deb*.rabbitmq.com can respond with a 403 if accessed via a specialized proxy #14430
-
Describe the bugURLs like https://deb1.rabbitmq.com/rabbitmq/rabbitmq-server/deb/debian/dists/trixie/InRelease and https://deb2.rabbitmq.com/rabbitmq/rabbitmq-server/deb/debian/dists/trixie/InRelease result in an error 403. Replacing deb1 and deb2 with ppa1 and ppa2 (older domain names) work successfully, even though they resolve to the same IP addresses. "Cloudflare Ray ID" shown in browser : 975362cb4c416b98 and 975366564a5c6b98 Reproduction stepsExpected behaviorAdditional contextNo response |
Beta Was this translation helpful? Give feedback.
Replies: 6 comments 5 replies
-
|
@sylvainfaivre I cannot reproduce with a real
If you have to use |
Beta Was this translation helpful? Give feedback.
-
|
@sylvainfaivre I have tried again and I cannot reproduce any 403s with a real Starting a Container# "docker" is an alias for Podman
docker run -it --dns 8.8.8.8 debian:trixie /bin/bashapt update -y
apt upgrade -y
# then install HelixInstall
|
Beta Was this translation helpful? Give feedback.
-
|
As for Our tiny team has infinitely more important things to do. Anyone who needs to install |
Beta Was this translation helpful? Give feedback.
-
|
Hello @michaelklishin , Thank you for taking the time to explain the changes in the Cloudflare setup, and to provide clean reproduction steps. The thing is, I actually had this error 403 issue on a Debian box, using Our boxes access the Internet through an HTTP proxy running the Debian Here are the real logs from a Debian box using this setup, when running |
Beta Was this translation helpful? Give feedback.
-
Yeah, that might be the culprit. Do you know if it may be messing with the |
Beta Was this translation helpful? Give feedback.
-
|
@sylvainfaivre I do see that a good half of the 403 returned by the bot protection rule originate from France. Given how few requests it filters out (as a percentage of total traffic), I am OK with deactivating the rule if today's whitelisting does not help in your specific case. Let me know. |
Beta Was this translation helpful? Give feedback.
-
|
Seems like I spoke too soon. I was able to replicate the 403 error on a Debian Bullseye box, with direct outbound connection (not going through the proxy). With old URLs (ppa), all goes fine : With new URLs (deb), error 403 : |
Beta Was this translation helpful? Give feedback.
-
|
The difference between the two groups of subdomains is one security rule. In the last 24 hours it was triggered 168 times out of over million requests by non-browser clients. I have added a new condition that should help |
Beta Was this translation helpful? Give feedback.
-
|
I can deactivate the rule entirely but Cloudflare stats suggests it affects a tiny percentage of requests, so let's see if excluding user agents that contain The Bullseye example from the docs works as expected. |
Beta Was this translation helpful? Give feedback.
-
|
After further debugging, I'm ashamed to admit the whole error was due to an oversight on my part : when adapting our code for the new repositories, I only changed the domain names from |
Beta Was this translation helpful? Give feedback.
-
|
Alright, no worries. It was a good opportunity to revisit and tweak the [anti-]bot protection rule for |
Beta Was this translation helpful? Give feedback.
@sylvainfaivre I have tried again and I cannot reproduce any 403s with a real
aptclient on an x86-64 Trixie host.Starting a Container
# "docker" is an alias for Podman docker run -it --dns 8.8.8.8 debian:trixie /bin/bashapt update -y apt upgrade -y # then install HelixInstall
sudoUsed by the Installation ScriptThe Script
Taken straight from the RabbitMQ doc guide for Debian and Ubuntu: