<div dir="ltr"><div><div>I have used debug_options 11,2 in squid.conf file. After I have following results in logs files:<br><br>/var/log/squid3/access.log<br>1473026084.048 253 192.168.200.85 TCP_MISS_ABORTED/000 0 POST <a href="http://m.addthis.com/live/red_lojson/100eng.json">http://m.addthis.com/live/red_lojson/100eng.json</a>? marcio HIER_NONE/- -<br>1473026086.275 0 192.168.200.85 TCP_DENIED/407 3792 CONNECT <a href="http://tiles.services.mozilla.com:443">tiles.services.mozilla.com:443</a> - HIER_NONE/- text/html<br>1473026086.778 0 192.168.200.85 TCP_DENIED/407 3995 GET <a href="http://start.ubuntu.com/14.04/Google/">http://start.ubuntu.com/14.04/Google/</a>? - HIER_NONE/- text/html<br>1473026088.908 0 192.168.200.85 TCP_DENIED/407 3796 CONNECT <a href="http://shavar.services.mozilla.com:443">shavar.services.mozilla.com:443</a> - HIER_NONE/- text/html<br>1473026091.932 0 192.168.200.85 TCP_DENIED/407 3780 CONNECT <a href="http://self-repair.mozilla.org:443">self-repair.mozilla.org:443</a> - HIER_NONE/- text/html<br>1473026096.418 180 192.168.200.85 TCP_MISS/200 960 POST <a href="http://ocsp.digicert.com/">http://ocsp.digicert.com/</a> marcio HIER_DIRECT/<a href="http://192.16.58.8">192.16.58.8</a> application/ocsp-response<br>1473026096.467 85 192.168.200.85 TCP_MISS/200 960 POST <a href="http://ocsp.digicert.com/">http://ocsp.digicert.com/</a> marcio HIER_DIRECT/<a href="http://192.16.58.8">192.16.58.8</a> application/ocsp-response<br>1473026102.051 525 192.168.200.85 TCP_REFRESH_UNMODIFIED/200 2907 GET <a href="http://start.ubuntu.com/14.04/Google/">http://start.ubuntu.com/14.04/Google/</a>? marcio HIER_DIRECT/<a href="http://91.189.90.41">91.189.90.41</a> text/html<br>1473026102.091 0 192.168.200.85 TCP_HIT/200 22099 GET <a href="http://start.ubuntu.com/12.04/sprite.png">http://start.ubuntu.com/12.04/sprite.png</a> marcio HIER_NONE/- image/png<br>1473026104.855 0 10.133.85.3 TCP_DENIED/407 3929 GET <a href="http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab">http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab</a>? - HIER_NONE/- text/html<br>1473026146.453 83 192.168.200.85 TCP_MISS/200 960 POST <a href="http://ocsp.digicert.com/">http://ocsp.digicert.com/</a> marcio HIER_DIRECT/<a href="http://192.16.58.8">192.16.58.8</a> application/ocsp-response<br>1473026147.447 83 192.168.200.85 TCP_MISS/200 960 POST <a href="http://ocsp.digicert.com/">http://ocsp.digicert.com/</a> marcio HIER_DIRECT/<a href="http://192.16.58.8">192.16.58.8</a> application/ocsp-response<br>1473026148.923 0 192.168.200.85 TCP_DENIED/407 3796 CONNECT <a href="http://shavar.services.mozilla.com:443">shavar.services.mozilla.com:443</a> - HIER_NONE/- text/html<br>1473026157.117 61506 192.168.200.85 TCP_MISS/200 3525 CONNECT <a href="http://tiles.services.mozilla.com:443">tiles.services.mozilla.com:443</a> marcio HIER_DIRECT/<a href="http://52.24.123.95">52.24.123.95</a> -<br>1473026157.195 61584 192.168.200.85 TCP_MISS/200 4521 CONNECT <a href="http://self-repair.mozilla.org:443">self-repair.mozilla.org:443</a> marcio HIER_DIRECT/<a href="http://54.69.9.44">54.69.9.44</a> -<br>1473026160.190 63085 192.168.200.85 TCP_MISS/200 5449 CONNECT <a href="http://self-repair.mozilla.org:443">self-repair.mozilla.org:443</a> marcio HIER_DIRECT/<a href="http://54.69.9.44">54.69.9.44</a> -<br>1473026204.518 0 192.168.200.85 TCP_DENIED/407 3780 CONNECT <a href="http://safebrowsing.google.com:443">safebrowsing.google.com:443</a> - HIER_NONE/- text/html<br>1473026207.807 62056 192.168.200.85 TCP_MISS/200 3686 CONNECT <a href="http://incoming.telemetry.mozilla.org:443">incoming.telemetry.mozilla.org:443</a> marcio HIER_DIRECT/<a