<div dir="ltr"><div><div><div><div><div>Hi Amos<br><br></div>Now, my squid.conf is as follow (very simple):<br><br>############ START #################<br>http_port 3128<br><br>debug_options 11,2<br><br>cache_mem 512 MB<br>cache_swap_low 80<br>cache_swap_high 90<br><br>maximum_object_size 512 MB<br>minimum_object_size 0 KB<br><br>maximum_object_size_in_memory 4096 KB<br><br>cache_replacement_policy heap LFUDA<br>memory_replacement_policy heap LFUDA<br><br>fqdncache_size 1024<br><br>### Parametros de atualizacao da memoria cache<br>refresh_pattern ^ftp: 1440 20% 10080<br>refresh_pattern ^gopher: 1440 0% 1440<br>refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>refresh_pattern . 0 20% 4320<br><br>### Localizacao dos logs<br>access_log /var/log/squid3/access.log<br>cache_log /var/log/squid3/cache.log<br><br>cache_dir aufs /var/spool/squid3 600 16 256<br><br>visible_hostname proxy<br><br>### acls<br>acl localhost src <a href="http://192.168.200.7/32">192.168.200.7/32</a><br>acl to_localhost dst <a href="http://192.168.200.7/32">192.168.200.7/32</a><br>acl SSL_ports port 22 443 563 7071 10000 <br>acl Safe_ports port 21 70 80 88 210 280 389 443 488 563 591 777 1025-65535 <br><br>acl purge method PURGE<br>acl CONNECT method CONNECT<br><br>http_access deny !Safe_ports<br>http_access deny CONNECT !SSL_ports<br>http_access deny purge<br><br>auth_param basic program /usr/lib/squid3/basic_ncsa_auth /etc/squid3/passwd<br>auth_param basic children 5<br>auth_param basic realm CMS<br>auth_param basic credentialsttl 2 hours<br>auth_param basic casesensitive off<br><br>### Exige autenticacao<br>acl autenticados proxy_auth REQUIRED<br>http_access deny !autenticados<br><br>### Rede do CMS #####<br>acl lannet src <a href="http://192.168.200.0/22">192.168.200.0/22</a> <br><br>### Nega acesso de quem nao esta na rede local do CMS<br>http_access allow lannet <br>http_access allow localhost<br><br>#negando o acesso para todos que nao estiverem nas regras anteriores<br>http_access deny all<br><br>### Erros em portugues<br>error_directory /usr/share/squid3/errors/pt-br<br><br>#cache_effective_user proxy<br>coredump_dir /var/spool/squid3<br><br></div><div>########## END ###########################<br></div><div><br></div>I have some doubts:<br><br>1) I open my browser to test the authentication. It seems OK, but when I open new tab in browser the Squid3 ask the user and password again. Is this normal behavior ?<br><br>2) Is necessary to declare LOCALHOST acl as "acl localhost src <a href="http://192.168.200.7/32">192.168.200.7/32</a>" ?<br><br>3) Isn't necessary MANAGER acl as "acl manager proto cache_object" ?<br><br></div><div>4) Is correct order of the ACL in my squid.conf ? How do I improve it?<br></div><div><br></div><div>5) In my access.log, I have saw many "TCP_MISS/200". Does mean only the website is not in cache or is a strange behavior?<br><br><br></div><div>Sorry, but I'm still learning about Squid!<br></div><div><br><br></div><div>Regards,<br><br></div><div>Márcio<br></div><div><br></div></div></div><br><div><div><div><div><br></div></div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-09-05 1:17 GMT-03:00 Amos Jeffries <span dir="ltr"><<a href="mailto:squid3@treenet.co.nz" target="_blank">squid3@treenet.co.nz</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On 5/09/2016 10:41 a.m., Marcio Demetrio Bacci wrote:<br>
> I have used debug_options 11,2 in squid.conf file. After I have following<br>
> results in logs files:<br>
><br>
> /var/log/squid3/access.log<br>
> 1473026084.048 253 192.168.200.85 TCP_MISS_ABORTED/000 0 POST<br>
> <a href="http://m.addthis.com/live/red_lojson/100eng.json" rel="noreferrer" target="_blank">http://m.addthis.com/live/red_<wbr>lojson/100eng.json</a>? marcio HIER_NONE/- -<br>
