<html><head></head><body>Just want to add, I use SquidGuard in two High load setups and never ran into issues. I didnt integrate it as url rewrite helper but as external acl helper and it works great with 800 Users.. <br><br><div class="gmail_quote">Am 17. September 2018 20:38:06 MESZ schrieb Amos Jeffries <squid3@treenet.co.nz>:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">On 18/09/18 3:37 AM, Service MV wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> Dear Ones, I draw on your experience in seeking help to determine<br> whether or not it is possible to achieve the configuration I am looking<br> for, due to a strange error I am having.<br></blockquote><br>FYI: SquidGuard has not been maintained for many years now.<br><br>I recommend you convert as many of your filtering rules as you can into<br>normal Squid ACLs. Traffic which is being blocked for simple reasons can<br>be done much more efficiently by Squid than a helper.<br><br>You can use the more up-to-date ufdbguard helper as a drop-in<br>replacement for squidguard during the conversion.<br><br><br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> <br> Before commenting on the bug I describe my testing environment:<br> - A VM CentOS 7 Core over VirtualBox 5.2, 1 NIC.<br> - My VM is attached to my domain W2012R2 (following this post<br> <a href="https://www.rootusers.com/how-to-join-centos-linux-to-an-active-directory-domain/)">https://www.rootusers.com/how-to-join-centos-linux-to-an-active-directory-domain/)</a><br> to achieve kerberos authentication transparent to the user. SElinux<br> disabled. Owner permissions to user squid in all folders/files involved.<br> - squid 3.5.20 installed and working great with kerberos, NTLM and basic<br> authentication. All authentication mechanisms tested and working great.<br> - SquidGuard: 1.4 Berkeley DB 5.3.21 installed and working great with<br> blacklists and acl default.<br> <br> My problem starts when I try to use source acl using ldapusersearch in<br> squidGuard... <br> <br> systemctl status squid:<br> (squid-1)[12627]: The redirector helpers are crashing too rapidly, need<br> help!<br> <br> *squidGuard.conf*<br> <br> dbhome /etc/squid/db<br> logdir /var/log/squidGuard<br> ldapbinddn<br> CN=ldap,OU=SERVICIOS,OU=SISTEMAS,OU=CANAL,OU=MYCOMPANY,DC=mydomain,DC=local<br> ldapbindpass myULTRAsecretPASS<br> ldapprotover 3<br> <br> <br> src WEB_BASIC {<br> ldapusersearch<br> ldap://dc-1.mydomain.local:3268/dc=mydomain,dc=local?sAMAccountName?sub?(&(sAMAccountName=%s)(memberOf=cn=WEB_BASIC%2cou=INTERNET%2cou=PERMISOS%2cou=MYCOMPANY%2cdc=mydomain%2cdc=local))<br> log block.log<br> }<br> <br></blockquote>...<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> <br> acl {<br> <br> WEB_BASIC{<br> pass whitelist !BL_porn !blacklist all<br> redirect<br> <a href="http://s-server1.mydomain.local/cgi-bin/squidGuard.cgi?clientaddr=%a">http://s-server1.mydomain.local/cgi-bin/squidGuard.cgi?clientaddr=%a</a>&clientname=%n&clientuser=%i&clientgroup=%s&targetgroup=%t&url=%u<br> log block.log<br> }<br> <br></blockquote>...<br><br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> *squid.conf*<br> <br> acl localnet src 10.10.8.0/22 # LAN net<br> acl dmz src 192.168.20.0/27 # DMZ net<br></blockquote><br>These ACLs are never used dues to what you are doing with the "auth" ACL.<br><br>...<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> <br> ### acl for proxy authentication (kerberos or ntlm) and ldap authorizations<br> acl auth proxy_auth REQUIRED<br> <br> # Define protocols used for redirects<br> acl HTTP proto HTTP<br> acl HTTPS proto HTTPS<br></blockquote><br>These have nothing to do with redirects and are never used.<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> <br> ### enforce authentication<br> http_access allow auth <br> http_access deny !auth<br> <br></blockquote><br>All possible traffic will match either "auth" or "!auth" above.<br><br>That means no http_access rules following this point do anything.<br><br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> ### standard access rules<br> http_access deny !Safe_ports <br> http_access deny CONNECT !SSL_ports <br> http_access allow localhost manager <br> http_access deny manager<br></blockquote><br>Your custom http_access rules (eg the auth checks) should be down here<br>so the basic security rules above have a chance to protect your proxy<br>again DoS, traffic smuggling attacks etc. before more complicated and<br>resource consuming things happen.<br><br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> http_access allow localnet<br> http_access allow dmz<br> http_access allow localhost <br> http_access deny all<br> <br></blockquote><br>...<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> visible_hostname eren <br></blockquote><br>The hostname needs to be a FQDN. It is delivered to clients in URLs<br>generated by Squid so they can fetch objects directly from the proxy.<br><br>FYI: Squid-3 should be able to automatically locate the hostname of the<br>machine it is running on. If that is not working then you need to fix<br>your machine, other software will be using the same mechanism and<br>likewise be encountering problems.<br><br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> httpd_suppress_version_string on <br> uri_whitespace strip<br> <br> <br> ## squidGuard ##<br> url_rewrite_program /usr/bin/squidGuard -c /etc/squid/squidGuard.conf<br> url_rewrite_children 10 startup=5 idle=1 concurrency=0<br> url_rewrite_bypass off<br> <br> <br></blockquote><br>Your traffic in your access.log is all CONNECT requests. Those messages<br>cannot be re-written by SquidGuard. So at the very least you require<br>this config line:<br><br> url_rewrite_access deny CONNECT<br><br><br>.. at this point you may notice your SG rules have no effect. This is<br>one of many reasons why you should do access control in the proxy<br>config, not externally in a complicated and slow helper.<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> <br> *messages*<br> <br> Sep 17 11:13:07 proxy kernel: squidGuard[12552]: segfault at<br> ffffffffd7706bb0 ip 00007fdbf2052e70 sp 00007fffd1b73c70 error 5 in<br> libldap-2.4.so.2.10.7[7fdbf2027000+52000]<br> Sep 17 11:13:07 proxy kernel: squidGuard[12553]: segfault at<br> ffffffffa3d27bb0 ip 00007fd79b787e70 sp 00007ffe47e9b880 error 5 in<br> libldap-2.4.so.2.10.7[7fd79b75c000+52000]<br></blockquote><br>...<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> <br> If I disable src and acl WEB_BASIC I have no problem. The default acl<br> does its thing without problems.<br> But when I enable src and acl WEB_BASIC squidGuard explodes and squid<br> restarts so I get to notice.<br> I see an error in a libldap library... Will it be a library error? Or am<br> I misconfiguring my squid ?<br> <br></blockquote><br>It is not a Squid error. It is something in SquidGuard and/or the library.<br><br>Amos<br><hr><br>squid-users mailing list<br>squid-users@lists.squid-cache.org<br><a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><br></pre></blockquote></div></body></html>