http proxy server unable to forward at this time

[Guest]

[david_thistlethwaite]

I admin several endian 2.4 systems and today they all stopped forwarding http request claiming that authentication was required.
No authentication is used.
Since this has happend on several machines all within 4 hours of each other I can only infer a bug or some type of attack ?

Any insights ?

David

[hitek0001]

Malformed CLAMAV database is causing the issue:
Feb 10 20:01:37 efw-1279312999 clamd[3136]: Running as user clamav (UID 1000, GID 107)
Feb 10 20:01:37 efw-1279312999 clamd[3136]: Log file size limited to 2097152 bytes.
Feb 10 20:01:37 efw-1279312999 clamd[3136]: Reading databases from /usr/share/clamav
Feb 10 20:01:37 efw-1279312999 clamd[3136]: Not loading PUA signatures.
Feb 10 20:01:37 efw-1279312999 clamd[3136]: Malformed database

run freshclam from ssh
then restartclamav

[hitek0001]

if freshclam still errors this worked on 2.4.1 for me:
Incase you still get an error with freshclam about malformed database here is the fix I had to do on sunvalley:
Ssh in:
cd /usr/share/clamav/
rm -Rf clamav-*
rm main.cvd
rm daily.cvd
rm safebrowsing.cvd
curl -O db.local.clamav.net/bytecode.cvd  add http colon slash slash before db (can't post links)
freshclam
restartclamav

[bernieL0max]

ALL of my Endian Community Edition boxes also fell over today with the same problem.

[bernieL0max]

When I look in "Services", "Antivirus Engine", it says "None of the activated services are currently using Clamav antivirus. Therefore updates are disabled."

yet I am using a transparent proxy and my access policy includes "Activate antivurs scan".

My SMTP Proxy also has "Scan mail for virus" enabled.

So why does it think "none of the activated services are currently using clamav"?

[bernieL0max]

ignore that last reply, after following instructions posted by hitek0001 the service is running and the update section is displaying the correct information.  Thank you.

[emilinz]

thanks !!! Resolved!!!!

[jimmyzshack]

ok i was able to get all 4 endian http servers working with this info, BUT i have endian server that i use to scan email and we are not getting any emails here is the message we are getting:

delivery temporarily suspended: lost connection with 127.0.0.1[127.0.0.1] while sending RCPT TO).

Anyone know what to do to fix this?

[jimmyzshack]

anyone else getting these error's again today? i have 2 endian machines with this problem but not all of them at least not yet.

ERROR

--------------------------------------------------------------------------------


The requested URL could not be retrieved
While trying to retrieve the URL: http://www.google.com/



The following error was encountered:

Unable to forward this request at this time.

Sorry, you are not currently allowed to request:
http://www.google.com/
from this cache until you have authenticated yourself.

This request could not be forwarded to the origin server or to any
parent caches. The most likely cause for this error is that:
The cache administrator does not allow this cache to make direct connections to origin servers, and
All configured parent caches are currently unreachable.

[jimmyzshack]

I was wrong it's all of our endian machine. Malformed database. none of the instructions above or fixing this error.
Antivirus2011-02-28 08:21:53
clamd (5816)  Log file size limited to 2097152 bytes. Antivirus2011-02-28 08:21:53
clamd (5816)  Reading databases from /usr/share/clamav Antivirus2011-02-28 08:21:53
clamd (5816)  Not loading PUA signatures. Antivirus2011-02-28 08:21:54
clamd (5816)  Malformed database SMTP Proxy2011-02-28 08:21:56

[Galas]

Yup, happening again ... 

Removing everything from the folder is not solving it

[alex_t]

I have the same problem

sequence:
cd /usr/share/clamav/
rm -Rf clamav-*
rm main.cvd
rm daily.cvd
freshclam
restartclamav

doesn't help.
freshclam ok, restart ok, proxy doesn't work.

[Galas]

Got it working, you must also restart havp

Code:

restarthavp.py

[jimmyzshack]

Don't know if they have been updated or not but i reboot the vm's after updating main and daily and it didn't fix it. I did have older copies of main and daily and restarted the VM's and it worked on all of them.

[alex_t]

Code:

cd /usr/share/clamav/
rm -Rf clamav-*
rm main.cvd
rm daily.cvd
freshclam
restartclamav
restarthavp.py

Works!!!
Thank you