> 1473026086.275 0 192.168.200.85 TCP_DENIED/407 3792 CONNECT<br>
> <a href="http://tiles.services.mozilla.com:443" rel="noreferrer" target="_blank">tiles.services.mozilla.com:443</a> - HIER_NONE/- text/html<br>
> 1473026086.778 0 192.168.200.85 TCP_DENIED/407 3995 GET<br>
> <a href="http://start.ubuntu.com/14.04/Google/" rel="noreferrer" target="_blank">http://start.ubuntu.com/14.04/<wbr>Google/</a>? - HIER_NONE/- text/html<br>
> 1473026088.908 0 192.168.200.85 TCP_DENIED/407 3796 CONNECT<br>
> <a href="http://shavar.services.mozilla.com:443" rel="noreferrer" target="_blank">shavar.services.mozilla.com:<wbr>443</a> - HIER_NONE/- text/html<br>
> 1473026091.932 0 192.168.200.85 TCP_DENIED/407 3780 CONNECT<br>
> <a href="http://self-repair.mozilla.org:443" rel="noreferrer" target="_blank">self-repair.mozilla.org:443</a> - HIER_NONE/- text/html<br>
> 1473026096.418 180 192.168.200.85 TCP_MISS/200 960 POST<br>
> <a href="http://ocsp.digicert.com/" rel="noreferrer" target="_blank">http://ocsp.digicert.com/</a> marcio HIER_DIRECT/<a href="http://192.16.58.8" rel="noreferrer" target="_blank">192.16.58.8</a><br>
> application/ocsp-response<br>
> 1473026096.467 85 192.168.200.85 TCP_MISS/200 960 POST<br>
> <a href="http://ocsp.digicert.com/" rel="noreferrer" target="_blank">http://ocsp.digicert.com/</a> marcio HIER_DIRECT/<a href="http://192.16.58.8" rel="noreferrer" target="_blank">192.16.58.8</a><br>
> application/ocsp-response<br>
> 1473026102.051 525 192.168.200.85 TCP_REFRESH_UNMODIFIED/200 2907 GET<br>
> <a href="http://start.ubuntu.com/14.04/Google/" rel="noreferrer" target="_blank">http://start.ubuntu.com/14.04/<wbr>Google/</a>? marcio HIER_DIRECT/<a href="http://91.189.90.41" rel="noreferrer" target="_blank">91.189.90.41</a><br>
> text/html<br>
> 1473026102.091 0 192.168.200.85 TCP_HIT/200 22099 GET<br>
> <a href="http://start.ubuntu.com/12.04/sprite.png" rel="noreferrer" target="_blank">http://start.ubuntu.com/12.04/<wbr>sprite.png</a> marcio HIER_NONE/- image/png<br>
> 1473026104.855 0 10.133.85.3 TCP_DENIED/407 3929 GET<br>
> <a href="http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab" rel="noreferrer" target="_blank">http://ctldl.windowsupdate.<wbr>com/msdownload/update/v3/<wbr>static/trustedr/en/<wbr>authrootstl.cab</a>?<br>
> - HIER_NONE/- text/html<br>
> 1473026146.453 83 192.168.200.85 TCP_MISS/200 960 POST<br>
> <a href="http://ocsp.digicert.com/" rel="noreferrer" target="_blank">http://ocsp.digicert.com/</a> marcio HIER_DIRECT/<a href="http://192.16.58.8" rel="noreferrer" target="_blank">192.16.58.8</a><br>
> application/ocsp-response<br>
> 1473026147.447 83 192.168.200.85 TCP_MISS/200 960 POST<br>
> <a href="http://ocsp.digicert.com/" rel="noreferrer" target="_blank">http://ocsp.digicert.com/</a> marcio HIER_DIRECT/<a href="http://192.16.58.8" rel="noreferrer" target="_blank">192.16.58.8</a><br>
> application/ocsp-response<br>
> 1473026148.923 0 192.168.200.85 TCP_DENIED/407 3796 CONNECT<br>
> <a href="http://shavar.services.mozilla.com:443" rel="noreferrer" target="_blank">shavar.services.mozilla.com:<wbr>443</a> - HIER_NONE/- text/html<br>
> 1473026157.117 61506 192.168.200.85 TCP_MISS/200 3525 CONNECT<br>
> <a href="http://tiles.services.mozilla.com:443" rel="noreferrer" target="_blank">tiles.services.mozilla.com:443</a> marcio HIER_DIRECT/<a href="http://52.24.123.95" rel="noreferrer" target="_blank">52.24.123.95</a> -<br>
> 1473026157.195 61584 192.168.200.85 TCP_MISS/200 4521 CONNECT<br>
> <a href="http://self-repair.mozilla.org:443" rel="noreferrer" target="_blank">self-repair.mozilla.org:443</a> marcio HIER_DIRECT/<a href="http://54.69.9.44" rel="noreferrer" target="_blank">54.69.9.44</a> -<br>
> 1473026160.<a href="tel:190%20%2063085%20192" value="+19063085192">190 63085 192</a>.168.200.85 TCP_MISS/200 5449 CONNECT<br>
