Are you getting 403's when downloading? Please read here first

jconnary · February 24, 2025, 10:51am

Hello,

root@cfd696f32074:/# curl ipinfo.io
{
  "ip": "89.244.118.234",
  "city": "Koblenz",
  "region": "Rheinland-Pfalz",
  "country": "DE",
  "loc": "50.3536,7.5788",
  "org": "AS8881 1&1 Versatel Deutschland GmbH",
  "postal": "56073",
  "timezone": "Europe/Berlin",
  "readme": "https://ipinfo.io/missingauth"
}

Thanks in advance!

carly.richmond · February 24, 2025, 1:14pm

Hi @jconnary,

Welcome! Thanks for sharing your details. Can you confirm which Elastic artefact you are unable to download/ command you are running that is generating the 403?

jconnary · February 25, 2025, 8:07am

Hi Carly,

Well, it's not related to a specific integration and maybe this is the wrong thread, but I came across it whilst searching for a solution. I have a new installation that I'm trying to get working. So far it seems ok, but when I go the Add Integrations page, it never fully loads. I just get the spinning icon and all of the placeholders for integrations are just grey boxes. Here is a screenshot:

Sorry if my problem is not related to this. Just let me know and I'll open my own post.

Cheers,
Jeff

carly.richmond · February 25, 2025, 8:35am

Ok @jconnary, thanks for sharing. This might not be a forbidden issue. Can you share the output of the browser DevTools console and network calls?

If the network calls are showing 403 responses it could be the IP needs to be unblocked. Otherwise it's a different issue

Let us know!

jconnary · February 25, 2025, 8:57am

Thanks for the response @carly.richmond. Do you mean 403's like this:

carly.richmond · February 25, 2025, 8:59am

Exactly @jconnary! That's what I need. I'll raise a request with the internal team with the details and revert back with an update when I can.

Just a note that it can time some time for the requests to be actioned.

Hope the helps!

jconnary · February 25, 2025, 9:13am

That's great @carly.richmond ! Thanks very much for your quick help.

roman444uk · March 4, 2025, 5:32am

Hi!

curl ipinfo.io
{
  "ip": "185.195.170.168",
  "hostname": "mail.expressm-test.ru",
  "city": "Moscow",
  "region": "Moscow",
  "country": "RU",
  "loc": "55.7522,37.6156",
  "org": "AS199669 Okay-Telecom Ltd.",
  "postal": "101000",
  "timezone": "Europe/Moscow",
  "readme": "https://ipinfo.io/missingauth"
}

carly.richmond · March 4, 2025, 6:24am

Hi @roman444uk,

Welcome! Thanks for getting in touch. Sadly we're not unable to unblock that IP address.

Hope that helps!

Damien_Gustave · March 12, 2025, 3:47pm

Hi, please unblock this IP:

vagrant@vm:~$ curl ipinfo.io
{
  "ip": "51.159.222.46",
  "hostname": "2687956d-2b13-465a-8afd-4b6ff2963671.fr-par-2.baremetal.scw.cloud",
  "city": "Paris",
  "region": "Île-de-France",
  "country": "FR",
  "loc": "48.8534,2.3488",
  "org": "AS12876 SCALEWAY S.A.S.",
  "postal": "75000",
  "timezone": "Europe/Paris",
  "readme": "https://ipinfo.io/missingauth"
}

E: Failed to fetch https://artifacts.elastic.co/packages/6.x/apt/dists/stable/main/Contents-amd64  403  Forbidden [IP: 34.120.127.130 443]

carly.richmond · March 12, 2025, 5:42pm

Hi @Damien_Gustave,

Welcome! I assume you are trying to download an asset via wget, and potentially an older asset? Can you confirm which asset you are trying to download and if you are able to download a more recent version of an asset such as Elasticsearch 8.17?

I'm not able to access the above resource either so I want to confirm first.

Let us know!

