Re: [squid-users] persistent connection

2009-09-02 Thread Henrik Nordstrom
tis 2009-09-01 klockan 20:17 -0700 skrev xetorthio: Hi everyone! I ran today to a really strange behavior of squid. My application (A) opened by mistake a lot of persistent connection to another application (C) going through a squid (B) for caching purposes. When I saw the connections I

[squid-users] delay pools and ident users

2009-09-02 Thread Yuri Vorobyev
Hello. It is possible to limit bandwidth to users, based on ident acl's? I'm upgraded to version 3.0.18 and trying this: acl ident_aware_hosts src 10.10.10.10/255.255.255.255 ident_lookup_access allow ident_aware_hosts ident_lookup_access deny all ident_timeout 10 seconds acl vip src

Re: [squid-users] delay pools and ident users

2009-09-02 Thread Henrik Nordstrom
ons 2009-09-02 klockan 12:24 +0600 skrev Yuri Vorobyev: It is possible to limit bandwidth to users, based on ident acl's? I'm upgraded to version 3.0.18 and trying this: For this to work reliably you probably need to refer to an ident acl in http_access, making Squid wait a little for the

RE: [squid-users] delay pools and ident users

2009-09-02 Thread Yuri Vorobyev
Hello. It is possible to limit bandwidth to users, based on ident acl's? I'm upgraded to version 3.0.18 and trying this: For this to work reliably you probably need to refer to an ident acl in http_access, making Squid wait a little for the ident lookup to complete. Add the following

RE: [squid-users] delay pools and ident users

2009-09-02 Thread Henrik Nordstrom
ons 2009-09-02 klockan 14:38 +0600 skrev Yuri Vorobyev: acl ident ident REQUIRED http_access deny ident_aware_hosts ident !all Unfortunately it doesn't work. Which Squid version? Regards Henrik

RE: [squid-users] delay pools and ident users

2009-09-02 Thread Yuri Vorobyev
acl ident ident REQUIRED http_access deny ident_aware_hosts ident !all Unfortunately it doesn't work. Which Squid version? 3.0.18

[squid-users] DNS+squid

2009-09-02 Thread Hermidio A. Rodriguez Chavez
Hi all, i need to control the access to my proxy checking first if the computer has: 1- FQDN 2- IP-address(of course in my checklist file) 3- reverse PTR record. It's posible? Thanks in advance Hermidio

Re: [squid-users] DNS+squid

2009-09-02 Thread Amos Jeffries
Hermidio A. Rodriguez Chavez wrote: Hi all, i need to control the access to my proxy checking first if the computer has: 1- FQDN 2- IP-address(of course in my checklist file) 3- reverse PTR record. It's posible? Not without patching. Squid only does domain-IP (dst ACL) and IP-rDNS

[squid-users] low file descriptors suddenly

2009-09-02 Thread Luis Daniel Lucio Quiroz
Hi all, Is there any reason to know why squid suddenly reports 1024 file descriptors, if i restart it it goes normal to 64k descriptors. TIA LD

Re: [squid-users] low file descriptors suddenly

2009-09-02 Thread Henrik Nordstrom
ons 2009-09-02 klockan 09:27 -0500 skrev Luis Daniel Lucio Quiroz: Is there any reason to know why squid suddenly reports 1024 file descriptors, if i restart it it goes normal to 64k descriptors. Someone may have restarted it before with a low ulimit.. Regards Henrik

[squid-users] Squid 2.7: Request from LAN UNABLE to FORWARD or CONNECTION REFUSED or ACCESS DENIED

2009-09-02 Thread RicardoCh
When I try, from the internal LAN, to load any page of my website running on server (Debian Lenny iptables-apache2-Squid2.7-samba3, ALL ON SAME SERVER), the Squid launches some of this 3 pages error warn: 1) Unable to forward this request at this time 2) (111) Conection refused 3) Access denied

