Re: [squid-users] SSL is a security hole

2003-03-06 Thread Henrik Nordstrom
On Thursday 06 March 2003 23.26, Christoph Haas wrote: > I am sure that this 'feature' is well-known and there already a > common-understanding of how to deal with it. Proxy users can use > the squid to tunnel their SSH sessions any destination they like - > at least if the port is allowed for the

Re: [squid-users] Squid Accelerator Farms

2003-03-06 Thread Henrik Nordstrom
You used the reload button... when you use the reload button most browsers includes HTTP headers which instructs the cache that it MUST verify the freshness with the origin server (Cache-Control: max-age=0 as you are using Mozilla).. Regards Henrik On Thursday 06 March 2003 20.40, Hugh Bucha

Re: [squid-users] accelerator farm: optimizing the sibbling_hit

2003-03-06 Thread Henrik Nordstrom
On Thursday 06 March 2003 19.04, Ard van Breemen wrote: > I can only think of one reason not to do it, and that is the > failure of one of the caches. A cache fail means that other > caches will do a direct, instead of using a second-in-line cache. > That means the site will probably get the same

Re: [squid-users] Display Company Policy

2003-03-06 Thread Henrik Nordstrom
Correct. Regards Henrik On Thursday 06 March 2003 18.58, [EMAIL PROTECTED] wrote: > But a custom redirector might be able to keep a rough notion of a > session based on client IP address, and a logging database. For > the first GET request of the day, that redirector could send the > user to an

Re: [squid-users] accelerator farm: optimizing the sibbling_hit

2003-03-06 Thread Henrik Nordstrom
On Thursday 06 March 2003 18.30, Ard van Breemen wrote: > Only revalidation refreshes. The client forced refresh was a > second thing to look at, but is not that important, since usually > clients do not force a refresh. The reload button will.. (in some versions of IE only if configured to use

[squid-users] Squid Problem.. Blocking, Etc.

2003-03-06 Thread Michael Barker
I am having two problems with our Squid Server. We are a school district with approx. 950 computers on the network using Squid with DansGuardian Filtering. We are having two problems. 1.) We have YAHOO Mail Blocked for the whole network. We would like to allow access to it only by about 10 c

[squid-users] SSL is a security hole

2003-03-06 Thread Christoph Haas
Hi, folks... I am sure that this 'feature' is well-known and there already a common-understanding of how to deal with it. Proxy users can use the squid to tunnel their SSH sessions any destination they like - at least if the port is allowed for the 'CONNECT' method. On my mind it is impossible for

[squid-users] Squid Accelerator Farms

2003-03-06 Thread Hugh Buchanan
Looking through the archives for this list, I don't see too much discussion regarding accelerator farms.. Most folks using squid aren't using the software for this purpose, but there must be information sitting around out there about the topic. I am looking for things like personal experience

Re: [squid-users] File descriptor problem

2003-03-06 Thread Ard van Breemen
On Wed, Mar 05, 2003 at 11:28:21AM +0700, Niti Lohwithee wrote: > Now, I am using squid2.3 stable 3 with Rehat 6.2. My hardware box is PIII 500 > with 512 memory. The size of file-max is 32768, but it 's still warning messages > which is WARNING! Your cache is running out of file descripto

Re: [squid-users] accelerator farm: optimizing the sibbling_hit

2003-03-06 Thread Ard van Breemen
On Mon, Mar 03, 2003 at 10:26:51PM +0100, Henrik Nordstrom wrote: > For your situationt and most accelerator farms the following > configuration should be optimal I think: > > 1. Use smart request routing within the array of Squids to make sure > that for each URL one of the Squids is denoted "m

RE: [squid-users] Display Company Policy

2003-03-06 Thread sean . upton
But a custom redirector might be able to keep a rough notion of a session based on client IP address, and a logging database. For the first GET request of the day, that redirector could send the user to an intermediary 'warning' page hosted by an HTTP server somwhere along with the destination URL

Re: [squid-users] accelerator farm: optimizing the sibbling_hit

2003-03-06 Thread Ard van Breemen
On Mon, Mar 03, 2003 at 10:29:30PM +0100, Henrik Nordstrom wrote: > On Monday 03 March 2003 18.29, Ard van Breemen wrote: > > > To allow refreshes via siblings you must also change Squid to not > > > use "only-if-cached" when requesting the object from the sibling, > > > or else the request will be

