Re: [squid-users] Squid -2.6 with Tproxy
Angel, Have you been able to implement it successfully. Rgds Sunil Angel Mieres wrote: Sunil, im trying to do the same that you are trying, i patched iptables 1.3.5 & 1.3.4 and the problem persist. Tino, have you work this succesfully? could you told me version have you used?(i refer iptables, patch aplied, kernel used, patch tproxy used...) Im using kernel 2.6.15.2 with balabit tproxy patch iptables 1.3.5 and squid 2.6 STABLE2 and always squid debug mode show me the same that show Sunil. I think that my problem is on iptables version and his patch. Regards, Angel M. Your iptables patch not complete fc5 use iptables rpm source, you need iptables from tar.gz/bz source - uninstall the iptables rpm, - download tar.gz/bz source from netfilter.org - patch it with iptables-1.3-cttproxy.diff before ./configure rgds, Tino - Original Message - From: "Sunil K.P." <[EMAIL PROTECTED]> To: Sent: Friday, August 11, 2006 4:33 PM Subject: [squid-users] Squid -2.6 with Tproxy Hi, I have squid 2.6 STABLE 2 running on FC 2.6.15.2. It is working fine in transparent mode. But I am trying to use Tproxy so that all the requests will spoofed to show the clients IP address and not the cache server. The patches have been applied to the kernel, compiled and applied as per procedure. After restarting the system the modules ipt_tproxy and ipt_TPROXY are loaded. The problem starts when I apply the following iptables rule iptables -t tproxy -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j TPROXY --on-port 3128 The traffic stops going thru the cache server. If the rule is removed the traffic goes smoothly. Cache.log shows the following error tproxy ip=192.168.10.11,0x9eec383e,port=0 ERROR ASSIGN There seems to be no proper documentation for implementation of tproxy with squid on the net. Pls. advice. Regards Sunil
AW: [squid-users] Need squid 2.4 running config dump
if you have installed cachemgr.cgi and call it via browser you can make a dump of the config. even the stuff which is included via acl surfer src "/path/to/client.lst" is shown in the output... markus >-Ursprüngliche Nachricht- >Von: [EMAIL PROTECTED] >[mailto:[EMAIL PROTECTED] >Gesendet: Dienstag, 15. August 2006 01:47 >An: squid-users@squid-cache.org >Betreff: [squid-users] Need squid 2.4 running config dump > >We have debian and squid 2.4, a change was made through webmin >of adding >a IP to a ACL, when applied it wiped the existing squid.conf >because the >proxy servers main hard drive that contained the squid.conf >was full. Is >there any way to get a dump of the running configuration so I can >restore the squid.conf (squid is still running). > > >Glenn Groves > >Network Administrator >Bradnam's Windows & Doors > Ph: (07) 3131 3825 > Mobile:0437 934 123 > Fax:(07) 3503 9322 > >This message (including any attachments) is confidential and >may be legally privileged. If you are not the intended >recipient, you should not disclose, copy or use any part of it >- please delete all copies immediately and notify the Bradnam >Group Helpdesk at [EMAIL PROTECTED] > >Any information, statements or opinions contained in this >message (including any attachments) are given by the author. >They are not given on behalf of the Bradnam Group unless >subsequently confirmed by an individual other than the author >who is duly authorised to represent the Bradnam Group (or any >of its subsidiary and associate companies). > >All sent and received email from/to the Bradnam Group (or any >of its subsidiary and associate companies) is automatically >scanned for the presence of computer viruses, security issues >and inappropriate content. > >For further information on the services which the Bradnam >Group provides visit our web >site(s) at www.bradnams.com.au or www.nationalglass.com.au >
[squid-users] on line reports
List, I'm using sarg to analyze de squid logs.. but all the reports are off line. I´ve tried to use trafshow, tcpdump, ethereal, etc. but there's a lot of traffic on my network. I need to know what the users are doing in the moment. Aguiar ___ Yahoo! Acesso Grátis - Internet rápida e grátis. Instale o discador agora! http://br.acesso.yahoo.com
Re: [squid-users] [Solution] Squid on Active Directory
Hello Squid User I read your article is nice. But you authenticate with ntlm. Could you implement Squid_ldap_auth Because i had a problem - Original Message - From: "Mario Iseli" <[EMAIL PROTECTED]> To: Sent: Monday, August 14, 2006 6:15 PM Subject: [squid-users] [Solution] Squid on Active Directory Hello Squid-Users, this week I had problems with binding Squid to Active Directory as some of you may already have noticed. I recognized that I was not the only one, a lot of other people had the same troubles and not yet enought squid-experience how to do it. In the last days I studied LDAP, Kerberos and the internals of AD, so I could install Squid finally. I wrote an article into my blog [1] which could also help other users. So please have a look at it and give me a feedback, I thank for all your help! http://blog.marioiseli.com/index.php/2006/08/14/debian-gnulinux-in-a-microsoft-network-with-winbindd-its-possible/ -- .''`. Mario Iseli <[EMAIL PROTECTED]> : :' :proud user of Debian unstable `. `'` `- Debian - when you have better things to do than fixing a system
Re: [squid-users] [Solution] Squid on Active Directory
How did u install Kerberos ?? Thz Ale - Original Message - From: "Mario Iseli" <[EMAIL PROTECTED]> To: Sent: Monday, August 14, 2006 6:15 PM Subject: [squid-users] [Solution] Squid on Active Directory Hello Squid-Users, this week I had problems with binding Squid to Active Directory as some of you may already have noticed. I recognized that I was not the only one, a lot of other people had the same troubles and not yet enought squid-experience how to do it. In the last days I studied LDAP, Kerberos and the internals of AD, so I could install Squid finally. I wrote an article into my blog [1] which could also help other users. So please have a look at it and give me a feedback, I thank for all your help! http://blog.marioiseli.com/index.php/2006/08/14/debian-gnulinux-in-a-microsoft-network-with-winbindd-its-possible/ -- .''`. Mario Iseli <[EMAIL PROTECTED]> : :' :proud user of Debian unstable `. `'` `- Debian - when you have better things to do than fixing a system
[squid-users] cache.log: many TCP Connection failed after update to squid 2.6stable2
we use a squid hierachy in our intranet. user-proxy -> main-proxy -> dmz-proxy -> internet after upgrading our "main-proxy" to squid 2.6stable2 (from squid 2.5stable2) we see a lot of "TCP connection to dmz-proxy failed" messages in our cache.log. i now also updated the dmz-proxy to squid 2.6stable2 but the messages still appear in cache.log. as soon as i use the old 2.5er squid the messages disappear. i have to admit that our dmz-proxy is under "heavy" load, squid uses a lot of cpu (up to 100%), but uptime only reports a (recent) load of load average: 0.11, 0.14, 0.24 but messages still appear. does anybody have an idea where to look further? is squid 2.6 so much "faster" than 2.5? i wonder why the messages disappear when using squid 2.5, maybe a slight different TCP-handling between the versions? i have hoped that the messages will disappear as soon all the squids in the chain are the same version. access.log seems to look ok, when the TCP connection is reported. on dmz-proxy no logs no hints no nothing thanxs markus
Re: [squid-users] Compile ldapdigest under FreeBSD 6.1
tis 2006-08-15 klockan 15:17 +0400 skrev Vladimir: > Thanks for reply. Now I`m trying to use ldap_digest_auth: > ValidUserName ValidUserPasswd It's not expecting a password, only a username. See protocol description in squid.conf comments. > I can`t see "userPassword" attribute using ldapsearch. Maybe > digest_ldap_auth can`t see it too. If you can't get the attribute you need with ldapsearch then squid_ldap_digest won't work either.. Most LDAP servers don't store plain-text passwords, and the few that does usually needs to be configured to allow access to see the attribute. Iteally you would set up a attribute having the digest hash of the password in the LDAP tree as this is less sensitive in terms of user privacy (equivalent to the password for Digest auth use, but does not reveal the plain text password to anyone who somehow got access to the LDAP data..) Regards Henrik signature.asc Description: Detta är en digitalt signerad meddelandedel
Re: [squid-users] on line reports
On Tuesday 15 August 2006 14:17, Aguiar Magalhaes wrote: > I'm using sarg to analyze de squid logs.. but all the > reports are off line. > > I´ve tried to use trafshow, tcpdump, ethereal, etc. > but there's a lot of traffic on my network. > > I need to know what the users are doing in the moment. tail -f /var/log/squid/access.log Christoph
Re: [squid-users] Digest Auth Problem in Reverse Proxy Setup
If I had a load balancer mapping many incoming client connections to fewer backend connections to Squid, would that cause trouble for the digest authentication logic? In particular, if requests from two different authenticated users were mapped onto a single connection from load balancer to Squid (and interleaved?) would that cause trouble? It seems like there is some cached auth state associated with each connection, and that the connection multiplexing must be interacting badly with that. Is there a way to suppress the caching of this auth state? Henrik Nordstrom wrote: tor 2006-08-10 klockan 16:52 -0700 skrev Ben Drees: Users are complaining that they are challenged to re-enter their credentials too frequently. Then something is wrong somewhere. They should only need to enter their credentials once, just as for basic.. I figured nonce_max_duration would set the "max session time", but the credentials challenges still seem to happen much more frequently. The nounce duration is not a session timer as such. It's more related to replay attacks on the digest protocol. I notice log entries like these that seem to be correlated with the credentials challenges: #1) authenticateValidateUser: Auth_user '0xb61430' is broken for it's scheme. #2) authenticateValidateUser: Validating Auth_user request '(nil)'. Are these normal sorts of log messages? What does AUTH_BROKEN mean (from the source generating example #1)? Most likely Squid didn't like something of the Digest message sent by the browser. debug_options ALL,1 29,9 should give more insight into the Digest processing. If you enable log_mime_hdrs and repeat the problem with a known password then we can look into what the browser sent and if it makes sense or not. Or at mimimum log_mime_hdrs and get the relevant /407 entries. Maybe there is something obvious. Regards Henrik
[squid-users] Cache Log errors
Can anyone explain if these are important messages. My squid server appears to be working but im concerned: The 51.63.xx.xx and 192.168.xx.xx are peers. I am able to access the particular website via these peers but I receive the messages below. If there is any other information I can provide to investigate please say so, but also please suggest the commands I should use, as my knowledge is brief. squid:/opt/squid/var/logs # tail -f cache.log 2006/08/15 18:49:26| storeLateRelease: released 0 objects 2006/08/15 18:53:42| temporary disabling (Internal Server Error) digest from 51.63.xx.xx 2006/08/15 18:54:43| temporary disabling (Internal Server Error) digest from 51.63.xx.xx 2006/08/15 18:56:13| temporary disabling (Service Unavailable) digest from 192.168.xx.x 2006/08/15 18:58:42| temporary disabling (Internal Server Error) digest from 51.63.xx.xx 2006/08/15 18:59:43| temporary disabling (Internal Server Error) digest from 51.63.xx.xx 2006/08/15 19:05:13| temporary disabling (Gateway Time-out) digest from 192.168.xx.x 2006/08/15 19:08:43| temporary disabling (Internal Server Error) digest from 51.63.xx.xx 2006/08/15 19:09:44| temporary disabling (Internal Server Error) digest from 51.63.xx.xx 2006/08/15 19:19:14| temporary disabling (reply header too big) digest from 192.168.xx.x Levent Mehmet Network Analyst Server and Network Team [EMAIL PROTECTED] Operate Unit Market Towers, 20th Floor 1 Nine Elms Lane London SW8 5NQ E-mail: [EMAIL PROTECTED] Phone: +44 20 7084 3517 Fax: +44 20 7084 2536 This email and any files transmitted with it are confidential. If you are not the intended recipient, any reading, printing, storage, disclosure, copying or any other action taken in respect of this email is prohibited and may be unlawful. If you are not the intended recipient, please notify the sender immediately by using the reply function and then permanently delete what you have received.Incoming and outgoing email messages are routinely monitored for compliance with the Department of Healths policy on the use of electronic communications. For more information on the Department of Healths email policy, click http;//www.doh.gov.uk/emaildisclaimer.htm The original of this email was scanned for viruses by Government Secure Intranet (GSi) virus scanning service supplied exclusively by Cable & Wireless in partnership with MessageLabs. On leaving the GSI this email was certified virus free. The MessageLabs Anti Virus Service is the first managed service to achieve the CSIA Claims Tested Mark (CCTM Certificate Number 2006/04/0007), the UK Government quality mark initiative for information security products and services. For more information about this please visit www.cctmark.gov.uk
Re: [squid-users] Digest Auth Problem in Reverse Proxy Setup
tis 2006-08-15 klockan 11:07 -0700 skrev Ben Drees: > If I had a load balancer mapping many incoming client connections to > fewer backend connections to Squid, would that cause trouble for the > digest authentication logic? In particular, if requests from two > different authenticated users were mapped onto a single connection from > load balancer to Squid (and interleaved?) would that cause trouble? No. Digest authentication is per the HTTP specifications and is message oriented, not connection oriented. But if this load balancer maps the same user to different Squids on different requests in the same session then there could be trouble. There is state kept at both ends, and if a second request gets sent to another server then Digest will have a bit of problem.. > It seems like there is some cached auth state associated with each > connection, and that the connection multiplexing must be interacting > badly with that. Is there a way to suppress the caching of this auth state? It's not caching of state, it's state inherent to the Digest authentication scheme. It's in principle a challenge/response authentication scheme and the response must be sent to the same server who issued the challenge. To get around this some code changes will be needed. I have some ideas which should work even in load balanced farms, but it will require some hours of coding. Regards Henrik signature.asc Description: Detta är en digitalt signerad meddelandedel
[squid-users] ntlm authentication
Hello. Can someone tell me some good documentation or howto to use ntlm authentication with samba? Thanks Wilson ___ Novidade no Yahoo! Mail: receba alertas de novas mensagens no seu celular. Registre seu aparelho agora! http://br.mobile.yahoo.com/mailalertas/
Re: [squid-users] COSS improvements
Hi everyone, my exeprience with these patches: At first: COSS seems to be stable, it doesn't crash so often any longer. I had the following cache_dir lines: cache_dir coss /dev/sdb1 32760 block-size=2048 max-size=32768 cache_dir aufs /var/squid/cache1 38000 256 256 max-size=16777216 cache_dir aufs /var/squid/bigcache 25000 16 16 The 5min average load is up to 220 requests per second at a cpu load average of about 24 percent. I get many "Failed to unpack meta data errors" (about one every 5 seconds) I have used the cache before with squid-2.6.STABLE2 without Steven Wilton's patches. It wasn't complete filled up before. Now, at stripe 29000 (of 32760), cachemgr storedir says: - Store Directory Statistics: Store Entries : 6085603 Maximum Swap Size : 98058240 KB Current Store Swap Size: 90869390 KB Current Capacity : 93% used, 7% free Store Directory #0 (coss): /dev/sdb1 FS Block Size 2048 Bytes Maximum Size: 33546240 KB Current Size: 33546242 KB Percent Used: 100.00% Current load metric: 0 / 1000 Number of object collisions: 0 Pending operations: 0 out of 128 Flags: Pending Relocations: 0 Stripe: 0, lockcount: 0, numobjects 209, flags: NOTFULL,NOTWRITING,NOTWRITTEN,MEMONLY Stripe: 1, lockcount: 2, numobjects 237, flags: FULL,NOTWRITING,NOTWRITTEN,MEMONLY Stripe: 29618, lockcount: 0, numobjects 137, flags: NOTFULL,NOTWRITING,NOTWRITTEN,DISK Pending Relocations: Store Directory #1 (aufs): /var/squid/cache1 FS Block Size 4096 Bytes First level subdirectories: 256 Second level subdirectories: 256 Maximum Size: 38912000 KB Current Size: 35020964 KB Percent Used: 90.00% Current load metric: 100 / 1000 Filemap bits in use: 796921 of 4194304 (19%) Filesystem Space in use: 34515696/43237588 KB (80%) Filesystem Inodes in use: 0/0 (0%) Flags: SELECTED Removal policy: lru LRU reference age: 7.78 days Store Directory #2 (aufs): /var/squid/bigcache FS Block Size 4096 Bytes First level subdirectories: 16 Second level subdirectories: 16 Maximum Size: 2560 KB Current Size: 22302184 KB Percent Used: 87.12% Current load metric: 100 / 1000 Filemap bits in use: 370 of 16384 (2%) Filesystem Space in use: 25556692/29727344 KB (86%) Filesystem Inodes in use: 0/0 (0%) Flags: Removal policy: lru LRU reference age: 21.48 days --- The cachemgr storedir interestingly says, that the cache is 100 percent used, although the stripes greater than 29618 should be completely empty. The number of files in Store Directory #1 (aufs) - /var/squid/cache1 is increasing. Before reaching the "100% full" in cachemgr storedir were about 500,000 entries in it. Only a small part of the requests are stored in the COSS dir since "reaching 100 percent full". I have also written this as a bug report as bug #1734. Greetings, Martin Stolle -Ursprüngliche Nachricht- Von: Adrian Chadd [mailto:[EMAIL PROTECTED] Gesendet: Donnerstag, 3. August 2006 13:30 An: squid-users@squid-cache.org Betreff: [squid-users] COSS improvements Hi everyone, Steven Wilton has contributed a whole swath of COSS fixes which provide even more dramatic performance fixes and some stability fixes to the codebase. Those who are trialing out COSS in Squid-2.6 should grab tomorrow's snapshot and give it a whirl. I suggest you read and re-read the COSS comments in the squid configuration file to get an idea of the newly available "knobs". Adrian
[squid-users] mail_list_problem
hi some times, after sending a new post or reply to other post, I don't receive my post via mailling_list, but other friends answer me. where is the problem? Regards Pezhman Lali
Re: [squid-users] ntlm authentication
On Tue, 2006-08-15 at 23:30 -0300, Wilson A. Galafassi Jr. wrote: > Hello. > > Can someone tell me some good documentation or howto to use ntlm > authentication with samba? > Thanks http://wiki.squid-cache.org/SquidFaq/ProxyAuthentication Kinkie
AW: [squid-users] coss configuration example
In my experience, you have to set the cache_swap_log variable to an existing directory where you can read and write to e.g. cache_swap_log /var/squid/cache1/%s This is because the swap log couldn't be written to the same directory in the coss case (because it isn't a directory, it is a file). Greetings, Martin -Ursprüngliche Nachricht- Von: chima s [mailto:[EMAIL PROTECTED] Gesendet: Montag, 14. August 2006 16:13 An: Steven Wilton Cc: squid mailing Betreff: Re: [squid-users] coss configuration example Hi Steven, I have tried following but it failed dd if=/dev/zero bs=1048576 count=2048 of=/cache_log/coss Part of Squid.conf -- cache_dir coss /cache_log/coss 2500 block-size=512 max-size=131072 cache_access_log /var/log/squid/access.log cache_log /var/log/squid/cache.log cache_store_log none cache_swap_log none Squid was compiled as ./configure --enable-storeio=coss --enable-coss-aio-ops --with-large-files While starting the squid i am getting error as 2006/08/14 19:36:37| WCCP Disabled. 