Database update process failed: Forbidden; Blocked by CDN

[bilias]

I'm getting those:

WARNING: You are on cool-down until after: 2025-10-31 10:28:27
WARNING: fc_download_url_databases: fc_download_url_database failed: Forbidden; Blocked by CDN (17)
ERROR: Database update process failed: Forbidden; Blocked by CDN
ERROR: Update failed.

Can you please check the following block:
cf-ray: 9968dcadda7b9835-ATH
cf-ray: 99698a0fbfa6517b-ATH
cf-ray: 9969948b99a65945-ATH
cf-ray: 9969a09698d0be00-ATH

running version: 1.4.3
and the funny thing is that we do have a private mirror to download from

grep ^DatabaseMirror /etc/freshclam.conf
DatabaseMirror cvd.xxx.xx

Our mirror downloads fine:

# /usr/local/bin/cvd update
2025-10-30 10:32:23 cvdupdate-1.1.1 WARNING You are running cvdupdate version: 1.1.1.
2025-10-30 10:32:23 cvdupdate-1.1.1 WARNING There is a newer version on PyPI: 1.2.0. Please update!
2025-10-30 10:32:23 cvdupdate-1.1.1 INFO Using system configured nameservers
2025-10-30 10:32:23 cvdupdate-1.1.1 INFO main.cvd is up-to-date. Version: 62
2025-10-30 10:32:23 cvdupdate-1.1.1 INFO daily.cvd is up-to-date. Version: 27807
2025-10-30 10:32:23 cvdupdate-1.1.1 INFO bytecode.cvd is up-to-date. Version: 339

[val-ms]

Hi @bilias sorry for the long lag time responding to your message.

Our cloudflare account admin looked up the records for the cf-ray's you provided and found that you're hitting the rate limiter.
Rate limiting done using the User-Agent HTTP header which for freshclam contains a UUID that is generated by freshclam the first time you run it and stored in a freshclam.dat file inside the database directory.

A single installation should never hit the rate limiter unless something weird is going on, such as sharing that freshclam.dat file with other clamav installations, or else repeatedly downloading daily.cvd or main.cvd (as in deleting the originals and doing it again, without deleting the freshclam.dat file). One other possibility is repeated failed attempts to download those files, like if they timed out or something mid-download and you had to try again repeatedly.

Can you tell me if any of these situations would apply in your case?

[bilias]

I've managed to solve this a week ago that's why I didn't bothered you again about this.

I also had DatabaseCustomURL with securiteinfo signature which where failing because the subscription was expired.
I've commented out securiteinfo and deleted freshclam.dat myself and I was able to resume downloads for normal clamav signatures.

I though it was a some kind of bug, taking the deny from securiteinfo as a block from clamav CDN, but you say that you found my cf-ray's in your database so it was a block.
I was using the same file in two servers (2nd server was clone of first).
And the servers are downloading every 4 hours. Can't remember if I manually tried something repeatedly.

Why was I blocked on the first place, since I use a private mirror?
DatabaseMirror cvd.xxx.xxx.xxx

Do I also need to set PrivateMirror ?

[val-ms]

I've commented out securiteinfo and deleted freshclam.dat myself and I was able to resume downloads for normal clamav signatures.

I've seen a similar issue, also regarding securiteinfo: #1419

I though it was a some kind of bug, taking the deny from securiteinfo as a block from clamav CDN,

I agree this is a bug. Failed attempts to download files with the DatabaseCustomURL option should not trigger self-rate limiting. We have an internal Jira ticket (CLAM-2725) to address how freshclam 403 errors don't distinguish between official/unofficial sources. I will add this information to that bug, since it's basically the same issue.

but you say that you found my cf-ray's in your database so it was a block.

That's what I was told. I don't have personal visibility into the logs.

Why was I blocked on the first place, since I use a private mirror?
DatabaseMirror cvd.xxx.xxx.xxx

The freshclam program has logic to prevent it from trying to update again for 24 hours if it knows it has been blocked or rate limited. This is we observed a sizeable amount of bandwidth going to repeated blocking of the same freshclam clients--E.g., from people setting up freshclam in a retry-loop. That self-rate-limiting behavior is the same whether DatabaseMirror points to database.clamav.net or somewhere else. Deleting the freshclam.dat file clears freshclam's memory which is why it works again after.

Do I also need to set PrivateMirror ?

There are two ways to source signatures for hosting your own private mirror:

1. cvdupdate: this downloads the latest version of each .cvd signature archive as well as each .cdiff patch file, enabling you to host a mirror that is functionally identical to database.clamav.net. Of note: with cvdupdate version 1.2.0, it will also download .cvd.sign and .cdiff.sign digital signature files used by ClamAV 1.5 to verify the authenticity and integrity of .cvd and .cdiff files. The files served would be something like this:

bytecode-338.cdiff
bytecode-339.cdiff
bytecode-339.cdiff.sign
bytecode-339.cvd.sign
bytecode.cvd
daily-27811.cdiff
daily-27811.cdiff.sign
daily-27812.cdiff
daily-27812.cdiff.sign
daily-27813.cdiff
daily-27813.cdiff.sign
daily-27814.cdiff
daily-27814.cdiff.sign
daily-27814.cvd.sign
daily.cvd
main-62.cdiff
main-62.cdiff.sign
main-62.cvd.sign
main.cvd

2. freshclam: as you probably know, the first time you run this, it will download .cvd signature archives, and with clamav 1.5 it will also download the associated .cvd.sign digital signature. In subsequent updates, it will download a .cdiff (and .cdiff.sign file to patch the .cvd or .cld signature archive. That process deletes the old signature archive and also the downloaded patch file and signature file. Unlike with cvdupdate, the are not retained. And the patched signature archives are .cld files, replacing the original .cvd files. So for example, if you had:

bytecode-339.cvd.sign
bytecode.cvd
daily-27814.cvd.sign
daily.cvd
main-62.cvd.sign
main.cvd

and if you used freshclam to update, on most days only the daily database gets updated. The result would be:

bytecode-339.cvd.sign
bytecode.cvd
daily.cld
main-62.cvd.sign
main.cvd

As you can see, that means any freshclam downstream of this mirror will have to know to download the unsigned daily.cld file instead of the signed daily.cvd file.

So to answer your question:

DatabaseMirror is intended to be used with:

1. database.clamav.net, or
2. when using cvdupdate source signatures for your own private mirror which works the same way as database.clamav.net

PrivateMirror is the alternative to DatabaseMirror to be used when using freshclam to source signatures. Using PrivateMirror will make freshclam prioritize downloading .cld signature archives over .cvd signature archives, and will disable the .cdiff patch-based update mechanism.