<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi amos , thanks for the kind response .<div class=""><br class=""></div><div class="">i denied to rebuild squid without IPV6 support and seems now no error in helper .</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">i just curious to know about the auth directors in squid how should i arrange it :</div><div class=""><br class=""></div><div class="">acl localnet src all</div><div class=""><br class=""></div><div class=""><div class="">auth_param basic program /lib/squid/basic_ncsa_auth /etc/squid/squid_user</div><div class="">acl ncsa_users proxy_auth REQUIRED</div><div class="">auth_param basic children 1000</div><div class=""><br class=""></div><div class="">external_acl_type bandwidth_check ttl=0 %SRC /usr/local/bin/bandwidth_check</div><div class="">acl bandwidth_auth external bandwidth_check</div><div class="">http_access allow localnet bandwidth_auth</div><div class="">http_access deny localnet !bandwidth_auth</div><div class="">###################################################</div><div class="">http_access allow ncsa_users</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">is above correct sequence to block any user exceeded quota ?</div><div class="">also should i use </div><div class="">external_acl_type bandwidth_check ttl=0 %SRC /usr/local/bin/bandwidth_check</div><div class=""><br class=""></div><div class="">or</div><div class=""><br class=""></div><div class="">external_acl_type bandwidth_check ttl=0 %SRC %LOGIN /usr/local/bin/bandwidth_check</div><div class=""><br class=""></div><div class="">or </div><div class=""><br class=""></div><div class=""><div class="">external_acl_type bandwidth_check ttl=0 <b class="">%EXT_USER</b> /usr/local/bin/bandwidth_check</div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">thanks amos in advance </div></div><div style=""><blockquote type="cite" class=""><div class="">On Sep 4, 2017, at 8:10 AM, Amos Jeffries <<a href="mailto:squid3@treenet.co.nz" class="">squid3@treenet.co.nz</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On 04/09/17 07:49, --Ahmad-- wrote:<br class=""><blockquote type="cite" class="">Hello squid folks .<br class="">I’m trying to use squid external helper to get quote to ips or users.<br class="">I’m following the wiki :<br class=""><a href="http://www.mikealeonetti.com/wiki/index.php?title=Squid_Arms_and_Tentacles:_Bandwidth_quotas" class="">http://www.mikealeonetti.com/wiki/index.php?title=Squid_Arms_and_Tentacles:_Bandwidth_quotas</a><br class="">i have done everything my side on squid .<br class="">i have tested the connection :<br class="">root@localhost:~# /usr/local/bin/bandwidth_calculate /etc/squid/bandwidth_rules<br class="">root@localhost:~#<br class="">no errors above !<br class="">#######################################<br class="">the issue I’m not sure if I’m using squid config file integration correctly .<br class="">here is my squid.conf file :<br class="">dns_v4_first on<br class="">acl localnet src all<br class=""></blockquote><br class="">You have defined your LAN to be the entire Internet. Don't do that.<br class=""><br class="">Define localnet to be your actual network ranges.<br class=""><br class="">Use the provided 'all' ACL to refer to things that are allowed/denied to everyone online. Most of the time 'all' is unnecessary.<br class=""><br class="">If you expect clients from the general web to access your proxy and some access control to apply to them, then simply do not limit those access controls with the 'localnet' ACL.<br class=""><br class=""><br class=""><blockquote type="cite" class="">auth_param basic program /lib/squid/basic_ncsa_auth /etc/squid/squid_user<br class="">acl ncsa_users proxy_auth REQUIRED<br class="">auth_param basic children 1000<br class=""></blockquote><br class="">How many users do expect exactly?<br class=""><br class="">Squid de-duplicated overlapping Basic auth logins so one user can login multiple times at once (ie login bursts when a Browser starts up) with only one query sent to the auth helper. NCSA is also extremely fast lookups.<br class=""><br class="">If you bumped that up because of the WARNING logged, then please change your practices to fix ERRORs before WARNINGs.<br class="">* WARNINGs are logged for things Squid can workaround but needs help to fix properly,<br class="">* ERRORs are things Squid cannot do anything about and need your attention,<br class="">* FATALs are things that are absolutely critical to fix if you are going to use Squid at all.<br class=""><br class=""><br class=""><blockquote type="cite" class="">external_acl_type bandwidth_check ttl=60 %SRC /usr/local/bin/bandwidth_check<br class=""></blockquote><br class="">The ttl= parameter needs to be 0 for accurate bandwidth results. With the above the helper is only checked once per minute, not on every request.<br class="">Keep in mind that you are only controlling whether new requests can start, and once started they will complete. So regular re-checking is required to minimize overages.