date:20110308

[squid-users] possible to deactivate pre-authentification on the Linux (or windows)- Please help

2011-03-08 Thread Sharik M

Dear Friend,


Is it possible to deactivate pre-authentification on the Linux (or

Windows) side to avoid these messages ?

Becouse i am getting lot of erro in windows 2003 domain.

Hi, 

When validating users on my Linux system against an ActiveDirectory, 
the Windows event log are filled with messages like these (Windows 
Event ID 675): 

Pre-authentication failed: 
User Name: linux$ 
User ID: KK\linux$ 
Service Name: krbtgt/KK.LOCAL 
Pre-Authentication Type: 0x0 
Failure Code: 0x19 
Client Address: 1.2.3.4 


(1.2.3.4 is the IP address of the Linux machine, LINUX the hostname of 
the Linux machine). 

The message above comes at every request from the Linux machine (every 5 
minutes on this installation). If I am validating a user, the same 
message is shown for the user like this (user name validated=test): 

Pre-authentication failed: 
User Name: test$ 
User ID: KK\test$ 
Service Name: krbtgt/KK.LOCAL 
Pre-Authentication Type: 0x0 
Failure Code: 0x19 
Client Address: 1.2.3.4 

Messages logged on behalf of a user may be disabled by deactivating 
pre-authentification for each user. But I cannot find any place in 
ActiveDirectory to disable it for the machine account. 

What is missing ? 

Is it possible to deactivate pre-authentification on the Linux (or 
Windows) side to avoid these messages ?

[squid-users] Squid with AD Authendication problem (windows 2003)- please help

2011-03-08 Thread Sharik M

 I have configured squid with AD authentication its working fine but I am 
getting lots of error for authentication failed.
 
 
squid-2.5.STABLE14-1.4E
samba-3.0.10-1.4E.11
 
 
 
Windows 2003 Domain Audit log failure.
 
 
Pre-authentication failed:
    User Name:    proxy$
    User ID:  DOMAIN\proxy$
    Service Name:    krbtgt/DOMAIN.HOME
    Pre-Authentication Type:   0x0
    Failure Code:  0x19
    Client Address:   10.1.5.12
 
 
For more information, see Help and Support Center at 
http://go.microsoft.com/fwlink/events.asp.
 
 
 
 
 
 
 
/etc/samba/smb.conf
 
 
[global]
    workgroup = DOMAIN
    netbios name = PROXY
    realm = DOMAIN.HOME
    server string = Linux Samba Server
    security = ads
    encrypt passwords = Yes
    password server = 10.1.5.11
    log file = /var/log/samba/%m.log
    max log size = 0
    socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
    preferred master = False
    local master = No
    domain master = False
    dns proxy = No
    wins server = 10.1.5.11
   # winbind separator = /
    winbind enum users = yes
    winbind enum groups = yes
    winbind use default domain = yes
    idmap uid = 1-2
    idmap gid = 1-2
    client schannel = no
 
log file = /var/log/samba/%m.log
max log size = 50
[homes]
   comment = Home Directories
   browseable = no
   writable = yes
[printers]
   comment = All Printers
   path = /var/spool/samba
   browseable = no
   guest ok = no
   writable = no
   printable = yes
 
 
/etc/krb5.conf
 
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log
 
[libdefaults]
 #ticket_lifetime = 24000
 default_realm = DOMAIN.HOME
 dns_lookup_realm = false
 dns_lookup_kdc = false
 
[realms]
 DOMAIN.HOME = {
  kdc = 10.1.5.11
  admin_server = 10.1.5.11
  default_domain = DOMAIN.HOME
 }
 
[domain_realm]
 .DOMAIN.home = DOMAIN.HOME
 DOMAIN.home = DOMAIN.HOME
 
[kdc]
 profile = /var/kerberos/krb5kdc/kdc.conf
 
[appdefaults]
 pam = {
   debug = false
   ticket_lifetime = 36000
   renew_lifetime = 36000
   forwardable = true
   krb4_convert = false
 }

Re: [Fwd: Re: [squid-users] help with squid redirectors]

2011-03-08 Thread Amos Jeffries


On Tue, 08 Mar 2011 07:52:50 -0500, Osmany wrote:

 Forwarded Message 
From: Osmany 
Reply-to: osm...@oc.quimefa.cu
To: squid-users 
Subject: Re: [squid-users] help with squid redirectors
Date: Tue, 08 Mar 2011 07:41:47 -0500

On Wed, 2011-03-09 at 01:33 +1300, Amos Jeffries wrote:

On 09/03/11 01:20, Osmany wrote:
> On Tue, 2011-03-08 at 12:21 +1300, Amos Jeffries wrote:
>> On Tue, 08 Mar 2011 11:58:57 +1300, Amos Jeffries wrote:
>>> On Mon, 07 Mar 2011 16:59:07 -0500, Osmany wrote:
 Greetings everyone,

 So I'm having trouble with my squid proxy-cache server. I 
recently

 added
 a redirect program because I had to make users go to my 
kaspersky

 admin
 kit and my WSUS services to get their updates and it works fine 
but

 I
 get constantly a warning and squid just collapses after a few
 minutes of
 run time. This is what I get in my cache.log:

 2011/03/07 15:54:17| WARNING: All url_rewriter processes are 
busy.

 2011/03/07 15:54:17| WARNING: up to 465 pending requests queued
 2011/03/07 15:54:17| storeDirWriteCleanLogs: Starting...
 2011/03/07 15:54:17| WARNING: Closing open FD 1455
 2011/03/07 15:54:17| commSetEvents: epoll_ctl(EPOLL_CTL_DEL): 
failed

 on
 fd=1455: (1) Operation not permitted
 2011/03/07 15:54:17| 65536 entries written so far.
 2011/03/07 15:54:17|131072 entries written so far.
 2011/03/07 15:54:17| WARNING: Closing open FD 1456
 2011/03/07 15:54:17| commSetEvents: epoll_ctl(EPOLL_CTL_DEL): 
failed

 on
 fd=1456: (1) Operation not permitted
 2011/03/07 15:54:17|   Finished.  Wrote 139965 entries.
 2011/03/07 15:54:17|   Took 0.1 seconds (1288729.1 
entries/sec).

