<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Hello James,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Here is to confirm that after applying this patch, rebuilding Squid 4.6 and deploying it into production of about 700 proxy connected clients using mostly Kerberos authentication followed by NTLM and Basic LDAP
the mentioned issue with negotiate wrapper went away. No more pop us from client browsers.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Best regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Rafael Akchurin<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Diladele B.V.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">--<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Need easy to manage DNS filter? See our new project at https://dnssafety.io/<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> squid-users [mailto:squid-users-bounces@lists.squid-cache.org]
<b>On Behalf Of </b>James Zuelow<br>
<b>Sent:</b> Monday, July 15, 2019 9:11 PM<br>
<b>To:</b> 'squid-users@lists.squid-cache.org'<br>
<b>Subject:</b> [squid-users] Debian Buster, Squid 4.6-1 amd64, "Too few negotiateauthenticator processes are running"<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We have a pair of Squid proxies, running as a failover pair with ucarp.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Both of these proxies are domain joined with Samba, and we’ve been using Kerberos authentication for several years.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">After Debian Buster was released, we upgraded the failover unit and did some basic testing. Everything seemed to go correctly. Unfortunately when we tested, we didn’t put the failover under a serious load – we merely made sure each component
was working the way we expected it to.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We waited a week, and then updated the primary.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">As soon as the primary was updated and assumed a real load, users started seeing proxy authentication prompts and the proxy started operating very slowly – to the point where sessions would time out. We quickly rolled to the failover,
but the problem remained.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Since this was a major version upgrade, everything on the server had changed so I had lots of places to look for errors. I did in fact find that my file descriptor settings in limits.conf had reverted back to the default of 1024, but even
after fixing this the proxy was slow.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I see in the logs many occurrences of “Too few negotiateauthenticator processes are running” – the negotiate authenticators look like they’re crashing every 15-45 seconds when the proxy is busy (between 80-100 requests per second at my
site).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Doing a quick Google, I found this: <a href="https://github.com/diladele/websafety-issues/issues/1141">
https://github.com/diladele/websafety-issues/issues/1141</a><o:p></o:p></p>
<p class="MsoNormal">Which refers to this: <a href="https://bugs.squid-cache.org/show_bug.cgi?id=4936">
https://bugs.squid-cache.org/show_bug.cgi?id=4936</a> <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The fix referred to in bug 4936 appears to be about a month old.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><a href="https://tracker.debian.org/pkg/squid">https://tracker.debian.org/pkg/squid</a> implies that the version of squid in Buster is older than that, last merged into testing (now stable) in February.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Before I file a Debian bug report, how could I go about confirming the presence of bug 4936 in the current Debian stable version of Squid? Are the dates good enough?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">James<o:p></o:p></p>
</div>
</body>
</html>