<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<span id="result_box" class="short_text" lang="en"><span class="">In
order not to be unfounded:<br>
<br>
</span></span><a class="moz-txt-link-freetext" href="https://bugs.squid-cache.org/show_bug.cgi?id=4572">https://bugs.squid-cache.org/show_bug.cgi?id=4572</a><br>
<br>
I found workaround more than year ago, however I believe but still
exists.<br>
<br>
PS. It's elementary to reproduce. Just specify cachemgr_passwd in
squid.conf and do not disable password access to cachemgr stats.
Then access to cachemgr from any tool like sqstat - with password
(basic auth) - and see what will in access.log. Congrats, you just
show your proxy manager password to all stats tool and anybody who
watch your statistics reports.<br>
<br>
25.01.2018 07:25, Yuri пишет:<br>
<span style="white-space: pre-wrap; display: block; width: 98vw;">>
</span>
<blockquote type="cite">Everything is a little worse. If you need a
password to access the cachemanager - it will shown in the logs. I
believe that this is a bug and a hole in security.<br>
<br>
Preventing by ACL can be workaround, but hardly this is feature.<br>
<br>
<br>
24.01.2018 20:44, Amos Jeffries пишет:<br>
> On 25/01/18 02:59, Alex Gutiérrez Martínez wrote:<br>
>> Hello comunity, im using squid 3.3.8 on ubuntu 14.04.02
LTS. I have<br>
>> implemented sqstat on this server to monitor my
bandwidth. My problem is<br>
>> simple, i need to remove from my log the line created by
sqstat.<br>
>><br>
>> 1516801891.375 1 10.28.27.36 TCP_MISS/200 25526 GET<br>
>> cache_object://localhost/active_requests - HIER_NONE/-
text/plain<br>
>><br>
>><br>
>> I tried using "access_log" directive, but until now the
only thing i<br>
>> acomplish is stop my squid using a bad configuration.<br>
>><br>
>> Does anyone have an idea of how to solve this problem?<br>
>><br>
<br>
> access_log is the way to go, using the 'manager' ACL.<br>
<br>
> Somewhat like this:<br>
<br>
> access_log /var/log/squid/access.log squid !manager<br>
<br>
<br>
> ... or if you want to log other manager access *except* for
the sqstat<br>
> ones. Then you will need an ACL that uniquely identifies
sqstat instead<br>
> of manager.<br>
<br>
<br>
> Amos<br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><br>
<br>
</blockquote>
<span style="white-space: pre-wrap; display: block; width: 98vw;">>
</span><br>
-- <br>
*****************************<br>
* C++20 : Bug to the future *<br>
*****************************<br>
<br>
</body>
</html>