Squid - o que há de errado

[edisonjr]

O que há de errado com o meu squid.conf. O squid inicializa, o cache.log não registra nada de erro e o access.log não registra nada, tá vazio....

segue abaixo o meu squid.conf

http_port 3128
icp_port 3130
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
cache_mem 64 MB
memory_replacement_policy lru
cache_dir ufs /var/spool/squid 4000 24 256
cache_access_log /var/log/squid/access.log
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl rede src 192.168.0.0/255.255.255.0
acl adsl src 192.168.1.0/255.255.255.0
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
acl sites dstdomain "/etc/squid/sites.denied"
acl ban url_regex -i "/etc/squid/ban.lst"
acl noban url_regex -i "/etc/squid/noban.lst"
http_access deny sites
http_access deny ban !noban
http_access allow rede
http_access allow adsl
http_access allow localhost
http_access deny all
http_reply_access allow all
icp_access allow all
visible_hostname e3corr.e3corr.com.br
httpd_accel_port 80
httpd_accel_host virtual
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
error_directory /etc/squid/errors
coredump_dir /var/spool/squid

e este é o cache.log:

5/02/25 15:44:43| Squid Cache (Version 2.5.STABLE1): Exiting normally.
2005/02/25 15:44:45| Starting Squid Cache version 2.5.STABLE1 for i386-redhat-linux-gnu...
2005/02/25 15:44:45| Process ID 2520
2005/02/25 15:44:45| With 1024 file descriptors available
2005/02/25 15:44:45| DNS Socket created at 0.0.0.0, port 32790, FD 5
2005/02/25 15:44:45| Adding nameserver 192.168.0.1 from /etc/resolv.conf
2005/02/25 15:44:45| Adding nameserver 200.180.128.68 from /etc/resolv.conf
2005/02/25 15:44:45| Adding nameserver 200.199.241.17 from /etc/resolv.conf
2005/02/25 15:44:45| Unlinkd pipe opened on FD 10
2005/02/25 15:44:45| Swap maxSize 4096000 KB, estimated 315076 objects
2005/02/25 15:44:45| Target number of buckets: 15753
2005/02/25 15:44:45| Using 16384 Store buckets
2005/02/25 15:44:45| Max Mem size: 65536 KB
2005/02/25 15:44:45| Max Swap size: 4096000 KB
2005/02/25 15:44:45| Rebuilding storage in /var/spool/squid (CLEAN)
2005/02/25 15:44:45| Using Least Load store dir selection
2005/02/25 15:44:45| Set Current Directory to /var/spool/squid
2005/02/25 15:44:45| Loaded Icons.
2005/02/25 15:44:46| Accepting HTTP connections at 0.0.0.0, port 3128, FD 11.
2005/02/25 15:44:46| Accepting ICP messages at 0.0.0.0, port 3130, FD 12.
2005/02/25 15:44:46| WCCP Disabled.
2005/02/25 15:44:46| Ready to serve requests.
2005/02/25 15:45:09| Done scanning /var/spool/squid swaplog (0 entries)
2005/02/25 15:45:09| Finished rebuilding storage from disk.
2005/02/25 15:45:09| 0 Entries scanned
2005/02/25 15:45:09| 0 Invalid entries.
2005/02/25 15:45:09| 0 With invalid flags.
2005/02/25 15:45:09| 0 Objects loaded.
2005/02/25 15:45:09| 0 Objects expired.
2005/02/25 15:45:09| 0 Objects cancelled.
2005/02/25 15:45:09| 0 Duplicate URLs purged.
2005/02/25 15:45:09| 0 Swapfile clashes avoided.
2005/02/25 15:45:09| Took 23.4 seconds ( 0.0 objects/sec).
2005/02/25 15:45:09| Beginning Validation Procedure
2005/02/25 15:45:09| Completed Validation Procedure
2005/02/25 15:45:09| Validated 0 Entries
2005/02/25 15:45:09| store_swap_size = 0k
2005/02/25 15:45:10| storeLateRelease: released 0 objects

[spectrum]

Deixa teu conf assim:

hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
auth_param basic children 5
auth_param basic realm spectrum
auth_param basic credentialsttl 2 hours
refresh_pattern ^ftp:		1440	20%	10080
refresh_pattern ^gopher:	1440	0%	1440
refresh_pattern .		0	20%	4320
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 563
acl Safe_ports port 80
acl Safe_ports port 20
acl Safe_ports port 21
acl Safe_ports port 25
acl Safe_ports port 443 563
acl Safe_ports port 1025-65535
acl Safe_ports port 280
acl Safe_ports port 488
acl Safe_ports port 591
acl Safe_ports port 777
acl CONNECT method CONNECT
acl rede src 192.168.0.0/255.255.255.0 
acl adsl src 192.168.1.0/255.255.255.0 
acl sites dstdomain "/etc/squid/sites.denied" 
acl ban url_regex -i "/etc/squid/ban.lst" 
acl noban url_regex -i "/etc/squid/noban.lst" 
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access deny sites 
http_access deny ban !noban 
http_access allow rede 
http_access allow adsl 
http_access deny all
http_reply_access allow all
icp_access allow all
coredump_dir /var/spool/squid
visible_hostname e3corr.e3corr.com.br

apague o access.log cache.log e store.log restart o squid e teste
falows

[edisonjr]

fiz como tu disse, e continua a mesma coisa...

não entendo o pq...

[w00dy]

Só não entendí uma coisa.. pq vc diz que teu squid tá errado? não inicia?
qual as msgs de erro?

[buribai]

kra ,

vc criou os diretorios de cache ???

Pode ser isso ???

[edisonjr]

ele não barra os sites que deveria, pór isso eu digo que não funciona... não registra nada do access.log...

e criei o diretório de cache sim....

ah, mas ele nao dá uma mensagem de erro...

[buribai]

Então quer dizer que o pessoal está acessando a net atraves do proxy ???

Menos mal !!!!

Entaum, se ele tá funfando e não tá conseguindo gravar nos arquivos ...

Já verificou as permissões dos diretorios de cache ???

[xstefanox]

Se ele estiver iniciando corretamente, certifique-se que os seus clientes estão passando pelo proxy e não pela regra de IP Masquerade que você fez. Você configurou os clientes? Checou a ordem das suas ACL's e dos seus HTTP_ACCESS?

Se precisar de mais informações, consulte: http://squid.linuxit.com.br


Abraços!

[oyama]

Os seu clientes deve ta acessando direto sem o proxy. Vc tem duas opcoesque eu saiba)


1) redirecionar pelo iptables a porta 80 para a que o squid esta escutando
2) bloquear a porta 80(para os esperto nao fugir das regras que vc definir no squid) no server e definir em todas as estacoes o ip e porta em que seu squid esta rodando.


Espero ter ajudado.

[pilantrox]

pela conf do seu squid vc esta usando o proxy transparente ,,, vc redirecionou com o iptables o trafego da sua rede interna para o squid ???? se naum aparece nada no seu access.log eh pq o trafego naum tah passando
pelo squid. vc esta usando essas regras no seu firewall????
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A PREROUTING -i eth1 -p udp --dport 80 -j REDIRECT --to-port 3128

deduzindo que sua rede seja ,, eth1 rede interna e eth0 internet ,,, essas regras direcionam todo o trafego para a porta padrao do squid ,, como vc ativou o proxy transparente no squid.conf essas regras sao nescessárias........ falows