Jump to content
j-gray

Proxy Error from multiple clients

Recommended Posts

I'm getting the following repeatedly logged on the proxy server:

[proxy:error] [pid 6596:tid 10020] [client x.x.x.x:52075] AH00898: Connect to remote machine blocked returned by epns.eset.com:8883

This specific remote server is constantly blocking these connection attempts.

Any idea what's going on here and how to rectify this?

 

Edited by j-gray
Corrected title

Share this post


Link to post
Share on other sites

@Marcos  Thanks for the reply. We are not blocking this traffic on our networks at the client or server. Based on the error messages, it appears that the remote server (epns.eset.com) is blocking/rejecting the communication. Or is the error indicating that the epns server cannot connect to our client?

I'm also confused, as the documentation indicates these calls are triggered by a Web Console user. I am the only Web Console user and have not triggered these ever (intentionally, at least).

Could you please clarify how to resolve this issue? Ideally we would not want this outbound traffic to ESET.

Thanks again.

Share this post


Link to post
Share on other sites

If nobody is triggering these, why are they occurring so frequently?  Is it possible to disable this?

Share this post


Link to post
Share on other sites
3 minutes ago, Marcos said:

Didn't you send a wake-up call from ESMC ?

No. I'm the only console user and I never use this feature.

The logs show multiple entries per minute from a number of different clients. There are 429 entries in today's log file, alone. There's no reason it should be doing this that I know of.

Share this post


Link to post
Share on other sites

Connections to epns.eset.com are made by every ESMC 7.0+ components (Server + Agent) regardless of wake-up functionality use. Components will be trying to establish persistent connections regularly, with slightly increasing interval between attempts. That is why after startup of AGENTs it might be more often than later during the day.

Share this post


Link to post
Share on other sites

From both Windows and OS X clients, nmap results show both ports open (epns.eset.com:8883 and epns.eset.com:443).

So I have no idea why the connection is being blocked. Any thoughts?

That said, we'd prefer to minimize outbound traffic, particularly given we don't require that functionality. Is there a way to disable this outbound traffic within the product?

Thank you.

Share this post


Link to post
Share on other sites
On 12/13/2019 at 4:12 AM, MartinK said:

Connections to epns.eset.com are made by every ESMC 7.0+ components (Server + Agent) regardless of wake-up functionality use. Components will be trying to establish persistent connections regularly, with slightly increasing interval between attempts. That is why after startup of AGENTs it might be more often than later during the day.

Are there any options if we do not want these frequent/persistent outbound connections?

Share this post


Link to post
Share on other sites
2 minutes ago, j-gray said:

Are there any options if we do not want these frequent/persistent outbound connections?

Unfortunately not, this functionality is enabled by detail and cannot be disabled.

My best guess for failure is failure during SSL handshake, which ESMC Agent versions are actually used? I guess they are not 7.1?

Share this post


Link to post
Share on other sites
13 minutes ago, MartinK said:

Unfortunately not, this functionality is enabled by detail and cannot be disabled.

My best guess for failure is failure during SSL handshake, which ESMC Agent versions are actually used? I guess they are not 7.1?

I just picked a random one from within the error logs. It is an OS X client running ESET Endpoint Antivirus 6.8.400.0 with 
ESET Management Agent 7.1.840.0 (latest).

Another random client with the same errors is also OS X, running agent 7.1.840.0 (latest) but older av version 6.7.900.0

A third random client in the error logs is a Windows client with ESET Management Agent 7.1.717.0 (latest) running ESET Endpoint Antivirus 7.1.2053.0.

So far, the random clients showing the connection error to epns.eset.com are all running the latest agent.

Share this post


Link to post
Share on other sites

In case you are using ESET Apache HTTP proxy, it is probable that connections to port 8883 are blocked but it is not clear whether this is the issue. Could you verify configuration of:

AllowCONNECT 443 563 2222

in httpd.conf? It is possible that enabling this port 8883 will helps AGENT to connect successfully.

In case direct connection to EPNS servers is not possible, multiple alternatives, including port variants (443,8883) are tried to ensure that connection is made even when configuration is not possible.

Share this post


Link to post
Share on other sites
19 hours ago, MartinK said:

In case you are using ESET Apache HTTP proxy, it is probable that connections to port 8883 are blocked but it is not clear whether this is the issue. Could you verify configuration of:


AllowCONNECT 443 563 2222

in httpd.conf? It is possible that enabling this port 8883 will helps AGENT to connect successfully.

In case direct connection to EPNS servers is not possible, multiple alternatives, including port variants (443,8883) are tried to ensure that connection is made even when configuration is not possible.

It looks like adding port 8883 to the httpd.conf file resolved the connection issue. Thanks for that tip.

Share this post


Link to post
Share on other sites
5 hours ago, j-gray said:

It looks like adding port 8883 to the httpd.conf file resolved the connection issue. Thanks for that tip.

Thanks for letting us know, it might indicate problem in order of connection attempts -> I guess port 443 should be preferred as it has much higher probability to bypass proxies and firewall on path to ESET infrastructure.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...