 FATAL: Too many queued url_rewriter requests (465 on 228)
 Squid Cache (Version 2.7.STABLE7): Terminated abnormally.

 This is what I have in the squid.conf

 #  TAG: url_rewrite_program
 url_rewrite_program /etc/squid/redirect

 #  TAG: url_rewrite_children
 url_rewrite_children 100

 #  TAG: url_rewrite_concurrency
 url_rewrite_concurrency 50

 #  TAG: url_rewrite_access
 url_rewrite_access allow redirect

 And this is what I have in my redirector script

 #!/usr/bin/perl
 BEGIN {$|=1}
 while (<>) {
   @X = split;
   $url = $X[0];
   if ($url =~ /^http:\/\/dnl(.*)kaspersky(.*)com(.*)/) {
print
 "301:ftp:\/\/dnl-kaspersky\.quimefa\.cu\:2122\/Updates";
   }
   elsif ($url =~ /^http:\/\/(.*)windowsupdate(.*)/) {
print 
"301:http:\/\/windowsupdate\.quimefa\.cu\:8530";

   }
 }

 Can you please help me to solve this?
>>>
>>> Your script does not support concurrency. When that is 
configured in

>>> squid there will be 2 space-delimited fields to handle.
>>> First one being the ID of the request channel, not the URL.
>>>
>>
>>   Oops, I missed a few other things too:
>>* 'else' case is needed to print the no-change result back to 
Squid

>>* newlines need to be printed in perl
>>
>>
>> $url = $X[1];
>> if ($url =~ /^http:\/\/dnl(.*)kaspersky(.*)com(.*)/) {
>>  print $X[0]."
>>   301:ftp:\/\/dnl-kaspersky\.quimefa\.cu\:2122\/Updates\n";
>> }
>> elsif ($url =~ /^http:\/\/(.*)windowsupdate(.*)/) {
>>  print $X[0]." 
301:http:\/\/windowsupdate\.quimefa\.cu\:8530\n";

>> }
>> else {
>>  print $X[0]."\n";
>> }
>>
>>   Amos
>
> So this is what I have now but it doesn't work. I've tried it 
manually:

>
> #!/usr/bin/perl
> BEGIN {$|=1}
> while (<>) {
>   @X = split;
>   $url = $X[1];
> if ($url =~ /^http:\/\/dnl(.*)kaspersky(.*)com(.*)/) {
>  print $X[0]."
>   301:ftp:\/\/dnl-kaspersky\.quimefa\.cu\:2122\/Updates\n";
> }
> elsif ($url =~ /^http:\/\/(.*)windowsupdate(.*)/) {
>  print $X[0]." 
301:http:\/\/windowsupdate\.quimefa\.cu\:8530\n";

> }
> else {
>  print $X[0]."\n";
> }
> }
>
> it just keeps on returning the same url that I enter. help please?
>

Did you add the concurrency channel ID before the URL on each 
manually

entered line?
eg  $id $url $garbage

Amos


Yes you are right. I was missing the concurrency channel ID on my 
manual
test in fact when I supervise my access.log I see it is actually 
working
and when I look at the cache.log I see that it working concurrently 
with

all the available channels.

Now actually I found out that my script only works for one of the two
conditions I have. the one that works: windowsupdate, I can see that 
it

is actually redirecting because I see it in the access.log file like
this:

TCP_MISS/301 330 HEAD
http://download.microsoft.com/windowsupdate/v5/redir/wuredir.cab?

But the other condition, the kaspersky one I am pretty sure it is not
working because in the access.log this is what I see:
TCP_MISS/200 946 GET

http://dnl-17.geo.kaspersky.com/diffs/bases/av/kdb/i386/base048c.kdc.h

Re: [squid-users] Performance between 2.x/3.1

2011-03-08 Thread Amos Jeffries

On Tue, 8 Mar 2011 12:36:49 -0600, Baird, Josh wrote:
Are there any docs that reference performance differences between
2.6/7

and 3.1? I'm running several 2.6 clusters (forward proxy) with all
caching disabled doing 20-30mbps per node. The nodes are not far
from

idle in terms of CPU and memory. They are currently running
RHEL5/x86_64. Should I expect to see similar performance on 3.1, or
even better?

Squid had a lot of very speed-specific changes in 2.7 that never got
ported to the 3.x series. It hit a performance high that we are still
trying to match in 3.x.

I believe 3.1 is faster than releases in the 2.6 series, but have no
solid benchmarking to back that up. The last wide comparison we had was
http://squid-web-proxy-cache.1019090.n4.nabble.com/Updated-Benchmark-results-with-CPU-usage-for-3-1-and-2-7-td1048161.html

3.1 is slower than 2.7 in most situations.
We have had one report that the very latest 3.1 releases are equivalent
under a specific type of traffic. But that was at the edge of stability
and the test machine crashed too often. It definitely takes more CPU and
memory.

3.2 surpasses everything else on the RPS metric (total parallel
requests capacity), though we know it has currently traded handling
speed in order to get there. Work is underway to gain back on the speed
regressions since 3.1, with faint dreams of beating 2.7 as well.

Its currently a matter of choice when upgrading from 2.6 and down.
If you need speed above everything else 2.7 latest is the way to go.
If you need standards compliance and new features over speed then 3.x
latest gives that

38 matches

Mail list logo