Sabnzbd 4.4.1 avast problem

[megasteck]

Hi,

today with Sabnzbd 4.4.1 the "Cannot connect to server news easynews com [Server name does not resolve]" came up, yesterday there was not problem.

Changed the Certificate verification level to Medium in Sabnzbd 4.4.1 but with Avast activated the problem stays.

When I deactivate Avast, I can download.

Have Windows 10, NordVpn running.

Tried:

"Open Run and type mmc.exe
Select <File>, <Add/Remove Snap-In>
Choose <Certificates>
Select <My User Account>, and click<OK>
Expand <Certificates - Current User>
Expand <Intermediate Certificate Authorities>, and Click <Certificates>
Find and delete the expired DST Root CA X3 and/or Let's Encrypt R3 certificates"

but couldn't find these certificates.

Disabled even in Avast the https scan, nothing changed.

anyone an idea?

Don't want to keep Avast deactivated.

Thanks,

[sander]

From memory: a few months ago, the new python version did not allow non-official certificates installed on the client anymore. And that is what virusscanners do: they put their certificate into the OS certificate store, so they intercept traffic. But ... not ok anymore for Python, and thus not ok anymore for SABnzbd.
And that is a good thing: SSL should protect against Man-in-the-Middle attacks ... which your Avast is doing.

So we introduced "Medium" checking into SABnzbd: "Medium: verify that the certificate is valid and matches the server address, but allow certificates locally injected (for example by firewall or virus scanner)."

And you already found that, but ...

> Changed the Certificate verification level to Medium in Sabnzbd 4.4.1 but with Avast activated the problem stays.

That's weird.

A workaround was: let SABnzbd connect to the newsserver on the HTTPS port = 443 (not NNTPS port 563). Explanation: the virusscanners seem to not intercept HTTPS traffic. The bad news: news.easynews.com does listen on HTTPS port = 443 ... but with plain NNTP, not NNTPS. So you cannot use that trick.

Ah: news.easynews.com does listen on port 993 with SSL. Maybe maybe maybe Avast does not scan that either (good), so worth trying ... but I'm in doubt. I haven't got Windows nor Avast, so I can't test for you.

If all else fails: set SABnzbd certificate checking to Minimal (or: Disabled) and try again.

[megasteck]

Thanks for the fast reply.

So the port 993 works just without avast. With avast the error code when I test the server: "Could not connect to news easynews com on port 993. It appears that news easynews com operates as a web server (port 80), possibly an indexer, not a usenet server. You have to fill a usenet server."

I tried with the SABnzbd to set it to minimal an to disabled and wont work with Avast on.

[sander]

Thanks for the fast reply.

So the port 993 works just without avast. With avast the error code when I test the server: "Could not connect to news easynews com on port 993. It appears that news easynews com operates as a web server (port 80), possibly an indexer, not a usenet server. You have to fill a usenet server."

I tried with the SABnzbd to set it to minimal an to disabled and wont work with Avast on.

Ahhhhhhhhhh ... that means Avast or your firewall is just blocking those connections completely. Probably "weird port => block".

There must be a setting in Avast or your firewall to allow that traffic.

[megasteck]

I just don't understand why it suddenly changed without doing an update.

Tried now in Avast to open up the port 993 (which I use now) for SABnzbd, but didn't work, but I saw that the port 443 was open in Avast for an earlier version of SABNzbd (4.0.3).

So maybe I could try with a other newsreader which works with the port 443, any ideas?

Was happy with easynews till now, but maybe I have to change if it works out.

[sander]

It's not the fault of easynews. So changing to another provider won't help that.

[megasteck]

I know it's not their fault, it's Avast's fault, just didn't know what else to try

[sander]

I don't use Windows, might you might discuss if you a need firewall if you're on your LAN, and if so, why not Windows built-in firewall.

[megasteck]

I will contact Avast directly and try to find a solution with them, it's not illegal to use SAbnzbd so I can look with them, maybe they find a solution.

On windows it's safer to have an antivir and till now everything worked with avast, so I have to find a solution.


Thanks for your suggestions.

Maybe somebody else here in the forum has the same problems with avast or even found a solution.

[sander]

On windows it's safer to have an antivir and till now everything worked with avast, so I have to find a solution.

Anti-virus? Certainly. But this problem is caused by the firewall, not the virus scanner.

Avast Firewall: https://support.avast.com/en-us/article ... rewall/#pc

[megasteck]

I know that, I have more services from Avast, Anti-virus, firewall etc.

I opened up the ports and gave Sabnzbd all possible rights there is, and two days ago everything worked.

Yeah if I don't find a solution I have to deactivate the firewall from Avast and leave the rest on and activate the windows firewall, but that is the last solution.

So it has to do something with an update from Avast or something like that.

[megasteck]

Maybe I can try out a different "hostname" from easynews in the settings of SABnzbd which Avast finds "secure" so it doesn't block it?

What do you think?

[megasteck]

I have to deactivate the whole Avast (Virusscanner + Firewall) that I works not just the firewall.

If I have Avast activated I can't even change and save the changes in the server settings of SABnzbd, have to deactivate it for that too.