Virus scanner blocking/messing up traffic? - Page 2

Stielf · 09-26-2007, 01:40 PM

Untangle works great except for once a week or so I get an email in that causes this same problem.

"I have the same problem to get my mail, I am using Thunderbird under XP.
When I turn off the virus/spam/Phish blocker it works like a charm.
I get this message from Thunderbird mail client:"The RETR command did not succeed. Error retrieving a message"

I use an Mdeamon Mail Server behind my Untangle computer. I get the error recieving message on an email that has a blank message. The email server will read thru the email list with no problem and time out when it hits the bad email while downloading it. Then it does this over and over again.

I can go on the ISP's web mail client and delete the email that Untangle hangs on and everything will start working correctly. I can also shut off the Untangle Virus module and reboot the Untangle server to fix the problem also.

I get this on multiple Untangle Servers that have an Mdeamon email server behind it useing pop3 to pull down the emails.

It seems that the Virus detection is waiting to scan the body of the message and since there isn't anything there, it times out, causing the email server to start over in an endless loop.

Mdeamon Email Server with it's virus software works just fine on these spam emails without Untangle in front of it.

dlasher · 10-03-2007, 11:14 PM

I'll just throw my "me too" in. I had to completely disable the virus scanning to get yum updates to go through. Even tried creating some additional file types ".rpm etc" and telling it to ignore them, to no avail.

buggers.

HomeNet · 10-31-2007, 07:13 AM

Yes, I saw something similar with a few of my Thunderbird users. They all have XP and Outlook Express broke a while back so they now use Thunderbird. When I installed the Untangle box the guys who used Thunderbird kept getting the "The RETR command did not succeed. Error retrieving a message." error and I had to shut down a few services in the Untangle box. If I was using the Spam Blocker, Phish Blocker or the Virus Blocker, Thunderbird would return that same error. It didn't matter if I use one, two or all three of those blocking utilities...

Is there a fix for this yet?

HomeNet · 11-06-2007, 08:27 AM

So is there a workaround or what? I'd like to re-enable these features to better protect my clients who paid us to install this piece of hardware.

mdh · 11-06-2007, 08:31 AM

Dunno as far as a workaround goes, but the yum issue is in Engineering now.

dlasher · 11-07-2007, 10:40 AM

Quote:

Originally Posted by mdh

Dunno as far as a workaround goes, but the yum issue is in Engineering now.

Do you still need more data? I can attach/email a TCPDUMP, with what ever params you need. As of right now I still have to turn off the virus scanning to get yum to update. I've even set up "exemptions" and it still screws em up.

mdh · 11-07-2007, 10:48 AM

dlasher,

We'd be silly to turn it down. Please feel free to send it to us. I have attached dmorris's quote from earlier in the thread which has the specs we are looking for. Thanks for the offer!

Quote:

Originally Posted by dmorris

If you could provide a couple tcpdump records on the inside and outside interface while doing a yum update.

tcpdump -i eth0 -s 0 -w eth0.yum.ptrace "tcp port 80" &
tcpdump -i eth1 -s 0 -w eth1.yum.ptrace "tcp port 80" &
<<do a yum update>>
killall tcpdump

then email them to us @ support@untangle.com

then we can file a bug and fix it - otherwise its hard to tell whats going on.

juank · 11-07-2007, 11:27 AM

The only workaround I found that works was to change the source lists from HTTP to FTP sites.

HomeNet · 11-07-2007, 11:30 AM

Quote:

Originally Posted by juank

The only workaround I found that works was to change the source lists from HTTP to FTP sites.

Are you speaking about my query?

dmorris · 11-07-2007, 11:50 AM

tracking of this bug here:

http://bugzilla.untangle.com/show_bug.cgi?id=3210

It appears to be an issue related to partial fetching.

edit: we already got a tcpdump and everything we need.
the bug is currently scheduled to be fixed in 5.1 by allowing users to turn of partial fetching blocking.
By default it blocks partial fetches because this gets around the ability to virus scan downloads.
Unfortunately, yum uses a web client that partial fetches the whole file
[0...size] instead of just requesting the file.

