Sophos UTM - 9.500-9 bug

[localzuk]

PSA for anyone using Sophos UTMs.

 

There is a bug in version 9.500-9 affecting active directory authentication for web filtering. Basically, the NTLM tool on the UTM keeps restarting over and over again, which manifests in Internet Explorer as a page failing to load and "flashing" on the screen - looking at the address bar shows the name of the UTM followed by the URL you were trying to visit over and over again.

 

I spent some time on the phone with Sophos support today, and their workarounds are:

 

1. Disable authentication

2. Restore your UTM back to 9.413-4 by re-imaging the UTM and restoring a configuration backup from that version.

 

I have done this with one of our UTMs tonight, and am doing it with another 2 tomorrow morning.

 

So - until they have a fix, don't update to 9.500-9.

[Jaan]

Ah bugger, (no pun intended).

 

We're having issues with applications not authenticating via proxy. our web browsers seem unaffected.

 

Our Groupcall xporter it also having issues as a result and also afew apps that office staff use. Looking at the logs it seems to correspond to the 9.5 update

 

Do you know if they have acknowledged this bug? Never had to restore to a previous version so don't want to brick it!

[localzuk]

Yeah, they know about it and it is with the developers to fix. I would log a support ticket if I were you, just to confirm it.

[colly72]

Is this the "Client Authentication daemon not running -restarted" issue?

[localzuk]

The errors I saw were in the web protection log:

 

2017:05:16-11:19:07 dms-utm httpproxy[8456]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x9fb9800" function="adir_auth_process_negotiate" file="auth_adir.c" line="1600" message="gss_accept_sec_context: Key table entry not found"

 

Hundreds of that message.

 

And in the /var/log/selfmon.log hundreds of this:

 

2017:05:16-00:07:58 dms-utm selfmonng[4413]: W actionCmd(+):  '/var/mdw/scripts/ntlm restart'

[colly72]

Ah, OK, I thought it may have been to do with this

[colly72]

New firmware just released, for anyone brave enough to try it:

 

https://community.sophos.com/products/unified-threat-management/f/hardware-installation-up2date-licensing/92971/sophos-utm-9-501-5-released

[colly72]

Interestingly, it looks like 9.5 has now been pulled and replaced with 9.414-2. The option to update to 9.5 is no longer showing on my UTM

 

https://community.sophos.com/products/unified-threat-management/b/utm-blog/posts/utm-up2date-9-414-released

[Jaan]

Interestingly, it looks like 9.5 has now been pulled and replaced with 9.414-2. The option to update to 9.5 is no longer showing on my UTM

 

https://community.sophos.com/products/unified-threat-management/b/utm-blog/posts/utm-up2date-9-414-released

 

but.....but......i just updated!

[colly72]

but.....but......i just updated!

 

Good luck!!

[Jaan]

Good luck!!

 

luckily we're not affected by the VPN issues....... but yeah WOW alot of people aren't going to be happy!

[colly72]

It's the AD SSO httpproxy authentication issues in Chrome/IE that stopped me from updating. So glad I held off! Sounds like a completely botched update from Sophos and it's not the first time.....

[Jaan]

It's the AD SSO httpproxy authentication issues in Chrome/IE that stopped me from updating. So glad I held off! Sounds like a completely botched update from Sophos and it's not the first time.....

 

I don't seem to have this issue? we're syncing our ad to the utm for user level filtering, using standard operation mode with proxy a in the chrome broswer. unless i'm confusing the issue with something else.

[colly72]

I don't seem to have this issue? we're syncing our ad to the utm for user level filtering, using standard operation mode with proxy a in the chrome broswer. unless i'm confusing the issue with something else.

 

I think it's only in transparent mode, where it's an issue:

 

https://community.sophos.com/kb/en-us/126819

[sparkeh]

9.501-5 is showing for us. Think I'll leave it... :S

[Jaan]

9.501-5 is showing for us. Think I'll leave it... :S

 

do it!

 

[localzuk]

I have no idea what my UTMs are doing. I got to work this morning to find 80 messages from UTMs saying various new firmware versions were available. Yet, on the UTMs themselves - no sign of any of it. Come on Sophos, up your game.

[Paul_Don]

We've started having this issue at a couple of schools now. Is there still no update from Sophos.

We use Standard Mode. Turned off authentication for now, but need to know when it's back on so we can start authenticating again.

Edited June 19, 2017 by Paul_Don
Update

[colly72]

Some people have had success apparently by removing the UTM from the domain, deleting the device account in active directory, then rejoining the domain.

[localzuk]

Some people have had success apparently by removing the UTM from the domain, deleting the device account in active directory, then rejoining the domain.

I tried this back at the time, and it made no difference. Actually, it appeared to make it worse.

[colly72]

I tried this back at the time, and it made no difference. Actually, it appeared to make it worse.

 

So glad I've held off then and am working happily on 9.413-4!!!

[colly72]

Apparently, according to this updated KB article, 9.5 MR2 is in the works, to resolve this problem:

 

https://community.sophos.com/kb/en-us/126819