Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 13 replies
  • Subscribers 3 subscribers
  • Views 2416 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DevOps administration ASMX authentication issue over UTM proxy

Mateusz Bender

We have an MS DevOps server running and exposed via UTM (no firewall, "pass host header" enabled). For almost everything this works absolutely fine - people are able to access the DevOps site, log in normally, commit code via GIT, etc.

However, certain administrative operations appear to be hampered. On the surface these calls seem to be just like any other DevOps call as they appear to be regular HTTP requests to just another URI this time being an ASMX service: /TeamFoundation/Administration/v3.0/LocationService.asmx

From what I can tell there are no custom authentication settings for that ASMX service vs any other part of the system, so I'm a bit confused why that particular part fails when it's passed via DevOps.

Any suggestions on what might be wrong? I guess I could install a local LE agent on the server and use some NAT rules to expose ports 80 and 443 directly but that eats up a public IP and generally feels like the wrong approach...

EDIT: To avoid needless spam. Turns out this is the same issue as described here: https://community.sophos.com/utm-firewall/f/hardware-installation-up2date-licensing/132837/waf-issues-after-updating-to-9-709-3/490536

Look at that thread for more information. I don't to mark this thread with an answer as that would be misleading (as there's currently no answer)...



This thread was automatically locked due to age.
  • 0 in reply to BAlfson

    Same thing with that path. And the service doesn't have any parameters - it doesn't even have its own web.config file, sharing the same configuration that the rest of DevOps uses (of course it's anyone's guess if MS doesn't do hack'y stuff in the backend).

  • 0 in reply to Mateusz Bender

    Is there a community for the DevOps application?  Maybe someone else has run into this with another Web Server Protection supplier.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    I fear the on-prem DevOps gets much less support than the on-line DevOps, both in terms of community and official support. And, given this doesn't seem like an isolated incident (see link to other forum post where other MS services are affected) I'm more inclined to believe this is a UTM issue.

Unfiltered HTML