href="http://52.89.83.186">52.89.83.186</a> -<br>1473026207.808 61159 192.168.200.85 TCP_MISS/200 390 CONNECT <a href="http://incoming.telemetry.mozilla.org:443">incoming.telemetry.mozilla.org:443</a> marcio HIER_DIRECT/<a href="http://52.89.83.186">52.89.83.186</a> -<br>1473026207.808 61159 192.168.200.85 TCP_MISS/200 390 CONNECT <a href="http://incoming.telemetry.mozilla.org:443">incoming.telemetry.mozilla.org:443</a> marcio HIER_DIRECT/<a href="http://52.89.83.186">52.89.83.186</a> -<br>1473026207.808 61160 192.168.200.85 TCP_MISS/200 390 CONNECT <a href="http://incoming.telemetry.mozilla.org:443">incoming.telemetry.mozilla.org:443</a> marcio HIER_DIRECT/<a href="http://52.89.83.186">52.89.83.186</a> -<br>1473026207.809 61160 192.168.200.85 TCP_MISS/200 390 CONNECT <a href="http://incoming.telemetry.mozilla.org:443">incoming.telemetry.mozilla.org:443</a> marcio HIER_DIRECT/<a href="http://52.89.83.186">52.89.83.186</a> -<br>1473026207.814 61165 192.168.200.85 TCP_MISS/200 390 CONNECT <a href="http://incoming.telemetry.mozilla.org:443">incoming.telemetry.mozilla.org:443</a> marcio HIER_DIRECT/<a href="http://52.89.83.186">52.89.83.186</a> -<br>1473026207.866 61052 192.168.200.85 TCP_MISS/200 3821 CONNECT <a href="http://aus5.mozilla.org:443">aus5.mozilla.org:443</a> marcio HIER_DIRECT/<a href="http://52.34.235.152">52.34.235.152</a> -<br>1473026212.687 116018 192.168.200.85 TCP_MISS/200 61971 CONNECT <a href="http://normandy.cdn.mozilla.net:443">normandy.cdn.mozilla.net:443</a> marcio HIER_DIRECT/<a href="http://52.84.177.125">52.84.177.125</a> -<br>1473026264.532 0 192.168.200.85 TCP_DENIED/407 3780 CONNECT <a href="http://safebrowsing.google.com:443">safebrowsing.google.com:443</a> - HIER_NONE/- text/html<br>1473026299.647 0 10.133.85.3 TCP_DENIED/407 3813 CONNECT <a href="http://iecvlist.microsoft.com:443">iecvlist.microsoft.com:443</a> - HIER_NONE/- text/html<br>1473026335.221 0 10.133.85.3 TCP_DENIED/407 3813 CONNECT <a href="http://ieonline.microsoft.com:443">ieonline.microsoft.com:443</a> - HIER_NONE/- text/html<br>1473026592.061 6624 10.133.85.3 TCP_MISS/200 3582 CONNECT <a href="http://forum.zentyal.org:443">forum.zentyal.org:443</a> marcio HIER_DIRECT/<a href="http://162.13.13.134">162.13.13.134</a> -<br>1473026793.073 0 192.168.200.96 TCP_DENIED/407 3780 CONNECT <a href="http://safebrowsing.google.com:443">safebrowsing.google.com:443</a> - HIER_NONE/- text/html<br><br>/var/log/squid3/cache.log<br><br>----------<br>2016/09/04 19:06:33.073 kid1| client_side.cc(2407) parseHttpRequest: HTTP Client local=<a href="http://192.168.200.7:3128">192.168.200.7:3128</a> remote=<a href="http://192.168.200.96:56302">192.168.200.96:56302</a> FD 12 flags=1<br>2016/09/04 19:06:33.073 kid1| client_side.cc(2408) parseHttpRequest: HTTP Client REQUEST:<br>---------<br>CONNECT <a href="http://safebrowsing.google.com:443">safebrowsing.google.com:443</a> HTTP/1.1<br>User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:35.0) Gecko/20100101 Firefox/35.0<br>Proxy-Connection: keep-alive<br>Connection: keep-alive<br>Host: <a href="http://safebrowsing.google.com:443">safebrowsing.google.com:443</a><br><br><br>----------<br>2016/09/04 19:06:33.073 kid1| client_side.cc(1459) sendStartOfMessage: HTTP Client local=<a href="http://192.168.200.7:3128">192.168.200.7:3128</a> remote=<a href="http://192.168.200.96:56302">192.168.200.96:56302</a> FD 12 flags=1<br>2016/09/04 19:06:33.073 kid1| client_side.cc(1460) sendStartOfMessage: HTTP Client REPLY:<br>---------<br>HTTP/1.1 407 Proxy Authentication Required<br>Server: squid/3.4.8<br>Mime-Version: 1.0<br>Date: Sun, 04 Sep 2016 22:06:33 GMT<br>Content-Type: text/html<br>Content-Length: 3357<br>X-Squid-Error: <b>ERR_CACHE_ACCESS_DENIED 0</b><br>Proxy-Authenticate: Basic realm="CMS"<br>X-Cache: MISS from <a href="http://proxy.cms.ensino.br">proxy.cms.ensino.br</a><br>X-Cache-Lookup: NONE from <a href="http://proxy.cms.ensino.br:3128">proxy.cms.ensino.br:3128</a><br>Via: 1.1 <a href="http://proxy.cms.ensino.br">proxy.cms.ensino.br</a> (squid/3.4.8)<br>Connection: keep-alive<br><br>----------<br><br>Sorry, but I didn't discover the problem! <br><br>Anybody have an idea?