[squid-users] Squid and two Active Directory

2009-09-02 Thread SecureSoft - Daniel Merino
)      San Isidro. Lima27 - PERU (511) 994622555 (RPC) (511) 4402031 (TeleFax) + dmer...@securesoft.com.pe : http://www.securesoft.com.pe __ Information from ESET Smart Security, version of virus signature database 4389 (20090902) __ The message was checked by ESET Smart

Re: [squid-users] low file descriptors suddenly

2009-09-02 Thread Luis Daniel Lucio Quiroz
Le mercredi 2 septembre 2009 10:55:09, vous avez écrit : Usually happens when file descriptors been set in sysctl.conf where squid has been started before sysctl - Original Message From: Luis Daniel Lucio Quiroz luis.daniel.lu...@gmail.com To: squid-users@squid-cache.org Sent:

Re: [squid-users] Squid and two Active Directory

2009-09-02 Thread Henrik Nordstrom
ons 2009-09-02 klockan 12:21 -0500 skrev SecureSoft - Daniel Merino: I’m looking for instructions about how to authenticate my squid with two Active Directories. I could authenticate it with one AD with ntlm. Thanks for answering Set up a trust relation between the two. Regards Henrik

RE: [squid-users] Squid and two Active Directory

2009-09-02 Thread SecureSoft - Daniel Merino
__ Information from ESET Smart Security, version of virus signature database 4390 (20090902) __ The message was checked by ESET Smart Security. http://www.eset.com __ Information from ESET Smart Security, version of virus signature database 4390 (20090902

RE: [squid-users] Squid and two Active Directory

2009-09-02 Thread Henrik Nordstrom
ons 2009-09-02 klockan 12:52 -0500 skrev SecureSoft - Daniel Merino: How works this? Because when i configure the squid Server in the Kerberos and samba i set up a active directory config and I don’t know how to add another one. Trust relations is configured in the active directory servers.

[squid-users] R: [squid-users] Squid and two Active Directory

2009-09-02 Thread Guido Serassio
Hi, If the the two domains are placed in two different AD Forests, a forest trust is needed for Kerberos authentication. But the two AD forests must be at least Windows 2003 AD Forests running in forest and domain Windows 2003 native mode. Here you can find more details:

Re: [squid-users] DNS+squid

2009-09-02 Thread Chris Robertson
Amos Jeffries wrote: Hermidio A. Rodriguez Chavez wrote: Hi all, i need to control the access to my proxy checking first if the computer has: 1- FQDN 2- IP-address(of course in my checklist file) 3- reverse PTR record. It's posible? Not without patching. Squid only does domain-IP (dst ACL)

[squid-users] Re: If refresh_pattern only extends expiration, how to force time-to-live in Squid code?

2009-09-02 Thread Guy Bashkansky
(Resending, first time accidentally sent with HTML formatting, bounced) Now I see the Expires header having a value in the past, which may confuse clients and caches further down the chain. Scenario: origin returns max-age=900 (15 min) and refresh_pattern overrides expire to 24 hours, what do the

Re: [squid-users] Squid 2.7: Request from LAN UNABLE to FORWARD or CONNECTION REFUSED or ACCESS DENIED

2009-09-02 Thread Chris Robertson
RicardoCh wrote: When I try, from the internal LAN, to load any page of my website running on server (Debian Lenny iptables-apache2-Squid2.7-samba3, ALL ON SAME SERVER), the Squid launches some of this 3 pages error warn: 1) Unable to forward this request at this time 2) (111) Conection

[squid-users] Re: If refresh_pattern only extends expiration, how to force time-to-live in Squid code?

2009-09-02 Thread Henrik Nordstrom
ons 2009-09-02 klockan 12:42 -0700 skrev Guy Bashkansky: Now I see the Expires header having a value in the past, which may confuse clients and caches further down the chain. Scenario: origin returns max-age=900 (15 min) and refresh_pattern overrides expire to 24 hours, what do the headers to

[squid-users] Re: If refresh_pattern only extends expiration, how to force time-to-live in Squid code?