Damien_Gustave · March 13, 2025, 8:41am

I am trying to access the debian repository of the 6.x version.

I tried with a wget directly. What interesting is that it is working directly on the machine. But I want to download the artifact from a virtual machine.

So, directly from the host machine it does work:

damien@tools-2:~/vm-setup/vagrant-base-box$ curl ipinfo.io
{
  "ip": "51.159.222.46",
  "hostname": "2687956d-2b13-465a-8afd-4b6ff2963671.fr-par-2.baremetal.scw.cloud",
  "city": "Paris",
  "region": "Île-de-France",
  "country": "FR",
  "loc": "48.8534,2.3488",
  "org": "AS12876 SCALEWAY S.A.S.",
  "postal": "75000",
  "timezone": "Europe/Paris",
  "readme": "https://ipinfo.io/missingauth"
damien@tools-2:~/vm-setup/vagrant-base-box$ wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.23.deb
--2025-03-13 09:33:27--  https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.23.deb
Resolving artifacts.elastic.co (artifacts.elastic.co)... 2600:1901:0:1d7::, 34.120.127.130
Connecting to artifacts.elastic.co (artifacts.elastic.co)|2600:1901:0:1d7::|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 149205680 (142M) [binary/octet-stream]
Saving to: ‘elasticsearch-6.8.23.deb’

elasticsearch-6.8.2 100%[===================>] 142.29M  28.8MB/s    in 5.6s    

2025-03-13 09:33:33 (25.2 MB/s) - ‘elasticsearch-6.8.23.deb’ saved [149205680/149205680]

But for a virtual machine it does not (obviously the ip info is the same):

vagrant@vm:~$ curl ipinfo.io
{
  "ip": "51.159.222.46",
  "hostname": "2687956d-2b13-465a-8afd-4b6ff2963671.fr-par-2.baremetal.scw.cloud",
  "city": "Paris",
  "region": "Île-de-France",
  "country": "FR",
  "loc": "48.8534,2.3488",
  "org": "AS12876 SCALEWAY S.A.S.",
  "postal": "75000",
  "timezone": "Europe/Paris",
  "readme": "https://ipinfo.io/missingauth"
vagrant@vm:~$ wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.23.deb
--2025-03-13 09:34:21--  https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.23.deb
Resolving artifacts.elastic.co (artifacts.elastic.co)... 34.120.127.130, 2600:1901:0:1d7::
Connecting to artifacts.elastic.co (artifacts.elastic.co)|34.120.127.130|:443... connected.
HTTP request sent, awaiting response... 403 Forbidden
2025-03-13 09:34:21 ERROR 403: Forbidden.

One time it even breaks in the middle:

vagrant@vm:~$ wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.23.deb
--2025-03-13 09:33:06--  https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.23.deb
Resolving artifacts.elastic.co (artifacts.elastic.co)... 34.120.127.130, 2600:1901:0:1d7::
Connecting to artifacts.elastic.co (artifacts.elastic.co)|34.120.127.130|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 149205680 (142M) [binary/octet-stream]
Saving to: ‘elasticsearch-6.8.23.deb’

elasticsearch-6.8.2  25%[====>               ]  36.00M  78.1MB/s    in 0.5s    

2025-03-13 09:33:07 (78.1 MB/s) - Read error at byte 37748448/149205680 (The TLS connection was non-properly terminated.). Retrying.

--2025-03-13 09:33:08--  (try: 2)  https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.23.deb
Connecting to artifacts.elastic.co (artifacts.elastic.co)|34.120.127.130|:443... connected.
HTTP request sent, awaiting response... 403 Forbidden
2025-03-13 09:33:08 ERROR 403: Forbidden.

Finally, the virtual machine itself works fine since I can download everything but your artifacts.

I don't know what filter you use but it's not only the source IP.

carly.richmond · March 13, 2025, 10:25am

Thanks for confirming @Damien_Gustave. Elastic v6.x is a pretty old version that is past EOL. We would recommend using a more recent version if possible.

