Thanks for the warnings, guys - I'll get this out to everyone.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • i gave up on this, skype won't fix anything.

     

    funny thing is thanks to this i'm forced to use full outgoing enabled packet filter for the lan or skype simply won't work for voice/video and i won't enable an open socks proxy

  • Any news about this?

    Got the same problem using UTM 9.411-3 and Skype 7.35.0.101

  • Bob, i'm not using radius for this auth, i had it enabled for pptp.

    the radius log shows an access attempt then a reject

    just for testing i disabled RADIUS and the error persists:

    2016:10:28-11:54:02 utm aua[12636]: id="3005" severity="warn" sys="System" sub="auth" name="Authentication failed" srcip="10.10.10.192" host="" user="user" caller="socks" reason="DENIED".

     

    EDIT:

    i've opened a support case for this and looks like a skype bug, the support guys pointed me to https://community.skype.com/t5/Windows-desktop-client/Skype-7-22-0-108-does-not-work-with-Socks5-Proxy/td-p/4359698

    i setup a packet capture with wireshark and did a test with skype and with curl, with skype the password is sent either empty or mangled, with curl it works perfectly(test with good and bad password and responses are as expected).

    the bug is still present on the current 7.94 version i'll see how to report this to skype if at all possible.

     

    EDIT2: got in touch with skype support, i'm amazed how fast and receptive they where, the support guy connected to my PC with logmein to reproduce the issue -which i did- and he acknowledged it might be a problem and he said that they'll refresh my account(that's kind of BS as this bug happens before skype logs in) and to check back in a day, i have a case number which i'll reference next week if it keeps failing(which it will do...)

  • I hate to have to look in the logs on a WinServer, but what does the RADIUS log show on 10.10.10.36?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • in the UA log i get:

     

    2016:10:20-18:08:53 utm aua[9774]: id="3006" severity="info" sys="System" sub="auth" name="Trying 10.10.10.36 (radius)"
    2016:10:20-18:08:53 utm aua[9774]: id="3006" severity="info" sys="System" sub="auth" name="Trying 10.10.10.36 (adirectory)"
    2016:10:20-18:08:53 utm aua[9774]: id="3006" severity="info" sys="System" sub="auth" name="Trying 10.10.10.35 (adirectory)"
    2016:10:20-18:08:53 utm aua[9774]: id="3005" severity="warn" sys="System" sub="auth" name="Authentication failed" srcip="10.10.10.192" host="" user="user@domain.com.ar" caller="socks" reason="DENIED"
     
     
    with the shortname it does the same
  • What do you see in the User Authentication log?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • i'm having this same issue, but i'm using AD users as allowed, i even added the AD user specifically and nothing.

     

    i've tried shortname, domain\shotname and FQDN, all attempts give access denied by AUA, what's going on?

  • I've seen the same behaviour here.

    In my case the Problem was the "uncategorized Websites" Setting under filter actions which was "warning".

    I changed it to "allow" and Skype could sucessfully connect.

    So I switched it back to "warning" established a new Connection and filtered the webfilter log for "Uncategorized".

    Found some URLs and added them with some RegEx to my exeptions.

    Now everything works fine for me.

     

    UTM v9.407-3

    Skype 7.28.32.101

  • I can join this discussion too, I am experiencing the same problem since several months ago.

    If I turn off passwords in the UTM socks proxy config, forcing it to SOCKS4, the socks proxy is working without the "error after having read 24 bytes: access denied by AUA" error. The socks proxy log is now showing successful connections.

    Using SOCKS 4 instead of socks 5 could be a solution? However, I am not certain of which functionality I loose besides not have to set username and password?

    Then I am running into the next problem :(

    Since I am also using https-proxy, Skype cannot log in my Skype user. The blue connect icon in Skype turns in eternity. If I turn off the https proxy and opens https for outgoing traffic Skype successfully logs in and all is working. But deactivation of the https-proxy is not the final solution for me so I am stranded here.

    This is my exception for skype for web filtering:

    There should possibly be more people with the same problems? How have you configured UTM and Skype using https proxy?

    UTM v9.407-3

    Skype v7.28.0.101