{"action":"created","issue":{"url":"https://api.github.com/repos/e2guardian/e2guardian/issues/464","repository_url":"https://api.github.com/repos/e2guardian/e2guardian","labels_url":"https://api.github.com/repos/e2guardian/e2guardian/issues/464/labels{/name}","comments_url":"https://api.github.com/repos/e2guardian/e2guardian/issues/464/comments","events_url":"https://api.github.com/repos/e2guardian/e2guardian/issues/464/events","html_url":"https://github.com/e2guardian/e2guardian/issues/464","id":372569800,"node_id":"MDU6SXNzdWUzNzI1Njk4MDA=","number":464,"title":"v5.2.2: NTLM + download .exe filter failed on sites with HTTP but works on HTTPS (MITM active)","user":{"login":"Schroeffu","id":12001003,"node_id":"MDQ6VXNlcjEyMDAxMDAz","avatar_url":"https://avatars0.githubusercontent.com/u/12001003?v=4","gravatar_id":"","url":"https://api.github.com/users/Schroeffu","html_url":"https://github.com/Schroeffu","followers_url":"https://api.github.com/users/Schroeffu/followers","following_url":"https://api.github.com/users/Schroeffu/following{/other_user}","gists_url":"https://api.github.com/users/Schroeffu/gists{/gist_id}","starred_url":"https://api.github.com/users/Schroeffu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Schroeffu/subscriptions","organizations_url":"https://api.github.com/users/Schroeffu/orgs","repos_url":"https://api.github.com/users/Schroeffu/repos","events_url":"https://api.github.com/users/Schroeffu/events{/privacy}","received_events_url":"https://api.github.com/users/Schroeffu/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2018-10-22T15:29:26Z","updated_at":"2018-10-23T09:55:29Z","closed_at":null,"author_association":"NONE","body":"I have E2Guardian active with Squid NTLM authentification and MITM (e2guardian). Furthermore I have 4 filter Groups: filter1-3 cannot download .exe files && executable MIME types, filter4 is allowed to do. The following test-case is done with a user in xxxx=filter4\r\n\r\nThe .exe Extension/MIME Type Filter is working correct on any HTTPS site, filter1-3 is blocked, filter4 can download. But on unencrypted HTTP sites the filter4 is not working. It does block the download with my filter=4 user. Again: In a 2nd tab, test-download an .exe over https, the filter4 is correctly allowing me download the .exe file.\r\n\r\n`Test-Download URL HTTP: http://prdownloads.sourceforge.net/filezilla/FileZilla_3.2.7.1_win32-setup.exe`\r\n\r\n`Test-Download URL HTTPS: https://download.filezilla-project.org/client/FileZilla_3.37.4_win64-setup_bundled.exe`\r\n\r\nLog HTTP download:\r\n\r\n```\r\n1540221802.291          -       172.16.5.15     172.16.5.15     http://prdownloads.sourceforge.net/filezilla/FileZilla_3.2.7.1_win32-setup.exe  GET     403     0       -       -       -       0       -       900     *VERWEIGERT* Verbotene Datei-Erweiterung: .exe       0       -       InternetAccessLevel0    1\r\n1540221802.334          -       172.16.5.15     172.16.5.15     http://prdownloads.sourceforge.net/favicon.ico  GET     407     4005    -       -       -       0       -       0       *VERTRAUENSWÜRDIG* -    0       -       InternetAccessLevel0 1\r\n```\r\n\r\nBut in a 2nd tab, download an .exe with HTTPS is working. Don't ask me why there is no username in logfile, another bug? See also https://github.com/e2guardian/e2guardian/issues/441\r\n\r\nLog HTTPS download: \r\n```\r\n1540221925.434          -       172.16.5.15     172.16.5.15     https://download.filezilla-project.org:443      CONNECT 407     3632    -       -       -       0       -       0       *VERTRAUENSWÜRDIG* -    0       -       InternetAccessLevel0 1\r\n1540221925.434          -       