<br class=""><br class="">NP: negative_ttl= control how often Squid re-checks results from the helper once users go over their quota. This is the option that you will want to tune with non-0 values to reduce helper load, but also keep it low enough not to block clients for too long after their quota renews.<br class=""><br class=""><br class=""><blockquote type="cite" class="">acl bandwidth_auth external bandwidth_check<br class="">http_access allow localnet bandwidth_auth<br class="">http_access deny localnet !bandwidth_auth<br class=""></blockquote><br class="">The wiki is documenting the above two rules as *alternatives*. I suggest you go back and read their descriptions, then pick the one that does what you need.<br class=""><br class=""><br class=""><blockquote type="cite" class="">###################################################<br class="">cache_effective_user squid<br class="">cache_effective_group squid<br class="">###########################################<br class="">http_access allow ncsa_users<br class=""></blockquote><br class="">This will only login users that broadcast their credentials. It will not require credentials from clients, and none of your below rules require login to have happened.<br class=""><br class="">Best practice for authentication is to place the rules applying to non-authenticate clients first, then have:<br class=""><br class=""> http_access deny !ncsa_users<br class=""><br class="">... then to follow that with any rules applying to authenticated clients.<br class=""><br class=""><br class=""><blockquote type="cite" class="">############################<br class="">acl SSL_ports port 443<br class="">acl Safe_ports port 80 # http<br class="">acl Safe_ports port 21 # ftp<br class="">acl Safe_ports port 443 # https<br class="">acl Safe_ports port 70 # gopher<br class="">acl Safe_ports port 210 # wais<br class="">acl Safe_ports port 1025-65535 # unregistered ports<br class="">acl Safe_ports port 280 # http-mgmt<br class="">acl Safe_ports port 488 # gss-http<br class="">acl Safe_ports port 591 # filemaker<br class="">acl Safe_ports port 777 # multiling http<br class="">acl CONNECT method CONNECT<br class="">http_access deny !Safe_ports<br class="">http_access deny CONNECT !SSL_ports<br class=""></blockquote><br class="">These Safe_ports and CONNECT rule need to be *above* all of your custom rules. Otherwise they will have zero ability to protect your proxy against the DoS and hijacking attacks they are supposed to prevent.<br class=""><br class=""><snip><br class=""><blockquote type="cite" class="">here is errors i get :<br class="">2017/09/03 19:32:38 kid1| WARNING: external ACL 'bandwidth_check' queue overload. Request rejected '11.13.209.12'.<br class="">2017/09/03 19:38:31 kid1| WARNING: external ACL 'bandwidth_check' queue overload. Request rejected '11.13.209.12'.<br class="">2017/09/03 19:44:46 kid1| WARNING: external ACL 'bandwidth_check' queue overload. Request rejected '148.161.111.42'.<br class="">2017/09/03 19:44:47 kid1| WARNING: external ACL 'bandwidth_check' queue overload. Request rejected '148.161.111.42’.<br class="">but I’m sure 100 % that the ips above not blacklisted bec i check them over the helper :<br class=""></blockquote><br class="">Please re-read the WARNING message.<br class=""><br class="">IPs are *not* being rejected because they are listed. They are being rejected because the helper lookup queue is overloaded and no OK is received.<br class=""><br class=""><blockquote type="cite" class="">here is squid when it run :<br class="">root@localhost:~# tailf /var/log/squid/cache.log<br class="">2017/09/03 19:32:33 kid1| ERROR: Failed to create helper child read FD: TCP [::1]<br class=""></blockquote><br class="">Fix that ERROR. The WARNING's about the helper and ACL checking are all side effects of there not actually being a helper running.<br class=""><br class="">There are several ways to do that:<br class=""><br class="">1) fix the helpers IPv6 support. It seems not to have any, or if it does is somehow still only using the IPv4-only address of localhost. Squid is trying to contact it over an IPv6-v4-mapped address for localhost.<br class=""><br class=""><br class="">2) add the 'ipv4' option to your external_acl_type, to make Squid temporarily be IPv4-only when talking to this helper.<br class=""><br class="">While (2) is very tempting and easy, you will probably find that an IPv4-only helper like this has errors when it gets told the IP address of an IPv6 client. So (1) is the better option and I see the wiki page author goes on about being happy to fix problem with their helper - just get in touch.<br class=""><br class=""><br class="">Amos<br class="">_______________________________________________<br class="">squid-users mailing list<br class=""><a href="mailto:squid-users@lists.squid-cache.org" class="">squid-users@lists.squid-cache.org</a><br class="">http://lists.squid-cache.org/listinfo/squid-users<br class=""></div></div></blockquote></div><br class=""></body></html>