> <a href="http://self-repair.mozilla.org:443" rel="noreferrer" target="_blank">self-repair.mozilla.org:443</a> marcio HIER_DIRECT/<a href="http://54.69.9.44" rel="noreferrer" target="_blank">54.69.9.44</a> -<br>
> 1473026204.518 0 192.168.200.85 TCP_DENIED/407 3780 CONNECT<br>
> <a href="http://safebrowsing.google.com:443" rel="noreferrer" target="_blank">safebrowsing.google.com:443</a> - HIER_NONE/- text/html<br>
> 1473026207.807 62056 192.168.200.85 TCP_MISS/200 3686 CONNECT<br>
> <a href="http://incoming.telemetry.mozilla.org:443" rel="noreferrer" target="_blank">incoming.telemetry.mozilla.<wbr>org:443</a> marcio HIER_DIRECT/<a href="http://52.89.83.186" rel="noreferrer" target="_blank">52.89.83.186</a> -<br>
> 1473026207.808 61159 192.168.200.85 TCP_MISS/200 390 CONNECT<br>
> <a href="http://incoming.telemetry.mozilla.org:443" rel="noreferrer" target="_blank">incoming.telemetry.mozilla.<wbr>org:443</a> marcio HIER_DIRECT/<a href="http://52.89.83.186" rel="noreferrer" target="_blank">52.89.83.186</a> -<br>
> 1473026207.808 61159 192.168.200.85 TCP_MISS/200 390 CONNECT<br>
> <a href="http://incoming.telemetry.mozilla.org:443" rel="noreferrer" target="_blank">incoming.telemetry.mozilla.<wbr>org:443</a> marcio HIER_DIRECT/<a href="http://52.89.83.186" rel="noreferrer" target="_blank">52.89.83.186</a> -<br>
> 1473026207.808 61160 192.168.200.85 TCP_MISS/200 390 CONNECT<br>
> <a href="http://incoming.telemetry.mozilla.org:443" rel="noreferrer" target="_blank">incoming.telemetry.mozilla.<wbr>org:443</a> marcio HIER_DIRECT/<a href="http://52.89.83.186" rel="noreferrer" target="_blank">52.89.83.186</a> -<br>
> 1473026207.809 61160 192.168.200.85 TCP_MISS/200 390 CONNECT<br>
> <a href="http://incoming.telemetry.mozilla.org:443" rel="noreferrer" target="_blank">incoming.telemetry.mozilla.<wbr>org:443</a> marcio HIER_DIRECT/<a href="http://52.89.83.186" rel="noreferrer" target="_blank">52.89.83.186</a> -<br>
> 1473026207.814 61165 192.168.200.85 TCP_MISS/200 390 CONNECT<br>
> <a href="http://incoming.telemetry.mozilla.org:443" rel="noreferrer" target="_blank">incoming.telemetry.mozilla.<wbr>org:443</a> marcio HIER_DIRECT/<a href="http://52.89.83.186" rel="noreferrer" target="_blank">52.89.83.186</a> -<br>
> 1473026207.866 61052 192.168.200.85 TCP_MISS/200 3821 CONNECT<br>
> <a href="http://aus5.mozilla.org:443" rel="noreferrer" target="_blank">aus5.mozilla.org:443</a> marcio HIER_DIRECT/<a href="http://52.34.235.152" rel="noreferrer" target="_blank">52.34.235.152</a> -<br>
> 1473026212.687 116018 192.168.200.85 TCP_MISS/200 61971 CONNECT<br>
> <a href="http://normandy.cdn.mozilla.net:443" rel="noreferrer" target="_blank">normandy.cdn.mozilla.net:443</a> marcio HIER_DIRECT/<a href="http://52.84.177.125" rel="noreferrer" target="_blank">52.84.177.125</a> -<br>
> 1473026264.532 0 192.168.200.85 TCP_DENIED/407 3780 CONNECT<br>
> <a href="http://safebrowsing.google.com:443" rel="noreferrer" target="_blank">safebrowsing.google.com:443</a> - HIER_NONE/- text/html<br>
> 1473026299.647 0 10.133.85.3 TCP_DENIED/407 3813 CONNECT<br>
> <a href="http://iecvlist.microsoft.com:443" rel="noreferrer" target="_blank">iecvlist.microsoft.com:443</a> - HIER_NONE/- text/html<br>
> 1473026335.221 0 10.133.85.3 TCP_DENIED/407 3813 CONNECT<br>
> <a href="http://ieonline.microsoft.com:443" rel="noreferrer" target="_blank">ieonline.microsoft.com:443</a> - HIER_NONE/- text/html<br>
> 1473026592.061 6624 10.133.85.3 TCP_MISS/200 3582 CONNECT<br>
> <a href="http://forum.zentyal.org:443" rel="noreferrer" target="_blank">forum.zentyal.org:443</a> marcio HIER_DIRECT/<a href="http://162.13.13.134" rel="noreferrer" target="_blank">162.13.13.134</a> -<br>
<br>
</div></div>Notice how the 407 occur in bunches. 2-3 getting a 407 reject, then many<br>
