<div dir="auto">Jesus, never seen so many messages that could have been answered by reading the basic squid docs.<div dir="auto"><br></div><div dir="auto">Tempted to unsub....sheesh</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 12 Sep. 2017 6:19 am, <<a href="mailto:squid-users-request@lists.squid-cache.org">squid-users-request@lists.squid-cache.org</a>> wrote:<br type="attribution"><blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Send squid-users mailing list submissions to<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.<wbr>org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/<wbr>listinfo/squid-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:squid-users-request@lists.squid-cache.org">squid-users-request@lists.<wbr>squid-cache.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:squid-users-owner@lists.squid-cache.org">squid-users-owner@lists.squid-<wbr>cache.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of squid-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: Need assistance debugging Squid error: ssl_ctrd helpers<br>
crashing too quickly (Rohit Sodhia)<br>
<br>
<br>
------------------------------<wbr>------------------------------<wbr>----------<br>
<br>
Message: 1<br>
Date: Mon, 11 Sep 2017 16:18:39 -0400<br>
From: Rohit Sodhia <<a href="mailto:sodhia.rohit@gmail.com">sodhia.rohit@gmail.com</a>><br>
To: Yuri <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>><br>
Cc: <a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.<wbr>org</a><br>
Subject: Re: [squid-users] Need assistance debugging Squid error:<br>
ssl_ctrd helpers crashing too quickly<br>
Message-ID:<br>
<<a href="mailto:CAN1w9tfQt3Mivwpyo%2Bu3Qp0agQ8pOgz2MGo2Wvb5AdGU3zbkjw@mail.gmail.com">CAN1w9tfQt3Mivwpyo+<wbr>u3Qp0agQ8pOgz2MGo2Wvb5AdGU3zbk<wbr>jw@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Ok. Looks like 3.5.20 is the latest on the yum repo I'm using, so guess<br>
I'll have to learn how to compile it myself; never compiled a package<br>
before.<br>
<br>
On Mon, Sep 11, 2017 at 4:17 PM, Yuri <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>> wrote:<br>
<br>
> Hardly,<br>
><br>
> most probably something in repo's package. However, upgrade is always<br>
> recommended, especially with modern functionality. It changes fast enough.<br>
><br>
> 12.09.2017 2:15, Rohit Sodhia пишет:<br>
><br>
> Ah. I'm on 3.5.20; not sure how far back that is. Is that the core of the<br>
> problem?<br>
><br>
> On Mon, Sep 11, 2017 at 4:07 PM, Yuri <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>> wrote:<br>
><br>
>> Seems latest 4.0.21 is good enough. Most critical SSL-related bugs almost<br>
>> closed or closed.<br>
>><br>
>> At least latest 3.5.27 is released. AFAIK this is minimum to problem-free<br>
>> running.<br>
>><br>
>> Repositories software sometimes has strange quirks, or sometimes rancid.<br>
>> 12.09.2017 2:05, Rohit Sodhia пишет:<br>
>><br>
>> I'll try to find it, but I read a few articles/SO questions that<br>
>> suggested there were bugs in 4 relating to SSL bumping? If they were wrong,<br>
>> I'd be glad to go forward. Should I be removing the yum squid package and<br>
>> compile my own? Is 3.5 problematic besides being old?<br>
>><br>
>> On Mon, Sep 11, 2017 at 4:02 PM, Yuri <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>> wrote:<br>
>><br>
>>> Wait. Squid 3.5.20? So ancient?<br>
>>><br>
>>> 12.09.2017 1:58, Rohit Sodhia пишет:<br>
>>><br>
>>> sslcrtd_program /usr/lib64/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB<br>
>>><br>
>>> I used the line from the Stack Overflow question I linked earlier.<br>
>>><br>
>>> On Mon, Sep 11, 2017 at 3:41 PM, Yuri <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>> wrote:<br>
>>><br>
