AUR connection issues (EOF/TLS errors)

Robertderidder · 2026-06-02 13:35:50

Hello, I keep having trouble with the AUR. Even though status.archlinux.org reports no outage. I keep getting an EOF error. Is this something I should fix on my side? Is it still a result of the DDOS attacks? Do more people have this problem?

seth · 2026-06-02 13:51:14

If the problem remains report the problem along your WAN IP to accountsupport@archlinux.org - you're probably running into the DDOS mitigation

gromit · 2026-06-02 14:21:59

Yes that is correct, the AUR should overall be up and running

Lenry · 2026-08-18 18:19:48

I'm getting the same error message, but it seems like it depends on your provider. I have two WAN connections, from the hungarian Digi network it works, but from the hungarian Telekom it doesn't

raggerv8 · 2026-08-18 19:54:45

I was even on the AUR earlier today and clicked “view changes” on a package and it failed to load. Now I have been unable to reach the AUR for a few hours.

Last edited by raggerv8 (2026-08-18 19:55:01)

seth · 2026-08-18 20:06:21

https://status.archlinux.org

vicbis · 2026-10-04 23:54:55

This is happening with me. It's rather annoying since I have to use a VPN get access to the AUR repository.

1: Please don't point me at "https://status.archlinux.org" because it states it is up (and I still cannot access)
2: My external IP address (that I usually use) is 138.217.204.154
3: Since from October 1 at approx 00:00 (GMT) it's been blocked, before that everything was operational.
4: I don't know how the 'bans' work but the only thing I installed and used is 'traur scan'
5: This link (that I was sent) https://gitlab.archlinux.org/archlinux/ … ecture.png does not provide any info on why my IP address is 'banned'
6: As for the '1 hour' ban, well it's now been 4 days.
7: No, there are no automated scripts that accesses the repository, I do updates manually on weekdays and that's only usually a few packages per day and been doing this for a number of years.
8: No, no one else accesses the repository at this IP address as 1: All other staff are using Windows and 2: other linux related uses here (at work) are Ubuntu machines.
9: It's nothing on my laptop as if I do AUR updates from an alternative IP address I have no problems.
10: The non-AUR updates are not affected.

vicb@ava [ ~ ]$ openssl s_client -tls1_2 -connect aur.archlinux.org:443 -servername aur.archlinux.org </dev/null 
Connecting to 209.126.35.78
CONNECTED(00000003)
4054FC4B607F0000:error:0A000126:SSL routines::unexpected eof while reading:ssl/record/rec_layer_s3.c:698:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 222 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Protocol: TLSv1.2
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1791156098
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---
4054FC4B607F0000:error:0A000197:SSL routines:SSL_shutdown:shutdown while in init:ssl/ssl_lib.c:2804:

Whereas from another server:

 vicb@<redacted incase of this ip/domain gets banned as well> [ ~ ]$ openssl s_client -tls1_2 -connect aur.archlinux.org:443 -servername aur.archlinux.org </dev/null 
Connecting to 209.126.35.78
CONNECTED(00000003)
depth=3 C=US, O=Internet Security Research Group, CN=ISRG Root X2
verify return:1
depth=2 C=US, O=ISRG, CN=Root YE
verify return:1
depth=1 C=US, O=Let's Encrypt, CN=YE1
verify return:1
depth=0 CN=aur.archlinux.org
verify return:1
---
Certificate chain
 0 s:CN=aur.archlinux.org
   i:C=US, O=Let's Encrypt, CN=YE1
   a:PKEY: EC, (prime256v1); sigalg: ecdsa-with-SHA384
   v:NotBefore: Aug 12 18:47:39 2026 GMT; NotAfter: Nov 10 18:47:38 2026 GMT
 1 s:C=US, O=Let's Encrypt, CN=YE1
   i:C=US, O=ISRG, CN=Root YE
   a:PKEY: EC, (secp384r1); sigalg: ecdsa-with-SHA384
   v:NotBefore: Sep  3 00:00:00 2025 GMT; NotAfter: Sep  2 23:59:59 2028 GMT
 2 s:C=US, O=ISRG, CN=Root YE
   i:C=US, O=Internet Security Research Group, CN=ISRG Root X2
   a:PKEY: EC, (secp384r1); sigalg: ecdsa-with-SHA384
   v:NotBefore: May 13 00:00:00 2026 GMT; NotAfter: Sep  2 23:59:59 2032 GMT
 3 s:C=US, O=Internet Security Research Group, CN=ISRG Root X2
   i:C=US, O=Internet Security Research Group, CN=ISRG Root X1
   a:PKEY: EC, (secp384r1); sigalg: sha256WithRSAEncryption
   v:NotBefore: May 13 00:00:00 2026 GMT; NotAfter: Sep  2 23:59:59 2032 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDjzCCAxagAwIBAgISBT72njVzlvin4/JLjQW3CEcnMAoGCCqGSM49BAMDMDMx
.
. (etc)
.
.

If it comes to It, I'll just have to use a VPN … but that's not the point.