requests going through with user credentials. Then again some without<br>
any getting a 407.<br>
Those bunches of 407 will be matching some type of credentials timeout<br>
in the browser, or opening of new tabs.<br>
<br>
<br>
This request below is the only one from 192.168.200.96 so appears to be<br>
the one you provide cache.log trace for...<br>
<span class=""><br>
<br>
> 1473026793.073 0 192.168.200.96 TCP_DENIED/407 3780 CONNECT<br>
> <a href="http://safebrowsing.google.com:443" rel="noreferrer" target="_blank">safebrowsing.google.com:443</a> - HIER_NONE/- text/html<br>
><br>
> /var/log/squid3/cache.log<br>
><br>
> ----------<br>
> 2016/09/04 19:06:33.073 kid1| client_side.cc(2407) parseHttpRequest: HTTP<br>
> Client local=<a href="http://192.168.200.7:3128" rel="noreferrer" target="_blank">192.168.200.7:3128</a> remote=<a href="http://192.168.200.96:56302" rel="noreferrer" target="_blank">192.168.200.96:56302</a> FD 12 flags=1<br>
> 2016/09/04 19:06:33.073 kid1| client_side.cc(2408) parseHttpRequest: HTTP<br>
> Client REQUEST:<br>
> ---------<br>
> CONNECT <a href="http://safebrowsing.google.com:443" rel="noreferrer" target="_blank">safebrowsing.google.com:443</a> HTTP/1.1<br>
> User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:35.0) Gecko/20100101<br>
> Firefox/35.0<br>
> Proxy-Connection: keep-alive<br>
> Connection: keep-alive<br>
> Host: <a href="http://safebrowsing.google.com:443" rel="noreferrer" target="_blank">safebrowsing.google.com:443</a><br>
<br>
</span>Notice the abence of any Proxy-Authorization header containing credentials.<br>
<span class=""><br>
><br>
><br>
> ----------<br>
> 2016/09/04 19:06:33.073 kid1| client_side.cc(1459) sendStartOfMessage: HTTP<br>
> Client local=<a href="http://192.168.200.7:3128" rel="noreferrer" target="_blank">192.168.200.7:3128</a> remote=<a href="http://192.168.200.96:56302" rel="noreferrer" target="_blank">192.168.200.96:56302</a> FD 12 flags=1<br>
> 2016/09/04 19:06:33.073 kid1| client_side.cc(1460) sendStartOfMessage: HTTP<br>
> Client REPLY:<br>
> ---------<br>
> HTTP/1.1 407 Proxy Authentication Required<br>
> Server: squid/3.4.8<br>
> Mime-Version: 1.0<br>
> Date: Sun, 04 Sep 2016 22:06:33 GMT<br>
> Content-Type: text/html<br>
> Content-Length: 3357<br>
</span>> X-Squid-Error: *ERR_CACHE_ACCESS_DENIED 0*<br>
> Proxy-Authenticate: Basic realm="CMS"<br>
<br>
That realm="CMS" does not match the realm value of "AUTENTICACAO" which<br>
your earlier config contained.<br>
<br>
Unless you changed your auth_param settings that is a sign that some<br>
other proxy is generating that response message. BUT, your access.log<br>
entry shows no server being contacted.<br>
<span class=""><br>
<br>
<br>
> X-Cache: MISS from <a href="http://proxy.cms.ensino.br" rel="noreferrer" target="_blank">proxy.cms.ensino.br</a><br>
> X-Cache-Lookup: NONE from <a href="http://proxy.cms.ensino.br:3128" rel="noreferrer" target="_blank">proxy.cms.ensino.br:3128</a><br>
> Via: 1.1 <a href="http://proxy.cms.ensino.br" rel="noreferrer" target="_blank">proxy.cms.ensino.br</a> (squid/3.4.8)<br>
> Connection: keep-alive<br>
><br>
> ----------<br>
><br>
> Sorry, but I didn't discover the problem!<br>
><br>
> Anybody have an idea?<br>
<br>
</span>If you altered your squid.conf settings as above in the auth details,<br>
did you also remove 192.168.200.7 from the "localhost" ACL ?<br>
<br>
Your rule "http_access allow localhost" occurs before anything that<br>
requires authentication. That means these requests coming from<br>
192.168.200.7 to your proxy would not use authentication for the above<br>
CONNECT request. So no reason for your proxy to generate any 407 response.<br>
<span class="HOEnZb"><font color="#888888"><br>
<br>
Amos<br>
<br>
</font></span></blockquote></div><br></div>