[squid-users] Squid_ldap_kerb make

2010-03-02 Thread Nick Cairncross
Hi All, I'm now looking at squid_ldap_kerb for my group lookups but I'm receiving the following error during 'make': make  all-recursive make[1]: Entering directory `/root/Desktop/squid_kerb_ldap-1.2.1' make[2]: Entering directory `/root/Desktop/squid_kerb_ldap-1.2.1' gcc -DHAVE_CONFIG_H -I.   

Re: [squid-users] Squid_ldap_kerb make

2010-03-03 Thread Nick Cairncross
configure: updating config.h On 02/03/2010 19:07, Henrik Nordstrom hen...@henriknordstrom.net wrote: tis 2010-03-02 klockan 17:34 + skrev Nick Cairncross: It seems to be complaining about krb5.h.. it doesn't appear on my server though I am successfully using Kerberos (configured using Samba

Re: [squid-users] Re: Squid_ldap_kerb make

2010-03-04 Thread Nick Cairncross
...@moeller.plus.com wrote in message news:hmmmuv$ie...@dough.gmane.org... You need the ldap and sasl development packages. Markus Nick Cairncross nick.cairncr...@condenast.co.uk wrote in message news:c7b3f825.1bb93%nick.cairncr...@condenast.co.uk... Henrik, Thanks for the pointers - I have added

Re: [squid-users] Re: Re: Squid_ldap_kerb make

2010-03-05 Thread Nick Cairncross
. use ktutil (from MIT Kerberos) like ktutil ktutil: addent -password -p u...@domain -k 1 -e rc4-hmac Password for u...@domain ktutil: wkt user.keytab ktutil: exit Markus Nick Cairncross nick.cairncr...@condenast.co.uk wrote in message news:c7b57c01.1bd68%nick.cairncr...@condenast.co.uk... Markus

[squid-users] TCP_DENIED/407 CONNECT www,evernote.com:443

2010-03-10 Thread Nick Cairncross
Hi All, I have some Mac clients/services that require internet via my Squid. Two such programs are Evernote and VMWare. Both are requesting access and both are being denied. The errors I see in the access.log are as follows and nothing else: 268234226.935 0 172.16.0.38 TCP_DENIED/407 2117

[squid-users] ACL wildcard?

2010-03-11 Thread Nick Cairncross
Hi all, Just a quick question today..: In a bid to keep to some standards my ACLs all follow similar naming conventions : FILETYPE_EXE_[object] - e.g. FILE_TYPE_EXE_Users, FILE_TYPE_EXE_Hosts, FILE_TYPE_EXE_IPAddresses FILETYPE_MP3_[object] - e.g. FILE_TYPE_MP3_Users, FILE_TYPE_MP3_Hosts,

Re: [squid-users] Blocking Instant Messaging

2010-03-22 Thread Nick Cairncross
Hi abv, You can block on user agent for some IM clients such as MSN. Ensure you have User Agent logging turned on and an entry in your conf file. I found this useful for finding out the agent that some IM clients use. For testing I use a file containing the agent but the result is the same..:

[squid-users] Sending on Group names after Kerb LDAP look-up

2010-03-22 Thread Nick Cairncross
Hi All, Things seem to be going well with my Squid project so far; a combined Mac/Windows AD environment using Kerberos authentication with fall back of NTLM. I (hopefully) seem to be getting the hang of it! I've been trying out the Kerberos LDAP look up tool and have a couple of questions (I

[squid-users] Squid Kerb Auth Issue

2010-03-23 Thread Nick Cairncross
Hi, I'm concerned by a problem with my HTTP.keytab 'expiring'. My test base have reported a problem to me that they are prompted repeatedly for an unsatisfiable username and password. When I checked cache.log I noticed that there was a KVNO mismatch being reported. I regenerated my keytab and

Re: [squid-users] Re: Squid Kerb Auth Issue

2010-03-25 Thread Nick Cairncross
way to do this (or have I done it wrong) Nick On 24/03/2010 23:45, Markus Moeller hua...@moeller.plus.com wrote: How did you create the keytab ? Markus Nick Cairncross nick.cairncr...@condenast.co.uk wrote in message news:c7ce8144.1d5e1%nick.cairncr...@condenast.co.uk... Hi, I'm

Re: [squid-users] Sending on Group names after Kerb LDAP look-up

2010-03-25 Thread Nick Cairncross
) Is this achievable with Squid? This could be the final piece in my puzzle... Thanks, Nick On 24/03/2010 05:58, Amos Jeffries squ...@treenet.co.nz wrote: Nick Cairncross wrote: Hi All, Things seem to be going well with my Squid project so far; a combined Mac/Windows AD environment using Kerberos

