<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>Hello all,</div>
<div> </div>
<div>I finaly got a squid proxy with kerberos authentification and LDAP group check to work! With a small amount of clients(1-10) everything works as it should and the squid is fast(no noticeable waiting time for websites to open). Users get authenticated, different AD groups can access the internet with blacklists/whitelists/full access and so on..</div>
<div> </div>
<div>But as soon as I make the whole company(round about 80 clients) use the new proxy, it begins to be very slow. And by very slow I mean like 1-2 minutes waiting time(response time in access.log is like 60000-270000 milliseconds for TCP_TUNNEL) until a website is fully loaded. We got a old squid proxy too, but without any authentication (just some dstdomain in general) and it's working great. But the new one is very slow..</div>
<div> </div>
<div>Btw. some of our clients have ipv6, others ipv4(~90%)..There were no errors in cache.log(activated it for some minutes with debug ALL for error checking).</div>
<div> </div>
<div> </div>
<div>Can anyone help?</div>
<div> </div>
<div> </div>
<div>What I tried so far:</div>
<div>dns_v4_first on at the very end/very beginning from squid.conf</div>
<div>enable/disable (memory) caching</div>
<div>use Google DNS instead of our own</div>
<div>connect_timeout 3 seconds</div>
<div> </div>
<div>Nothing realy helped..</div>
<div> </div>
<div>Here is my squid.conf:</div>
<div> </div>
<div>
<div>######### allowed port part ########################<br/>
acl Allowed_port port 80 # http<br/>
acl Allowed_port port 21 # ftp<br/>
acl Allowed_port port 443 # https<br/>
acl Allowed_port port 70 # gopher<br/>
acl Allowed_port port 210 # wais<br/>
acl Allowed_port port 1025-65535 # unregistered ports<br/>
acl Allowed_port port 280 # http-mgmt<br/>
acl Allowed_port port 488 # gss-http<br/>
acl Allowed_port port 591 # filemaker<br/>
acl Allowed_port port 777 # multiling http<br/>
acl Allowed_port port 10000 # Proofpoint<br/>
acl CONNECT method CONNECT<br/>
http_access deny CONNECT !Allowed_port</div>
<div> </div>
<div>##################### cache/logs ########################<br/>
cache_log /dev/null<br/>
#logfile_rotate 0<br/>
logformat myformat %{%d.%m %H:%M:%S}tl %>a %Ss %ru %tr<br/>
access_log /var/log/squid/access.log myformat<br/>
#cache_dir aufs /var/spool/squid 16384 32 512<br/>
#cache_mem 8 MB<br/>
#maximum_object_size_in_memory 64 KB<br/>
#maximum_object_size 4 MB<br/>
#coredump_dir /var/spool/squid</div>
<div>cache deny all<br/>
coredump_dir /dev/null<br/>
cache_dir null /dev/null<br/>
cache_store_log none</div>
<div> </div>
<div>########## Debug ########################<br/>
#debug_options ALL,1 33,2 28,9</div>
<div> </div>
<div>######################### squid-port #######<br/>
http_port 3128 #proxy port</div>
<div>authenticate_ttl 2 hours #auth timeout squid->passwd_server</div>
<div>#acl localhost src 192.168.2.2 #proxy IP<br/>
#follow_x_forwarded_for allow localhost #trust localhost</div>
<div>#general allow everything<br/>
#acl whole_company src 192.0.0.0-192.255.255.254<br/>
#http_access allow whole_company</div>
<div> </div>
<div>############### url_regex ####<br/>
acl black_regex url_regex "/etc/squid/regex_black.acl"<br/>
#http_access allow white_regexp<br/>
acl white_regex url_regex "/etc/squid/regex_white.acl"<br/>
acl license_regex url_regex "/etc/squid/regex_license_servers_no_auth.acl"</div>
<div> </div>
<div>############################# allow License Managers ##########<br/>
http_access allow license_regex all</div>
<div> </div>
<div>################### Kerberos ##################################<br/>
auth_param negotiate program /lib/squid/negotiate_wrapper_auth -d --ntlm /bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp --domain=DOMAIN.TLD --kerberos /lib/squid/negotiate_kerberos_auth -d -s HTTP/proxy.domain.tld@DOMAIN.TLD<br/>
auth_param negotiate children 200<br/>
auth_param negotiate keep_alive on</div>
<div> </div>
<div>########################## Allow based on group membership ######<br/>
# Authentication required, otherwise Pop-Up<br/>
acl Authenticated_Users proxy_auth REQUIRED<br/>
http_access deny !Authenticated_Users all</div>
<div> </div>
<div># Define external acl for group check<br/>
external_acl_type ldap_group ipv4 ttl=300 negative_ttl=120 children-max=200 %LOGIN /lib/squid/ext_ldap_group_acl -K -S -R \<br/>
-b "ou=Users,DC=domain,DC=tld" \<br/>
-D "ProxyUser@DOMAIN.TLD" \<br/>
-W /etc/squid/authfile \<br/>
-f "(&(objectclass=person)(sAMAccountName=%v)(memberof=CN=%a,OU=Groups,DC=domain,DC=tl))" \<br/>
-h 192.0.1.1</div>
<div> </div>
<div>## check whitelist group<br/>
#acl whitelist_Internet_Users external ldap_group whitelist<br/>
#http_access allow whitelist_Internet_Users white_regex</div>
<div> </div>
<div>## check blacklist group<br/>
#acl blacklist_Internet_Users external ldap_group blacklist<br/>
#http_access allow blacklist_Internet_Users !black_regex</div>
<div> </div>
<div>## check full_access group<br/>
#acl full_access_Internet_Users external ldap_group full_access<br/>
#http_access allow full_access_Internet_Users all</div>
<div> </div>
<div>## check Users group<br/>
acl Users_Internet_Users external ldap_group Users<br/>
http_access allow Users_Internet_Users !black_regex</div>
<div> </div>
<div>http_access deny all</div>
<div>dns_v4_first on<br/>
connect_timeout 3 seconds</div>
<div> </div>
<div> </div>
<div>Regards!</div>
</div></div></body></html>