>>>> Well. Let's check more deep.<br>
>>>><br>
>>>> Show me parameter sslcrtd_program in your squid.conf<br>
>>>><br>
>>>> 12.09.2017 1:23, Rohit Sodhia пишет:<br>
>>>><br>
>>>> Unfortunately, no luck yet. Thank you again for your help before.<br>
>>>><br>
>>>> I found that the user squid and group squid existed already, so I added<br>
>>>><br>
>>>> cache_effective_user squid<br>
>>>> cache_effective_group squid<br>
>>>><br>
>>>> to my config (first two lines), made sure /var/lib/ssl_db and it's<br>
>>>> contents were set to squid:squid and restarted the service, but I'm still<br>
>>>> getting the same error :(<br>
>>>><br>
>>>> On Mon, Sep 11, 2017 at 2:42 PM, Rohit Sodhia <<a href="mailto:sodhia.rohit@gmail.com">sodhia.rohit@gmail.com</a>><br>
>>>> wrote:<br>
>>>><br>
>>>>> I'll try that immediately, thanks! I appreciate all your advice;<br>
>>>>> hopefully I won't have to reach out again :p<br>
>>>>><br>
>>>>> On Mon, Sep 11, 2017 at 2:39 PM, Yuri <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>> wrote:<br>
>>>>><br>
>>>>>> I'm not Linux fanboy, but modern squid never runs as root. So, most<br>
>>>>>> probably it runs as nobody user.<br>
>>>>>><br>
>>>>>> Ah, yes:<br>
>>>>>><br>
>>>>>> # TAG: cache_effective_user<br>
>>>>>> # If you start Squid as root, it will change its effective/real<br>
>>>>>> # UID/GID to the user specified below. The default is to change<br>
>>>>>> # to UID of nobody.<br>
>>>>>> # see also; cache_effective_group<br>
>>>>>> #Default:<br>
>>>>>> # cache_effective_user nobody<br>
>>>>>><br>
>>>>>> # TAG: cache_effective_group<br>
>>>>>> # Squid sets the GID to the effective user's default group ID<br>
>>>>>> # (taken from the password file) and supplementary group list<br>
>>>>>> # from the groups membership.<br>
>>>>>> #<br>
>>>>>> # If you want Squid to run with a specific GID regardless of<br>
>>>>>> # the group memberships of the effective user then set this<br>
>>>>>> # to the group (or GID) you want Squid to run as. When set<br>
>>>>>> # all other group privileges of the effective user are ignored<br>
>>>>>> # and only this GID is effective. If Squid is not started as<br>
>>>>>> # root the user starting Squid MUST be member of the specified<br>
>>>>>> # group.<br>
>>>>>> #<br>
>>>>>> # This option is not recommended by the Squid Team.<br>
>>>>>> # Our preference is for administrators to configure a secure<br>
>>>>>> # user account for squid with UID/GID matching system policies.<br>
>>>>>> #Default:<br>
>>>>>> # Use system group memberships of the cache_effective_user account<br>
>>>>>><br>
>>>>>> As documented. :)<br>
>>>>>><br>
>>>>>> AFAIK best solution is create non-privileged group & user (like<br>
>>>>>> squid/squid) and set both this parameters explicity.<br>
>>>>>><br>
>>>>>> Then change owner recursively on SSL cache to this user.<br>
>>>>>><br>
>>>>>> 12.09.2017 0:36, Rohit Sodhia пишет:<br>
>>>>>><br>
>>>>>> Neither of those values are set in my config. Even though I'm not<br>
>>>>>> using squid for caching, I need those values? They aren't set in the<br>
>>>>>> default configs either.<br>
>>>>>><br>
>>>>>> On Mon, Sep 11, 2017 at 2:33 PM, Yuri <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>> wrote:<br>
>>>>>><br>
>>>>>>> Most probably you squid runs as another user than squid.<br>
>>>>>>><br>
>>>>>>> Check your squid.conf for cache_effective_user and<br>
>>>>>>> cache_effective_group values.<br>
>>>>>>><br>
>>>>>>> Then change SSL cache permissions to this values. Should work.<br>
>>>>>>><br>
>>>>>>> 12.09.2017 0:30, Rohit Sodhia пишет:<br>
>>>>>>><br>
>>>>>>> Thanks for the feedback! I just used yum (it's a CentOS 7 VB) and it<br>
>>>>>>> set it up like that. I changed the owner and group to squid:squid and tried<br>