Pillendreher · 2026-10-05 04:31:55

vicbis wrote:

4: I don't know how the 'bans' work but the only thing I installed and used is 'traur scan'

Been suffering from the same issue since Thursday and I too installed traur on my Desktop system. When I tried to do the same on my laptop an hour later, I could not access aur any longer. Spent an hour trying to figure out if Adguard Home was responsible before I stumbled onto this thread. The ban on my external IP (83.164.61.***) has not been lifted as of yet. Maybe the initial traur scan triggered some sort of rate limit?

seth · 2026-10-05 06:49:58

Why would anyone point out status.archlinux.org when that's not an ongoing situation?
(Though as you can see the AUR has been a bit spotty the last few days)

Don't post your WAN IP into the public, https://www.openstreetmap.org/#map=18/- … 144.962062
Report it to accountsupport@archlinux.org

traur (written by claude) polls the AUR to query metadata, might have gone rogue.
=> https://wiki.archlinux.org/title/Wireshark

vicbis · 2026-10-05 11:05:06

1: It's got nothing to do with AUR being down. I can set an 'at' job to fire at exactly the same time and on two different servers at two different IP addresses and still get the same results in my post.
2: Yes that's the Lonsdale street telephone exchange — I'm not there.
3: Yes I've sent an email to 'accountsupport@archlinux.org ... and basically got no useful information from them.

From: "XXXXXXXX XXXXXX (@gromit)" <gitlab@gitlab.archlinux.org>
Reply-To: Arch Linux / Service Desks / Account support <incoming+6-46XXXXXXXXXXXXXXXXXXXXXXXX-XXX@gitlab.archlinux.org>
To: <me>
Subject: Re: AUR TLS handshake dropped from XXX.XXX.XXX.XXX (0 bytes read)

New response for issue #XXXXX:

Author: XXXXXXXXX XXXXXX 

Hello,

that is most likely due to rate-limits being exceeded by the IPs in question, do you have anything that programatically accesses our services or just a lot of users? :thinking:

If you're curious on why this happens, here is is diagram for our setup: https://gitlab.archlinux.org/archlinux/infrastructure/-/blob/b727817071794eeea73bd467467c8e7f1bd566d8/docs/graphs/HAProxy-service-architecture.png 

Cheers,
XXXXX

I've replied in detail October 2, but to no avail. The silence is deafening and as I type now it's still blocked (nearly 5 days now).

4: I'm not going to test with wireshark as that will most likely put another (permanent) ban on whatever IP address I'm going to use.

5: So much for AI written code. Was it fully tested, probably not.

5: My solution:

vicb@ava [~] sudo pacman -R traur # AUR may flag a DDOS attack at AUR from here therefore deleting.

seth · 2026-10-05 12:07:46

1: It's got nothing to do with AUR being down. I can set an 'at' job to fire at exactly the same time and on two different servers at two different IP addresses and still get the same results in my post.

Yes, that's why I don't understand why you'd preemptively warn people to no bring it up - the entire point is just insane.

4: I'm not going to test with wireshark as that will most likely put another (permanent) ban on whatever IP address I'm going to use.

Wireshark is going to do exactly nothing like that - it allows you to monitor your traffic to see whether and what is currently banging the AUR from your host.
You can try and see whether that's actually traur but even if you're not risking that, you can passively check that this is currently not happening.

If you're behind a CGN it's also possible that this is completely unrelated to your system - have you tried to restart your modem to hopefully get a different IP from your ISP?

rharish · Yesterday 20:34:40

Same issue here from Switzerland, with my home internet, but it works somehow from my mobile phone's carrier's internet (via an Android hotspot). I'm behind CGNAT, if that helps.

Also, only HTTP(S) seems to be blocked, while SSH works. So a

git clone aur@aur.archlinux.org:PKG.git

works via my AUR SSH key (I maintain a few AUR packages), while

git clone https://aur.archlinux.org/PKG.git

doesn't.

Last edited by rharish (Yesterday 20:38:04)

Akela · Today 19:43:55

Hello,

I am experiencing the exact same TLS connection error (`unexpected eof while reading`) when trying to access `aur.archlinux.org` via browser or `yay`.

Here are my connection details:
- **ISP:** AS8193 ("Uzbektelekom" Joint Stock Company)
- **IP Range (Subnet):** 213.230.64.0/18 (Announced: 213.230.78.0/24)
- My IP - 213.230.78.xxx
-**Location:** Uzbekistan

**Diagnostic details:**
- `curl -v https://aur.archlinux.org` fails with `TLS connect error: error:0A000126:SSL routines::unexpected eof while reading`.
- Handshake drops immediately at `Client Hello` stage.
- Connections work fine when using a VPN or an alternative network interface.

Could you please check if our ISP's IP range was affected by rate-limiting or DDoS mitigation filters?

Thank you!

Arch Linux

#101 2026-06-02 13:35:50

Re: AUR connection issues (EOF/TLS errors)

#102 2026-06-02 13:51:14

Re: AUR connection issues (EOF/TLS errors)

#103 2026-06-02 14:21:59

Re: AUR connection issues (EOF/TLS errors)

#104 2026-08-18 18:19:48

Re: AUR connection issues (EOF/TLS errors)

#105 2026-08-18 19:54:45

Re: AUR connection issues (EOF/TLS errors)

#106 2026-08-18 20:06:21

Re: AUR connection issues (EOF/TLS errors)

#107 2026-10-04 23:54:55

Re: AUR connection issues (EOF/TLS errors)

#108 2026-10-05 04:31:55

Re: AUR connection issues (EOF/TLS errors)

#109 2026-10-05 06:49:58

Re: AUR connection issues (EOF/TLS errors)

#110 2026-10-05 11:05:06

Re: AUR connection issues (EOF/TLS errors)

#111 2026-10-05 12:07:46

Re: AUR connection issues (EOF/TLS errors)

#112 Yesterday 20:34:40

Re: AUR connection issues (EOF/TLS errors)

#113 Today 19:43:55

Re: AUR connection issues (EOF/TLS errors)

Board footer