Re: [squid-users] Queue congestion

2003-03-06 Thread Alex Sharaz
o.k just see them occasionally, I've got 4 36Gbyte 15Krpm Ultra 160 disks in the server --On 06 March 2003 17:38 +0100 Henrik Nordstrom <[EMAIL PROTECTED]> wrote: This can be ignored if you are only seeing a few of them.. If you are seeing it constantly then your drives is probably overloaded a

Re: [squid-users] Queue congestion

2003-03-06 Thread Henrik Nordstrom
This can be ignored if you are only seeing a few of them.. If you are seeing it constantly then your drives is probably overloaded and you need one or two more drives.. Regards Henrik tor 2003-03-06 klockan 16.51 skrev Alex Sharaz: > I'm seeing a few error messages in my squid 2.5.s20030.. cach

Re: [squid-users] HTTP Headers

2003-03-06 Thread Craig Kelley
On Thu, 2003-03-06 at 00:54, Henrik Nordstrom wrote: > On Thursday 06 March 2003 00.24, Craig Kelley wrote: > > > Just for the archives; I solved the problem by using this on the > > source HTTPD server: > > > > > > Options FollowSymLinks > > AllowOverride None > > Header set Cache-co

[squid-users] Queue congestion

2003-03-06 Thread Alex Sharaz
I'm seeing a few error messages in my squid 2.5.s20030.. caches saying WARNING squidaio_queue congestion Anything I can do about it? alex Sent using Mulberry 3.01a

RE: [squid-users] Config: NTLM & Exceptions for specified servers?

2003-03-06 Thread Sorisio,Chris
That did the trick. Thanks! -Original Message- From: Henrik Nordstrom [mailto:[EMAIL PROTECTED] Sent: Thursday, March 06, 2003 10:00 AM To: Sorisio,Chris Cc: [EMAIL PROTECTED] Subject: Re: [squid-users] Config: NTLM & Exceptions for specified servers? It is a matter of the order of your

Re: [squid-users] Config: NTLM & Exceptions for specified servers?

2003-03-06 Thread michele . de-martin
"http_access allow ssupp001" must go before "http_access allow ProxyUsers" Michele |-+> | | "Sorisio,Chris" <[EMAIL PROTECTED]> | | | Sent by:

Re: [squid-users] Config: NTLM & Exceptions for specified servers?

2003-03-06 Thread Henrik Nordstrom
It is a matter of the order of your http_access rules.. http_access is a ordered list of rules. The first http_access rule which matches the request (all listed acls are true) will allow or deny the request. If one of the acls on the http_access line does not match the request Squid continues wi

[squid-users] Re: about cachemgr.cgi

2003-03-06 Thread Henrik Nordstrom
tor 2003-03-06 klockan 20.19 skrev atit_ldce: > i am monitoring squid performance > i am using cachemgr.cgi for this.. > > is there any documentation for cachemgr.cgi since some of the information presented > is not clear There is the source. > i got no help from squid site Some is in the

[squid-users] Config: NTLM & Exceptions for specified servers?

2003-03-06 Thread Sorisio,Chris
Hola folks, I'm attempting to configure Squid 2.5.1 to support NTLM authentication while allowing exceptions for specified clients. I have the NTLM authentication portion working with these snippets (though it only authenticates against the domain the server is in, and I need to get it to auth ag

Re: [squid-users] SSL and directed HTTP proxy

2003-03-06 Thread Gary Price \(ICT\)
Figured this one out. A program that uses WinInet was being used to set the proxy, rather than it being set manually. The program contained a slight error, such that HTTPS was effectively getting a blank proxy. This of course did not happen with manual setup, which was what I was using. GP -

Re: [squid-users] Error in cache.log about NtLM authentication

2003-03-06 Thread Marc Elsen
[EMAIL PROTECTED] wrote: > > Hi, > I'm running squid 2.5STABLE1 in a Solaris 8 serveur, with 1Gb and 20Gb disk for > the cache, it also use samba 2.2.7 > and it work great but I'm still getting a lot of this error messages in the > cache.log: > 2003/03/06 13:30:03| AuthenticateNTLMHandleReply: i

[squid-users] Error in cache.log about NtLM authentication

2003-03-06 Thread Arno_STREULI
Hi, I'm running squid 2.5STABLE1 in a Solaris 8 serveur, with 1Gb and 20Gb disk for the cache, it also use samba 2.2.7 and it work great but I'm still getting a lot of this error messages in the cache.log: 2003/03/06 13:30:03| AuthenticateNTLMHandleReply: invalid callback data. Releasing helper '