>>>>>>> restarting squid, but still get the same errors. I thought to run the<br>
>>>>>>> command again, but this time it says<br>
>>>>>>><br>
>>>>>>> /usr/lib64/squid/ssl_crtd: Cannot create /var/lib/ssl_db<br>
>>>>>>><br>
>>>>>>> If this folder has incorrect permissions are there possibly other<br>
>>>>>>> permission issues?<br>
>>>>>>><br>
>>>>>>> On Mon, Sep 11, 2017 at 2:25 PM, Yuri <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>> wrote:<br>
>>>>>>><br>
>>>>>>>> Here you root of problem.<br>
>>>>>>>><br>
>>>>>>>> Should be (on my setups):<br>
>>>>>>>><br>
>>>>>>>> # ls -al /var/lib/ssl_db<br>
>>>>>>>> total 326<br>
>>>>>>>> drwxr-xr-x 3 squid squid 5 Sep 5 00:53 .<br>
>>>>>>>> drwxr-xr-x 8 root other 8 Sep 5 00:53 ..<br>
>>>>>>>> drwxr-xr-x 2 squid squid 454 Sep 11 23:37 certs<br>
>>>>>>>> -rw-r--r-- 1 squid squid 280575 Sep 11 23:37 index.txt<br>
>>>>>>>> -rw-r--r-- 1 squid squid 7 Sep 11 23:37 size<br>
>>>>>>>><br>
>>>>>>>> I.e. Squid has no access to SSL cache dir structures.<br>
>>>>>>>><br>
>>>>>>>> 12.09.2017 0:23, Rohit Sodhia пишет:<br>
>>>>>>>><br>
>>>>>>>> total 8<br>
>>>>>>>> drwxr-xr-x. 3 root root 48 Sep 11 12:42 .<br>
>>>>>>>> drwxr-xr-x. 32 root root 4096 Sep 11 12:42 ..<br>
>>>>>>>> drwxr-xr-x. 2 root root 6 Sep 11 12:42 certs<br>
>>>>>>>> -rw-r--r--. 1 root root 0 Sep 11 12:42 index.txt<br>
>>>>>>>> -rw-r--r--. 1 root root 1 Sep 11 12:42 size<br>
>>>>>>>><br>
>>>>>>>><br>
>>>>>>>> On Mon, Sep 11, 2017 at 2:22 PM, Yuri <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>> wrote:<br>
>>>>>>>><br>
>>>>>>>>> Show output of<br>
>>>>>>>>><br>
>>>>>>>>> ls -al /var/lib/ssl_db<br>
>>>>>>>>><br>
>>>>>>>>> 12.09.2017 0:21, Rohit Sodhia пишет:<br>
>>>>>>>>><br>
>>>>>>>>> Yes, but telling me it's crashing unfortunately doesn't help me<br>
>>>>>>>>> figure out why or how to fix it. I've run the command it suggests but it<br>
>>>>>>>>> doesn't help. I'm unfortunately not an ops guy familiar with this kind of<br>
>>>>>>>>> stuff; I don't see anything on how to figure out what to do about it.<br>
>>>>>>>>><br>
>>>>>>>>> On Mon, Sep 11, 2017 at 2:17 PM, Yuri <<a href="mailto:yvoinov@gmail.com">yvoinov@gmail.com</a>> wrote:<br>
>>>>>>>>><br>
>>>>>>>>>> It tells you what's happens.<br>
>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>>>> 11.09.2017 23:50, Rohit Sodhia пишет:<br>
>>>>>>>>>> > (ssl_crtd): Uninitialized SSL certificate database directory:<br>
>>>>>>>>>> > /var/lib/ssl_db. To initialize, run "ssl_crtd -c -s<br>
>>>>>>>>>> /var/lib/ssl_db".<br>
>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>>>> ______________________________<wbr>_________________<br>
>>>>>>>>>> squid-users mailing list<br>
>>>>>>>>>> <a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.<wbr>org</a><br>
>>>>>>>>>> <a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/<wbr>listinfo/squid-users</a><br>
>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>>><br>
>>>>>>>>><br>
>>>>>>>><br>
>>>>>>>><br>
>>>>>>><br>
>>>>>>><br>
>>>>>><br>
>>>>>><br>
>>>>><br>
>>>><br>
>>>><br>
>>><br>
>>><br>
>><br>
>><br>
><br>
><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.squid-cache.org/pipermail/squid-users/attachments/20170911/2c3ab1ef/attachment.html" rel="noreferrer" target="_blank">http://lists.squid-cache.org/<wbr>pipermail/squid-users/<wbr>attachments/20170911/2c3ab1ef/<wbr>attachment.html</a>><br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
______________________________<wbr>_________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.<wbr>org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/<wbr>listinfo/squid-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of squid-users Digest, Vol 37, Issue 30<br>
******************************<wbr>*************<br>
</blockquote></div><br></div>