<br><br></div>Regards,<br><br></div>Márcio<br></div><div class="gmail_extra"><br><div class="gmail_quote">2016-09-02 11:10 GMT-03:00 Amos Jeffries <span dir="ltr"><<a href="mailto:squid3@treenet.co.nz" target="_blank">squid3@treenet.co.nz</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 2/09/2016 3:21 p.m., Marcio Demetrio Bacci wrote:<br>
> In my Windows workstations the authentication works correctly, however in<br>
> Ubuntu 14.04 the user and password are asked twice.<br>
><br>
> I am using the basic_ncsa_auth with Squid 3.4.8<br>
><br>
> Is there any setting that I do in Squid?<br>
><br>
> Bellow is my squid.conf<br>
><br>
</span>...<br>
<span class="">><br>
> auth_param basic program /usr/lib/squid3/basic_ncsa_<wbr>auth /etc/squid3/passwd<br>
> auth_param basic children 5<br>
> auth_param basic realm AUTENTICACAO<br>
> auth_param basic credentialsttl 2 hours<br>
> auth_param basic casesensitive off<br>
><br>
</span>...<br>
<span class="">><br>
> ### Regras iniciais do Squid<br>
> http_access allow localhost<br>
> http_access allow purge localhost<br>
> http_access deny purge<br>
> http_access deny !Safe_ports<br>
> http_access deny CONNECT !SSL_ports<br>
<br>
</span>Please re-order the above security rules to be:<br>
<span class=""><br>
http_access deny !Safe_ports<br>
http_access deny CONNECT !SSL_ports<br>
</span> http_access allow localhost<br>
http_access deny purge<br>
<span class=""><br>
><br>
> ### Exige autenticacao<br>
> acl autenticados proxy_auth REQUIRED<br>
> http_access allow autenticados<br>
><br>
> ### Bloqueia extensoes de arquivos<br>
> acl extensoes_bloqueadas url_regex -i "/etc/squid3/acls/extensoes-<wbr>proibidas"<br>
><br>
> ### Liberar alguns sites<br>
> acl sites_liberados url_regex -i "/etc/squid3/acls/sites-<wbr>permitidos"<br>
><br>
> ### Bloqueia sites por URL<br>
> acl sites_bloqueados url_regex -i "/etc/squid3/acls/sites-<wbr>proibidos"<br>
><br>
> #bloqueios basicos<br>
> http_access allow sites_liberados<br>
> http_access deny extensoes_bloqueadas<br>
> http_access deny sites_bloqueados<br>
><br>
> ### LAN #####<br>
> acl rede_lan src <a href="http://192.168.200.0/22" rel="noreferrer" target="_blank">192.168.200.0/22</a><br>
><br>
> ### Nega acesso de quem nao esta na rede local do CMB<br>
> http_access allow rede_lan<br>
><br>
> #negando o acesso para todos que nao estiverem nas regras anteriores<br>
> http_access deny all<br>
><br>
</span>...<br>
<br>
<br>
With your config Squid will only challenge the browser to send some if<br>
they are completely missing. It will not deny access when invalid<br>
credentials are sent.<br>
<br>
That means the browser probably does not have access to any Basic auth<br>
credentials it can send.<br>
<br>
The two popups are probably from two TCP connections being made with no<br>
credentials (maybe the result of the "Happy Eyeballs" algorithm doing<br>
its thing). You can check for that with "debug_options 11,2" and seeing<br>
what HTTP messages are happening with what IP:port details.<br>
<br>
Amos<br>
<br>
______________________________<wbr>_________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.<wbr>org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/<wbr>listinfo/squid-users</a><br>
</blockquote></div><br></div>