Re: AW: [squid-users] SquidCompilationproblem -squid_ldap_auth.c:123:18: error: lber.h: No such file or directory

2010-03-26 Thread Nick Cairncross
If you're on the RHN then yum is the easiest. If not: Keyutils_libs-devel Libselinux-devel Libsepol-devel E2fsprogs-devel Krb5-devel Cyrus-sasl-gssapi Cyrus-sasl-devel Openldap-devel Might be a few more. On 26/03/2010 14:42, Zeller, Jan jan.zel...@id.unibe.ch wrote: Hi, you need something

Re: [squid-users] Sending on Group names after Kerb LDAP look-up

2010-03-29 Thread Nick Cairncross
on icap_client_username_header X-Authenticated-User Access log shows my jsm...@myaddomain and I would LOVE to be able to just have the first part in ICAP X-Authenticated-User. Thanks again, Nick On 25/03/2010 16:18, Nick Cairncross nick.cairncr...@condenast.co.uk wrote: Amos, Thanks for your help - you are right

Re: [squid-users] Re: Sending on Group names after Kerb LDAP look-up

2010-03-30 Thread Nick Cairncross
option -- r Did I misunderstand? I'm using Squid 3.0 stable 20 - I'm not sure what version the squid_kerb_auth that comes with it is. Thanks, Nick On 29/03/2010 22:16, Markus Moeller hua...@moeller.plus.com wrote: Did you try -r with squid_kerb_auth ? Markus Nick Cairncross nick.cairncr

Re: [squid-users] Re: Re: SSO with Active Directory-Squid Clients

2010-04-08 Thread Nick Cairncross
Bilal, I'm working on much the same thing, with added Apple Mac just to complicate things. My aim is to create an SSO environment for all my Windows, OSX and nix machines. I want to use Kerberos as my primary authentication as IE7 and FF onwards are moving that way..but for my situation some

Re: [squid-users] Re: Re: Re: Re: SSO with Active Directory-Squid Clients

2010-04-09 Thread Nick Cairncross
-HTTP to be independent of samba which usually uses . Regards Markus Nick Cairncross wrote in message news:c7e35da9.1eb06%nick.cairncr...@condenast.co.uk... Bilal, I'm working on much the same thing, with added Apple Mac just to complicate things. My aim is to create an SSO environment

Re: [squid-users] Re: Re: Re: SSO with Active Directory-Squid Clients

2010-04-09 Thread Nick Cairncross
) it will update regularly the AD entry and key for the host/fqdn principal which is the same as for HTTP/fqdn. I usually use msktutil and create a second AD entry called short-hostname-HTTP to be independent of samba which usually uses short-hostname. Regards Markus Nick Cairncross nick.cairncr

Re: [squid-users] Re: Re: Re: SSO with Active Directory-Squid Clients

2010-04-09 Thread Nick Cairncross
Markus, I've had a go with mskstutil and it appeared to work partially once - the comptuer account was created and the spn/upn were set, but no Keytab was generated.. I then tried again having deleted the squid-http computer account but receive the following errors - see below, at the end.

[squid-users] Squid HTTP Keytab SPN question

2010-04-14 Thread Nick Cairncross
Hi, I'd like confirmation of something is possible, but first best to detail what I want: I want to use a separate computer account to authenticate my users against. I know that this requires an HTTP.keytab and computer in AD with SPN. I would like to use MKTSUTIL for this. If my proxy server

Re: [squid-users] Re: Re: Creating a kerberos Service Principal.

2010-04-15 Thread Nick Cairncross
Bilal, I think we're doing a similar thing here! See my post earlier about SPN. I think you need to be using the fqdn of the machine in the HTTP/ spn upn and not just the domain. Also check your DNS and host local host entries. E.g.: msktutil -c -b CN=COMPUTERS -s HTTP/squid1.[mydomain] -k

Re: [squid-users] Squid HTTP Keytab SPN question

2010-04-16 Thread Nick Cairncross
(Netbios name = AUTH1), then do net ads join and then net ads keytab add http. This will cause net to create a keytab with the correct keys and the correct KVNO. Regards, Khaled 2010/4/15 Nick Cairncross nick.cairncr...@condenast.co.uk: Hi Khaled, The reason is that I am also running Samba, which

Re: [squid-users] SPN case sensitivity culprit for Negotiate/Kerberos Failures +msktutil

2010-04-21 Thread Nick Cairncross
Hi Bilal, Good to hear you've pin-pointed the problem. I'm not one hundred percent sure on all the answers to your questions, but I'll throw in my 10 cents.. It's all a learning curve! I've just created a new computer account using msktuil and I specified the SPN as HTTP/FuNnYName.{domain}.