It's interesting that downloads work fine on the box but not the virtual machine. Does your virtual machine configuration have IPv6 enabled? If so I would recommend disabling that and trying again.

Let us know!

Damien_Gustave · March 13, 2025, 10:55am

Yes, I know this is an very old version, for now we have ne resource internally to do the switch.

I have no ipv6 on the VM, but I do on the host

VM:

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 08:00:27:1c:1d:05 brd ff:ff:ff:ff:ff:ff
    altname enp0s3
    inet 10.0.2.15/24 brd 10.0.2.255 scope global dynamic eth0
       valid_lft 63217sec preferred_lft 63217sec
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 08:00:27:3a:99:85 brd ff:ff:ff:ff:ff:ff
    altname enp0s8
    inet 192.168.56.254/24 brd 192.168.56.255 scope global dynamic eth1
       valid_lft 355sec preferred_lft 355sec

Host:

2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 44:a8:42:09:5f:46 brd ff:ff:ff:ff:ff:ff
    altname enp2s0f0
    inet 51.159.76.22/32 brd 51.159.76.22 scope global eno1:1
       valid_lft forever preferred_lft forever
    inet 51.159.222.46/24 brd 51.159.222.255 scope global eno1
       valid_lft forever preferred_lft forever
    inet 51.159.197.204/24 brd 51.159.197.255 scope global eno1:0
       valid_lft forever preferred_lft forever
    inet6 2001:bc8:1201:641:46a8:42ff:fe09:5f46/64 scope global dynamic mngtmpaddr 
       valid_lft 2591999sec preferred_lft 604799sec
    inet6 fe80::46a8:42ff:fe09:5f46/64 scope link 
       valid_lft forever preferred_lft forever

The behaviour is very erratic, as, in a 30 second window, I was able to download the file once, then a 403, and right after, a success:

vagrant@vm:~$ wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.23.deb
--2025-03-13 11:52:58--  https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.23.deb
Resolving artifacts.elastic.co (artifacts.elastic.co)... 34.120.127.130, 2600:1901:0:1d7::
Connecting to artifacts.elastic.co (artifacts.elastic.co)|34.120.127.130|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 149205680 (142M) [binary/octet-stream]
Saving to: ‘elasticsearch-6.8.23.deb’

elasticsearch-6.8.2 100%[===================>] 142.29M  90.6MB/s    in 1.6s    

2025-03-13 11:53:00 (90.6 MB/s) - ‘elasticsearch-6.8.23.deb’ saved [149205680/149205680]

vagrant@vm:~$ wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.23.deb
--2025-03-13 11:53:49--  https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.23.deb
Resolving artifacts.elastic.co (artifacts.elastic.co)... 34.120.127.130, 2600:1901:0:1d7::
Connecting to artifacts.elastic.co (artifacts.elastic.co)|34.120.127.130|:443... connected.
HTTP request sent, awaiting response... 403 Forbidden
2025-03-13 11:53:50 ERROR 403: Forbidden.
              wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.23.deb^Clasticsearch-6.8.23.deb*
vagrant@vm:~$ ^C
vagrant@vm:~$ wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.23.deb
--2025-03-13 11:53:58--  https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.23.deb
Resolving artifacts.elastic.co (artifacts.elastic.co)... 34.120.127.130, 2600:1901:0:1d7::
Connecting to artifacts.elastic.co (artifacts.elastic.co)|34.120.127.130|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 149205680 (142M) [binary/octet-stream]
Saving to: ‘elasticsearch-6.8.23.deb.1’

elasticsearch-6.8.2 100%[===================>] 142.29M  66.9MB/s    in 2.1s    

2025-03-13 11:54:01 (66.9 MB/s) - ‘elasticsearch-6.8.23.deb.1’ saved [149205680/149205680]

carly.richmond · March 13, 2025, 12:07pm

Thanks for sharing @Damien_Gustave. It looks like you've now been able to download the install from your latest message. If not, I would recommend trying to disable IPv6 on the host.