2006/08/14 19:36:37| Ready to serve requests. 2006/08/14 19:36:37| COSS: /cache_log/coss: Rebuilding (0 % completed - 1/2500 stripes) 2006/08/14 19:36:39| COSS: /cache_log/coss: Rebuilding (5 % completed - 126/2500 stripes) 2006/08/14 19:36:40| COSS: /cache_log/coss: Rebuilding (10 % completed - 251/2500 stripes) 2006/08/14 19:36:42| COSS: /cache_log/coss: Rebuilding (15 % completed - 376/2500 stripes) 2006/08/14 19:36:43| COSS: /cache_log/coss: Rebuilding (20 % completed - 501/2500 stripes) 2006/08/14 19:36:44| COSS: /cache_log/coss: Rebuilding (25 % completed - 626/2500 stripes) 2006/08/14 19:36:45| COSS: /cache_log/coss: Rebuilding (30 % completed - 751/2500 stripes) 2006/08/14 19:36:47| COSS: /cache_log/coss: Rebuilding (35 % completed - 876/2500 stripes) 2006/08/14 19:36:48| COSS: /cache_log/coss: Rebuilding (40 % completed - 1001/2500 stripes) 2006/08/14 19:36:49| COSS: /cache_log/coss: Rebuilding (45 % completed - 1126/2500 stripes) 2006/08/14 19:36:50| COSS: /cache_log/coss: Rebuilding (50 % completed - 1251/2500 stripes) 2006/08/14 19:36:52| COSS: /cache_log/coss: Rebuilding (55 % completed - 1376/2500 stripes) 2006/08/14 19:36:53| COSS: /cache_log/coss: Rebuilding (60 % completed - 1501/2500 stripes) 2006/08/14 19:36:55| COSS: /cache_log/coss: Rebuilding (65 % completed - 1626/2500 stripes) 2006/08/14 19:36:57| COSS: /cache_log/coss: Rebuilding (70 % completed - 1751/2500 stripes) 2006/08/14 19:36:58| COSS: /cache_log/coss: Rebuilding (75 % completed - 1876/2500 stripes) 2006/08/14 19:36:59| COSS: /cache_log/coss: Rebuilding (80 % completed - 2001/2500 stripes) 2006/08/14 19:37:01| COSS: /cache_log/coss: Rebuilding (85 % completed - 2126/2500 stripes) 2006/08/14 19:37:02| COSS: /cache_log/coss: Rebuilding (90 % completed - 2251/2500 stripes) 2006/08/14 19:37:02| COSS: /cache_log/coss: Rebuilding (95 % completed - 2376/2500 stripes) FATAL: storeCossDirCloseTmpSwapLog: rename failed I don't know what went wrong. Regards Chima On 8/5/06, Steven Wilton <[EMAIL PROTECTED]> wrote: > > - Original Message - > From: "chima s" <[EMAIL PROTECTED]> > To: "squid mailing" > Sent: Friday, August 04, 2006 8:24 PM > Subject: [squid-users] coss configuration example > > > > Hi, > > > > Can any one give the squid configuration to use coss cache_dir. > > > > My system info > > > > Fedora Core release 3 > > Kernel : 2.6.10 > > Squid : squid-2.6.STABLE2-20060804 > > MEM: 2GB > > HD : 2*72 GB SCSI > > System Filesystem: reiserfs > > > > How COSS_MEMBUF_SZ is calculated for given cache_dir size > > > > Regards > > Chima > > > > The minimum config for a COSS dir is the following (for 100MB cache_dirs): > cache_dir coss /var/spool/squid/coss 100 block-size=512 max-size=131072 > or > cache_dir coss /dev/sdb1 100 block-size=512 max-size=131072 > > If you set COSS to write to a flie, you must create the file manually. To > do this, you can run: > dd if=/dev/zero bs=1048576 count= of= > > If you set COSS to write direct to a block device, you need to make sure > that the cache user has write permissions on the block device. > > > The COSS_MEMBUF_SZ does not get set on a per-device basis. The magic number > you need to be aware of is the block-size, which limits the size of the > cache. The valid numbers are: > > block-size=512 - 8GB Max cache_dir size > block-size=1024 - 16GB Max cache_dir size > block-size=2048 - 32GB Max cache_dir size > block-size=4096 - 64GB Max cache_dir size > block-size=8192 - 128GB Max cache_dir size > > Steven > >
Re: [squid-users] mail_list_problem
I have the same problem 2006/8/16, lopl <[EMAIL PROTECTED]>: hi some times, after sending a new post or reply to other post, I don't receive my post via mailling_list, but other friends answer me. where is the problem? Regards Pezhman Lali
