[squid-users] Re: squid 3.1 - endless loop IIS webserver
Hi, Hi, Thanks for that. I tried your recommendations and now I get this. 2012/03/13 12:11:25| clientNegotiateSSL: Error negotiating SSL connection on FD 18: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca (1/0) 2012/03/13 12:11:25| clientNegotiateSSL: Error negotiating SSL connection on FD 20: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca (1/0) 2012/03/13 12:11:27| clientNegotiateSSL: Error negotiating SSL connection on FD 18: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca (1/0) Adding ssl sslflags=NO_VERIFY_PEER to the cache_peer line gives: 2012/03/13 12:35:23| TCP connection to 192.168.124.169/443 failed 2012/03/13 12:35:23| SSL unknown certificate error 20 in /CN=savitr69 2012/03/13 12:35:23| SSL unknown certificate error 20 in /CN=savitr69 2012/03/13 12:35:23| fwdNegotiateSSL: Error negotiating SSL connection on FD 20: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (1/-1/0) I'm a bit confused about the actual interaction between squid and the backend IIS server. The programmer has generated an ssl cert on the iis server, I have generated an ssl cert on squid. When I type https://www.example.com/Login.aspx, it asks me to add an exception for the squid box but the request now hangs at the iis server. As per my understanding according to the current setup, when a user visits www.example.com/Login.aspx he is presented with a Add exception window for the squid box, after accepting he should again be presented with an add exception window from the iis server, this never happens. Is there a better way to do this? Thanks, Adi -- View this message in context: http://squid-web-proxy-cache.1019090.n4.nabble.com/squid-3-1-endless-loop-IIS-webserver-tp4465329p4468478.html Sent from the Squid - Users mailing list archive at Nabble.com.
[squid-users] Re: squid 3.1 - endless loop IIS webserver
Hi Amos, that worked brilliantly, thanks a lot! -- View this message in context: http://squid-web-proxy-cache.1019090.n4.nabble.com/squid-3-1-endless-loop-IIS-webserver-tp4465329p4469087.html Sent from the Squid - Users mailing list archive at Nabble.com.
[squid-users] squid 3.1 - endless loop IIS webserver
Hi, I have searched for other posts with the same problem but the workarounds that worked for them did'nt work for me. I am trying to configure a squid reverse proxy with ssl support. I have squid on 192.168.124.41 with apache on 127.0.0.1 on the same box. I also have two other webservers (1 apache, 1 IIS). Squid is configured to direct any requests for asp pages to iis and the rest to the apache machine. I have also configured squid to use https, the programmer has set up a 302 redirect on the iis machine so that visiting http://example.com/Login.aspx redirects to https://example.com/Login.aspx. Squid redirects fine but after that gives me a The page isn't redirecting properly. Running wget shows that squid is going into an endless loop. I have reproduced squid.conf and also the wget output below. $wget --no-check http://192.168.124.41/Login.aspx --2012-03-12 11:06:53-- http://192.168.124.41/Login.aspx Connecting to 192.168.124.41:80... connected. HTTP request sent, awaiting response... 302 Moved Temporarily Location: https://example.com/Login.aspx [following] --2012-03-12 11:06:53-- https://example.com/Login.aspx Resolving example.com... 192.168.124.41 Connecting to example.com|192.168.124.41|:443... connected. WARNING: cannot verify example.com’s certificate, issued by “/C=IN/ST=AP/L=Default City/O=Default Company Ltd/CN=example.com/emailAddress=ad...@example.com”: Unable to locally verify the issuer’s authority. HTTP request sent, awaiting response... 302 Moved Temporarily Location: https://example.com/memberplanet/Login.aspx [following] and so on.. ## squid.conf # http_port 192.168.124.41:80 accel defaultsite=example.com https_port 192.168.124.41:443 accel cert=/usr/newrprgate/CertAuth/testcert.cert key=/usr/newrprgate/CertAuth/testkey.pem defaultsite=example.com acl rx_aspx urlpath_regex -i \.asp[x]* cache_peer 192.168.124.169 parent 80 0 no-query no-digest originserver name=aspserver cache_peer_access aspserver allow rx_aspx cache_peer_access aspserver deny all cache_peer 127.0.0.1 parent 80 0 no-query originserver name=wb1 cache_peer_access wb1 deny rx_aspx acl origin_servers dstdomain .example.com http_access allow origin_servers http_access deny all ### I'd appreciate it if someone could give me some clues as to what I'm doing wrong. Thanks, Adi -- View this message in context: http://squid-web-proxy-cache.1019090.n4.nabble.com/squid-3-1-endless-loop-IIS-webserver-tp4465329p4465329.html Sent from the Squid - Users mailing list archive at Nabble.com.
[squid-users] Re: multiple web servers - squid looks for images on wrong server.