172.16.5.15     172.16.5.15     https://download.filezilla-project.org:443      CONNECT 407     3632    -       -       -       0       -       0       *VERTRAUENSWÜRDIG* -    0       -       InternetAccessLevel0 1\r\n```\r\n\r\nFor sites on \"exceptionsitelist\" the user is logged properly. For example I have google.com on this exceptionsitelist whitelisted. Example Log:\r\n\r\n```\r\n1540222050.755          schroeffu  172.16.5.15     172.16.5.15     https://sb-ssl.google.com:443   CONNECT 200     4885    -       -       -       120329  -       602     *VERTRAUENSWÜRDIG* Übereinstimmung mit Seite in Ausnahmelistegoogle.com      0       -       InternetAccessLevel3    4\r\n```\r\n\r\nIf I have to debug the main issue more, can somebody explain me how to enable Debug in the Pre-Compiled Ubuntu 18.04 .deb Version?\r\n\r\nThanks!\r\nSchroeffu"},"comment":{"url":"https://api.github.com/repos/e2guardian/e2guardian/issues/comments/432180522","html_url":"https://github.com/e2guardian/e2guardian/issues/464#issuecomment-432180522","issue_url":"https://api.github.com/repos/e2guardian/e2guardian/issues/464","id":432180522,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMjE4MDUyMg==","user":{"login":"Schroeffu","id":12001003,"node_id":"MDQ6VXNlcjEyMDAxMDAz","avatar_url":"https://avatars0.githubusercontent.com/u/12001003?v=4","gravatar_id":"","url":"https://api.github.com/users/Schroeffu","html_url":"https://github.com/Schroeffu","followers_url":"https://api.github.com/users/Schroeffu/followers","following_url":"https://api.github.com/users/Schroeffu/following{/other_user}","gists_url":"https://api.github.com/users/Schroeffu/gists{/gist_id}","starred_url":"https://api.github.com/users/Schroeffu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Schroeffu/subscriptions","organizations_url":"https://api.github.com/users/Schroeffu/orgs","repos_url":"https://api.github.com/users/Schroeffu/repos","events_url":"https://api.github.com/users/Schroeffu/events{/privacy}","received_events_url":"https://api.github.com/users/Schroeffu/received_events","type":"User","site_admin":false},"created_at":"2018-10-23T09:55:29Z","updated_at":"2018-10-23T09:55:29Z","author_association":"NONE","body":"> what do you see in squid, nothing ?\r\n\r\nYes, that request is not logged in SQUID.\r\nThe browser is trying to load the favicon URL, thats the only request which i see in squid/access.log:\r\n\r\ntail -f /var/log/e2guardian/access.log /var/log/squid/access.log\r\n```\r\n==> /var/log/e2guardian/access.log <==\r\n1540288276.130          -       172.16.5.15     172.16.5.15     https://www.google.de:443       CONNECT 407     3742    -       -       -       41      -       602     *VERTRAUENSWÜRDIG* Übereinstimmung mit Seite in Ausnahmelistegoogle.de       0       -       InternetAccessLevel0    1\r\n1540288277.240          -       172.16.5.15     172.16.5.15     http://downloads.signotec.com/signoPAD-Tools/signotec_signoPADTools_3.1.9_64Bit.exe     GET     403     0       -       -       -       0       -       900     *VERWEIGERT* Verbotene Datei-Erweiterung: .exe       0       -       InternetAccessLevel0    1\r\n\r\n==> /var/log/squid/access.log <==\r\n1540288277.402      0 127.0.0.1 TCP_DENIED/407 4617 GET http://downloads.signotec.com/favicon.ico - HIER_NONE/- text/html\r\n\r\n==> /var/log/e2guardian/access.log <==\r\n1540288277.402          -       172.16.5.15     172.16.5.15     http://downloads.signotec.com/favicon.ico       GET     407     4109    -       -       -       0       -       0       *VERTRAUENSWÜRDIG* -    0       -       InternetAccessLevel0 1\r\n```"}}
{"actor":{"display_login":"Schroeffu"}}