Nikolay Pavlov <[EMAIL PROTECTED]> wrote: > I am trying to implement reverse proxy using squid with mac_portacl, > but i have problem while binding squid to port 80. > Am i missed something? > > Here is my mac_portacl variables: > > # sysctl security.mac.portacl. > security.mac.portacl.enabled: 1 > security.mac.portacl.suser_exempt: 1 > security.mac.portacl.autoport_exempt: 1 > security.mac.portacl.port_high: 1023 > security.mac.portacl.rules: uid:100:tcp:80 > > And squid user info: > > # grep squid /etc/passwd > squid:*:100:100:squid caching-proxy pseudo > user:/usr/local/squid:/usr/sbin/nologin > > Also here is cache.log: > > 2006/10/20 09:55:59| Starting Squid Cache version 2.5.STABLE14 for > i386-portbld-freebsd6.1... > 2006/10/20 09:55:59| Process ID 6584 > 2006/10/20 09:55:59| With 11072 file descriptors available > 2006/10/20 09:55:59| DNS Socket created at 0.0.0.0, port 59879, FD 5 > 2006/10/20 09:55:59| Adding nameserver 206.53.60.10 from > /etc/resolv.conf > 2006/10/20 09:55:59| User-Agent logging is disabled. > 2006/10/20 09:55:59| Unlinkd pipe opened on FD 10 > 2006/10/20 09:55:59| Swap maxSize 102400000 KB, estimated 7876923 > objects > 2006/10/20 09:55:59| Target number of buckets: 393846 > 2006/10/20 09:55:59| Using 524288 Store buckets > 2006/10/20 09:55:59| Max Mem size: 1048576 KB > 2006/10/20 09:55:59| Max Swap size: 102400000 KB > 2006/10/20 09:55:59| Rebuilding storage in /cache (DIRTY) > 2006/10/20 09:55:59| Using Least Load store dir selection > 2006/10/20 09:55:59| Set Current Directory to /usr/local/squid/cache > 2006/10/20 09:55:59| Loaded Icons. > 2006/10/20 09:55:59| commBind: Cannot bind socket FD 12 to *:80: (13) > Permission denied > FATAL: Cannot open HTTP Port > Squid Cache (Version 2.5.STABLE14): Terminated abnormally. > CPU Usage: 0.035 seconds = 0.000 user + 0.035 sys > Maximum Resident Size: 9528 KB > Page faults with physical i/o: 0
I assume you aren't starting Squid with root privileges? If you aren't, you'll have to lower: net.inet.ip.portrange.reservedhigh if you want it to bind to port 80. I don't use mac_portacl, but from the name I assume security.mac.portacl.port_high does something similar. Port redirection with your packet filter of choice would be another option. Followup-To: [email protected] set. Fabian -- http://www.fabiankeil.de/
signature.asc
Description: PGP signature