Hope that helps!

Damien_Gustave · March 13, 2025, 12:37pm

Well, that don't resolve the issue since this process run within a continuous integration system daily, we need it to work every time.

carly.richmond · March 13, 2025, 1:02pm

Makes sense @Damien_Gustave! Can you try disabling IPv6 on the host as I suggest above?

Damien_Gustave · March 13, 2025, 3:50pm

I did and it did not improve things:

sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
15:28:00 [admin@tools-2|euwest1|:~] $ ip a
[...]
2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 44:a8:42:09:5f:46 brd ff:ff:ff:ff:ff:ff
    altname enp2s0f0
    inet 51.159.76.22/32 brd 51.159.76.22 scope global eno1:1
       valid_lft forever preferred_lft forever
    inet 51.159.222.46/24 brd 51.159.222.255 scope global eno1
       valid_lft forever preferred_lft forever
    inet 51.159.197.204/24 brd 51.159.197.255 scope global eno1:0
       valid_lft forever preferred_lft forever

After restarting the virtual box VM:

vagrant@vm:~$ wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.23.deb
--2025-03-13 16:48:50--  https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.23.deb
Resolving artifacts.elastic.co (artifacts.elastic.co)... 34.120.127.130, 2600:1901:0:1d7::
Connecting to artifacts.elastic.co (artifacts.elastic.co)|34.120.127.130|:443... connected.
HTTP request sent, awaiting response... 403 Forbidden
2025-03-13 16:48:50 ERROR 403: Forbidden.

As you can see this is using ipv4 to connect:

Connecting to artifacts.elastic.co (artifacts.elastic.co)|34.120.127.130|:443... connected

Damien_Gustave · March 17, 2025, 10:29am

Today, it's even the host that do not have access anymore...

damien@tools-2:~/vm-setup$ wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.23.deb
--2025-03-17 11:27:19--  https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.23.deb
Resolving artifacts.elastic.co (artifacts.elastic.co)... 34.120.127.130, 2600:1901:0:1d7::
Connecting to artifacts.elastic.co (artifacts.elastic.co)|34.120.127.130|:443... connected.
HTTP request sent, awaiting response... 403 Forbidden
2025-03-17 11:27:19 ERROR 403: Forbidden.

Please unblock my server.

damien@tools-2:~/vm-setup$ curl ipinfo.io
{
  "ip": "51.159.222.46",
  "hostname": "2687956d-2b13-465a-8afd-4b6ff2963671.fr-par-2.baremetal.scw.cloud",
  "city": "Paris",
  "region": "Île-de-France",
  "country": "FR",
  "loc": "48.8534,2.3488",
  "org": "AS12876 SCALEWAY S.A.S.",
  "postal": "75000",
  "timezone": "Europe/Paris",
  "readme": "https://ipinfo.io/missingauth"
}

carly.richmond · March 17, 2025, 12:10pm

Thanks for confirming @Damien_Gustave. With IPv6 disabled I don't see any obvious reason for the block, so I've raised a request to the team to check and unblock if possible. I'll update you when I hear back.

Hope that helps!

Topic		Replies	Views
Official apt repository (451 Unavailable For Legal Reasons) Elasticsearch	75	6956	August 10, 2020
Artifacts.elastic.co responds with 403 Meta Elastic	4	3411	May 31, 2022
Why artifacts.elastic.co/GPG-KEY-elasticsearch returns 403 for russian IPs, but not always? Вопросы на русском языке	28	6789	August 14, 2022
Getting 403 denied to elastic.co (for anything: apt refresh, wget, etc) Meta Elastic	14	16196	June 6, 2022
Forbidden IP errors? incompetent elastic team Meta Elastic	4	143	September 9, 2025

Are you getting 403's when downloading? Please read here first

Related topics