<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">We have a pair of Squid proxies, running as a failover pair with ucarp.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Both of these proxies are domain joined with Samba, and we’ve been using Kerberos authentication for several years.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">After Debian Buster was released, we upgraded the failover unit and did some basic testing. Everything seemed to go correctly. Unfortunately when we tested, we didn’t put the failover under a serious load – we merely made sure each component
was working the way we expected it to.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We waited a week, and then updated the primary.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">As soon as the primary was updated and assumed a real load, users started seeing proxy authentication prompts and the proxy started operating very slowly – to the point where sessions would time out. We quickly rolled to the failover,
but the problem remained.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Since this was a major version upgrade, everything on the server had changed so I had lots of places to look for errors. I did in fact find that my file descriptor settings in limits.conf had reverted back to the default of 1024, but even
after fixing this the proxy was slow.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I see in the logs many occurrences of “Too few negotiateauthenticator processes are running” – the negotiate authenticators look like they’re crashing every 15-45 seconds when the proxy is busy (between 80-100 requests per second at my
site).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Doing a quick Google, I found this: <a href="https://github.com/diladele/websafety-issues/issues/1141">
https://github.com/diladele/websafety-issues/issues/1141</a><o:p></o:p></p>
<p class="MsoNormal">Which refers to this: <a href="https://bugs.squid-cache.org/show_bug.cgi?id=4936">
https://bugs.squid-cache.org/show_bug.cgi?id=4936</a> <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The fix referred to in bug 4936 appears to be about a month old.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><a href="https://tracker.debian.org/pkg/squid">https://tracker.debian.org/pkg/squid</a> implies that the version of squid in Buster is older than that, last merged into testing (now stable) in February.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Before I file a Debian bug report, how could I go about confirming the presence of bug 4936 in the current Debian stable version of Squid? Are the dates good enough?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">James<o:p></o:p></p>
</div>
</body>
</html>