09-26-2007, 01:40 PM	#11 (permalink)
Stielf Newbie Join Date: Sep 2007 Posts: 2	pop3 email problem Untangle works great except for once a week or so I get an email in that causes this same problem. "I have the same problem to get my mail, I am using Thunderbird under XP. When I turn off the virus/spam/Phish blocker it works like a charm. I get this message from Thunderbird mail client:"The RETR command did not succeed. Error retrieving a message" I use an Mdeamon Mail Server behind my Untangle computer. I get the error recieving message on an email that has a blank message. The email server will read thru the email list with no problem and time out when it hits the bad email while downloading it. Then it does this over and over again. I can go on the ISP's web mail client and delete the email that Untangle hangs on and everything will start working correctly. I can also shut off the Untangle Virus module and reboot the Untangle server to fix the problem also. I get this on multiple Untangle Servers that have an Mdeamon email server behind it useing pop3 to pull down the emails. It seems that the Virus detection is waiting to scan the body of the message and since there isn't anything there, it times out, causing the email server to start over in an endless loop. Mdeamon Email Server with it's virus software works just fine on these spam emails without Untangle in front of it.

10-31-2007, 07:13 AM	#13 (permalink)
HomeNet Master Untangler Join Date: Sep 2007 Location: West Chester, Pennsylvania, USA Posts: 193	Thunderbird Breaks! Yes, I saw something similar with a few of my Thunderbird users. They all have XP and Outlook Express broke a while back so they now use Thunderbird. When I installed the Untangle box the guys who used Thunderbird kept getting the "The RETR command did not succeed. Error retrieving a message." error and I had to shut down a few services in the Untangle box. If I was using the Spam Blocker, Phish Blocker or the Virus Blocker, Thunderbird would return that same error. It didn't matter if I use one, two or all three of those blocking utilities... Is there a fix for this yet? Last edited by HomeNet; 10-31-2007 at 07:14 AM.. Reason: formatting change

11-07-2007, 11:27 AM	#18 (permalink)
juank Join Date: Aug 2007 Location: Athens URLs submitted: 46 Posts: 1,474	The only workaround I found that works was to change the source lists from HTTP to FTP sites. __________________ -------------------------------- Juan Machado --------------------------------

11-07-2007, 11:50 AM	#20 (permalink)
dmorris Untangle Junkie Join Date: Nov 2006 Location: San Mateo, CA URLs submitted: 10 Posts: 10,215	tracking of this bug here: http://bugzilla.untangle.com/show_bug.cgi?id=3210 It appears to be an issue related to partial fetching. edit: we already got a tcpdump and everything we need. the bug is currently scheduled to be fixed in 5.1 by allowing users to turn of partial fetching blocking. By default it blocks partial fetches because this gets around the ability to virus scan downloads. Unfortunately, yum uses a web client that partial fetches the whole file [0...size] instead of just requesting the file. __________________ Attention: Support and help on the Untangle Forums is provided by volunteers and community members like yourself. If you need Untangle support please call or email support@untangle.com

10-03-2007, 11:14 PM	#12 (permalink)
dlasher Untangler Join Date: Sep 2007 Posts: 30	I'll just throw my "me too" in. I had to completely disable the virus scanning to get yum updates to go through. Even tried creating some additional file types ".rpm etc" and telling it to ignore them, to no avail. buggers.

11-06-2007, 08:27 AM	#14 (permalink)
HomeNet Master Untangler Join Date: Sep 2007 Location: West Chester, Pennsylvania, USA Posts: 193	So is there a workaround or what? I'd like to re-enable these features to better protect my clients who paid us to install this piece of hardware.

11-06-2007, 08:31 AM	#15 (permalink)
mdh Join Date: Aug 2007 URLs submitted: 171 Posts: 4,802	Dunno as far as a workaround goes, but the yum issue is in Engineering now.