Amos Jeffries-2 wrote #192.168.124.41/images has to be redirected to another web server acl images urlpath_regex images Problem #1: everything with the letters images in the URL path gets matched by this. For examples: http://example.com/images/haha.html http://example.com/boo/?images http://example.com/scripts/images.js http://example.com/videos/images.avi http://google.com/images?q=boo http://192.168.124.41/images.html Careful with regex. #now that images has been found deny the request being sent to server 1 cache_peer 127.0.0.1 parent 80 0 no-query originserver name=server1 cache_peer_access server1 deny images PROBLEM #2: myimage.jpg does not contain an s. The 'images' ACL definition does not prevent it going to this peer. #now send the image requests to server 2, first create peer cache_peer 192.168.124.40 parent 80 0 no-query originserver name=server2 #now send image requests to peer cache_peer_access server2 allow images cache_peer_access server2 deny all Amos Thank you for that! I still have a problem with the images thing. I re-wrote the regex as acl images_reg urlpath_regex ^/images/ Lets say I have a page www.mysite.com/images/mygallery.html which has an image file tiger.jpg embedded. Now squid matches www.mysite.com/images/mygallery.html and sends it to server 2 but still looks for tiger.jpg on server 1 even though it's on the same server as mygallery.html (server 2). Thanks, Adi -- View this message in context: http://squid-web-proxy-cache.1019090.n4.nabble.com/multiple-web-servers-squid-looks-for-images-on-wrong-server-tp4431686p4434384.html Sent from the Squid - Users mailing list archive at Nabble.com.
[squid-users] multiple web servers - squid looks for images on wrong server.
Hi, I have set up squid in reverse proxy (http-accelerator mode) on a machine along with the web server. the web server listens on 127.0.0.1 while squid listens on 192.168.124.41. There is another web server 192.168.124.40. Squid has been configured with urlpath_regex to redirect any incoming requests with images in the url to 192.168.124.40. |--- webserver1 (127.0.0.1) squid (192.168.124.41) --- | | |--- webserver2 (192.168.124.40) Now according to my config, pointing my browser to 192.168.124.41/images.html should lead to 192.168.124.40/images.html. The page loads up but the embedded images do not show up. A tail -f on access.log shows 1330494519.583 5 192.168.124.41 TCP_REFRESH_UNMODIFIED/304 357 GET http://192.168.124.41/images.html - FIRST_UP_PARENT/server2 - 1330494519.814 3 192.168.124.41 TCP_MISS/404 582 GET http://192.168.124.41/myimage.jpg - FIRST_UP_PARENT/server1 text/html images.html has an image embedded in it called myimage.jpg. Squid does well to redirect incoming requests for images.html to server2 but it is still looking for myimage.jpg on server1. Why is this happening? Thanks, Adi I have reproduced squid.conf below squid.conf ### http accel configuration ### #let squid listen on the public ip addr port 80 and apache on localhost 80 http_port 192.168.124.41:80 accel defaultsite=192.168.124.41 #192.168.124.41/images has to be redirected to another web server acl images urlpath_regex images #now that images has been found deny the request being sent to server 1 cache_peer 127.0.0.1 parent 80 0 no-query originserver name=server1 cache_peer_access server1 deny images #now send the image requests to server 2, first create peer cache_peer 192.168.124.40 parent 80 0 no-query originserver name=server2 #now send image requests to peer cache_peer_access server2 allow images cache_peer_access server2 deny all # # Recommended minimum configuration: # acl manager proto cache_object acl localhost src 127.0.0.1/32 ::1 acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1 # Example rule allowing access from your local networks. # Adapt to list your (internal) IP networks from where browsing # should be allowed acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT # # Recommended minimum Access Permission configuration: # # Only allow cachemgr access from localhost http_access allow manager localhost http_access deny manager # Deny requests to certain unsafe ports http_access deny !Safe_ports # Deny CONNECT to other than secure SSL ports http_access deny CONNECT !SSL_ports # We strongly recommend the following be uncommented to protect innocent # web applications running on the proxy server who think the only # one who can access services on localhost is a local user #http_access deny to_localhost # # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS # # Example rule allowing access from your local networks. # Adapt localnet in the ACL section to list your (internal) IP networks # from where browsing should be allowed http_access allow localnet http_access allow localhost # And finally deny all other access to this proxy http_access deny all # Squid normally listens to port 3128 #http_port 3128 # We recommend you to use at least the following line. hierarchy_stoplist cgi-bin ? # Uncomment and adjust the following to add a disk cache directory. #cache_dir ufs /var/spool/squid 100 16 256 # Leave coredumps in the first cache dir coredump_dir /var/spool/squid # Add any of your own refresh_pattern entries above these. refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 -- View this message in context: http://squid-web-proxy-cache.1019090.n4.nabble.com/multiple-web-servers-squid-looks-for-images-on-wrong-server-tp4431686p4431686.html Sent from the Squid - Users mailing list archive at Nabble.com.