Re: [squid-users] Display Company Policy

2003-03-06 Thread HeadsUp Support
--- Christoph Andreas <[EMAIL PROTECTED]> wrote: > There was a nice patch some weeks ago on this list > concerning this. Just > look for "headsup" in the archives. We use that for > two weeks now and it > works very fine. Thanks! Its not a patch but as separate application. No compiling necessar

Re: [squid-users] Display Company Policy

2003-03-06 Thread rvt
Hi Ben, I'm currently also have such requests from my Boss. I currently use Sarg and Webaliser to create the stats I need. But to easy things up and create more personalized stats I put the access.log into a PostgreSQL database and retreiver information based on a query back into a temporary ac

Re: [squid-users] three questions

2003-03-06 Thread Henrik Nordstrom
tis 2003-01-07 klockan 18.59 skrev Pat Lendon: > I looked at "system dependent weirdness" faq. Should squid be compiled > with --enable-gnuregex? Not if you are using glibc. > For our parent proxy, we continue to have occassional cpu at 98% for the > squid process. The squid cpu usage goes

Re: [squid-users] downloading files

2003-03-06 Thread Henrik Nordstrom
Works here using the current Squid-2.5-CVS, but I have no memory of anything which may be related to this being fixed after 2.5.STABLE1. Is your Squid running as a normal proxy or as a transparent proxy? What does access.log show? Also, to make the tests more reliable and reproduceable, clear y

Re: [squid-users] Squid_ldap_group

2003-03-06 Thread Henrik Nordstrom
tor 2003-03-06 klockan 11.02 skrev Homberger Peter: > My LDAP Group: > > # Security-Group, security, nextiraone, ch > dn: cn=Security-Group,ou=security,o=nextiraone,c=ch > objectClass: groupOfNames > objectClass: groupOfUniqueNames > cn: Security-Group > member: cn=FW1-Template,o=nextiraone,c=ch

[squid-users] RE: SquidGuard & NT Groups

2003-03-06 Thread Henrik Nordstrom
Squid only knows that the user matched you http_access rules, not that one of the acls used happens to be a user group. The mechanism used in Squid for group membership verifications is a generic acl lookup mechanism via external helpers, not at all restricted to group memberships. A example of an

[squid-users] Squid_ldap_group

2003-03-06 Thread Homberger Peter
Dear Squid Users I have some problems configuring authentication of ldap users. The idea behind my configuration is that only users in a existing LDAP Group will be authenticated sucessfully. In this example it's my own user with the login ID phom. What's wrong in my config, because the user wil

Re: [squid-users] Display Company Policy

2003-03-06 Thread Christoph Andreas
There was a nice patch some weeks ago on this list concerning this. Just look for "headsup" in the archives. We use that for two weeks now and it works very fine. Christoph. Ben White schrieb: Hi, I was thinking if it is possible for my company policies to be dispalyed (in HTML) when users st

Re: [squid-users] Display Company Policy

2003-03-06 Thread Henrik Nordstrom
The main problem to solve in this equation is "once". Depending on your situation "users" might also require some consideration to be clearly defined. HTTP is quite stateless in it's nature with no notion of a "session", and so is Squid (yet). Regards Henrik tor 2003-03-06 klockan 09.34 skrev B

Re: [squid-users] Replace Default Error Msg

2003-03-06 Thread Henrik Nordstrom
Sure. The error messages are just plain text files and can be edited with any editor. If you customize the default error messages then I recommend you to make a new directory for your error pages, and use error_directory to tell Squid where your customized error pages can be found. This to make su

[squid-users] Display Company Policy

2003-03-06 Thread Ben White
Hi, I was thinking if it is possible for my company policies to be dispalyed (in HTML) when users start using squid proxy at the start of the day. I want this HTML to be displayed once, regardless of how many times users use squid subsequently. Can this be done, and how to do it ? Thanks for any

[squid-users] Replace Default Error Msg

2003-03-06 Thread Ben White
Hi, I'm able to customize my own html error messages using deny_info. But I notice whenever the users key in the wrong URL, the default squid error msg would appear. Is there anyway for me to replace the default to one of my own, as I would like to provide my users with more info such as contacti