2009-09-02 Thread Guy Bashkansky
I'm using a customized version of Squid 2.4 STABLE6. But nothing seems to be customized in refresh.c, except for my own recent swap of age and expires checks (as recommended). Probably the expires header is added in some other place, it's just difficult to figure out exactly where in the code

Re: [squid-users] Squid and two Active Directory

2009-09-02 Thread Markus Moeller
squid_kerb_auth should be able to handel two AD Forests without trust. Use the -s GSS_C_NO_NAME and add keys from both ADs to the keytab. Regards Markus Guido Serassio guido.seras...@acmeconsulting.it wrote in message news:58fd293ce494af419a59ef7e597fa4e6393...@hermes.acmeconsulting.loc...

[squid-users] Re: squid_kerb_auth and Windows 2008

2009-09-02 Thread Markus Moeller
Markus Moeller hua...@moeller.plus.com wrote in message news:h7bduh$l5...@ger.gmane.org... I finally could look more into Windows 2008 and I found some unusal behaviour. Firstly you need hotfix 951191 and possibly [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kdc]

RE: [squid-users] sometimes the users can´t visit an y webpage

2009-09-02 Thread Jesus Angeles
Hi, thanks for your interest Well, today I had same problem, this is an extract to my cache.log. The problem happened about 15:30hrs, and the user reported me about 16:00 hrs, and I had to restart the squid service. Any Idea? What does it mean httpReadReply Excess data from...? 2009/09/02

[squid-users] Re: If refresh_pattern only extends expiration, how to force time-to-live in Squid code?

2009-09-02 Thread Henrik Nordstrom
ons 2009-09-02 klockan 13:42 -0700 skrev Guy Bashkansky: I'm using a customized version of Squid 2.4 STABLE6. But nothing seems to be customized in refresh.c, except for my own recent swap of age and expires checks (as recommended). Ouch.. that's a very very old relese. Upgrading highly

Re: [squid-users] low file descriptors suddenly

2009-09-02 Thread Henrik Nordstrom
ons 2009-09-02 klockan 12:31 -0500 skrev Luis Daniel Lucio Quiroz: MMM the fact is that i set my filedescriptos in /etc/security/limits.conf look: * - nofile 131072 This is only used by interactive logins (PAM), not during the system startup. Regards Henrik

RE: [squid-users] sometimes the users can´t visit any webpage

2009-09-02 Thread Amos Jeffries
On Wed, 2 Sep 2009 16:33:49 -0500, Jesus Angeles jange...@confidesolutions.com.pe wrote: Hi, thanks for your interest Well, today I had same problem, this is an extract to my cache.log. The problem happened about 15:30hrs, and the user reported me about 16:00 hrs, and I had to restart the

RE: [squid-users] Squid 2.7: Request from LAN UNABLE to FORWARD or CONNECTION REFUSED or ACCESS DENIED

2009-09-02 Thread RicardoCh
Hi Chris, thanks for your support... I did everything you recommended, but when I make a request to the website (running on the same server), this error now in browser: •Unable to forward this request at this time. This request could not be forwarded to the origin server or to any parent caches.

RE: [squid-users] Squid 2.7: Request from LAN UNABLE to FORWARD or CONNECTION REFUSED or ACCESS DENIED

2009-09-02 Thread Henrik Nordstrom
tor 2009-09-03 klockan 00:32 -0300 skrev RicardoCh: Starting web server: apache2(98)Address already in use: make_sock: could not bind to address [::]:80 (98)Address already in use: make_sock: could not bind to address 0.0.0.0:80 no listening sockets available, shutting down Unable to open

RE: [squid-users] Squid 2.7: Request from LAN UNABLE to FORWARD or CONNECTION REFUSED or ACCESS DENIED

2009-09-02 Thread RicardoCh
Bingo!!! Thanks Henrik and Chris... -Mensaje original- De: Henrik Nordstrom [mailto:hen...@henriknordstrom.net] Enviado el: jueves, 03 de septiembre de 2009 12:50 a.m. Para: RicardoCh CC: 'Chris Robertson'; squid-users@squid-cache.org Asunto: RE: [squid-users] Squid 2.7: Request from