[squid-users] Primary, Secondary, Tertiary Squid proxies

2010-04-21 Thread Nick Cairncross
Hi, I would like to configure my proxies to route via different boxes if the primary upstream is unavailable. I have three Squid boxes all at different sites . All three have the entry: cache_peer upstream.isp.com parent 8080 0 no-query default All three are the same, utilising

Re: [squid-users] Squid Quicktime RTPS 401 unauthorized error

2010-04-22 Thread Nick Cairncross
In times gone buy I created an acl for the quicktime browser and disabled authentication for the quicktime user-agent as it would completely break on my macs. N On 22/04/2010 16:02, Johnson, S sjohn...@edina.k12.mn.us wrote: When I try to access a quicktime video through my squid proxy I

Re: [squid-users] Squid Quicktime RTPS 401 unauthorized error

2010-04-22 Thread Nick Cairncross
create an ACL for a browser service. Do you by chance have an example I could reference? (sorry about the dup message; forgot to hit reply all...) -Original Message- From: Nick Cairncross [mailto:nick.cairncr...@condenast.co.uk] Sent: Thursday, April 22, 2010 10:10 AM To: Johnson, S

[squid-users] Squid Conf - Checking

2010-04-27 Thread Nick Cairncross
Hi, I wondered whether I could have an eyeball on my squid.conf. It's very basic regarding access rules as there is a proxy filter further up chain - also I'm not caching. The main purpose is to ensure that where not explicitly allowed via ACL all traffic passes through the squid proxy and

RE: [squid-users] make squid-3.1.1

2010-04-29 Thread Nick Cairncross
Dependencies perhaps - krb5, cyrus-sasl, gss etc? -Original Message- From: lieven [mailto:lie...@ba.be] Sent: 28 April 2010 17:47 To: squid-users@squid-cache.org Subject: [squid-users] make squid-3.1.1 Dear list and people therein, I'm currently trying to compile (make) the squid 3.1.1

[squid-users] TCP_MISS/000 0 POST

2010-05-06 Thread Nick Cairncross
Hi, I have a TCP_MISS 000 error being reported for users in the 172.16.0.0 subnet attempting to upload files to a particular internet site. I understand that 000 indicates that the request has been aborted before it could complete? The exact error is: TCP_MISS/000 0 POST http://[domain

Re: [squid-users] Re: squid_ldap_auth

2010-05-07 Thread Nick Cairncross
What about kerberos auth and use the the squid_kerb_ldap lookup? cheers On 07/05/2010 13:45, burbankmarc djo...@mapcommunications.com wrote: So I guess the only way to get it to work like NTLM is to use NTLM? Well, I'm not sure what we're going to do when we can't use it any longer, but

Re: [squid-users] TCP_MISS/000 0 POST

2010-05-10 Thread Nick Cairncross
Hi all, Having investigated this further, the issue is caused when I use the ICAP plugin referenced in my squid.conf. If I remove the lines then I am able to POST the file. Any suggestions? Thanks On 06/05/2010 17:35, Nick Cairncross nick.cairncr...@condenast.co.uk wrote: Hi, I have

[squid-users] ICAP breaking upload.youtube.com

2010-05-18 Thread Nick Cairncross
Hi all, I've noticed that a few users have reported problems when uploading files to certain sites. For example upload.youtube.com. When a video is selected for upload the upload progress moves along to completion but it never succeeds, eventually timing out. Tracing the client in access.log I

Re: [squid-users] Re: Advices for a squid cluster with kerberos auth

2010-05-21 Thread Nick Cairncross
Just to add: Thanks for this. I've successfully got RR working with Kerberos as you said. It's something I've been interested in as well. My test setup is: SQUID1.domain.com 10.0.0.1 SQUID2.domain.com 10.0.0.2 RR DNS record SQUIDS.domain.com for each SQUIDx IP Computer account in

RE: [squid-users] Squid NTML and auth problems with POST

2010-06-15 Thread Nick Cairncross
Just to check, Amos: Squid 3 and above has client_persistent_connections and server_persistent_connections 'on' by default i.e. not required in the conf file unless setting to 'off'... Correct? -Original Message- From: Amos Jeffries [mailto:squ...@treenet.co.nz] Sent: 15 June 2010

[squid-users] Active/Backup Squid cluster

2010-06-21 Thread Nick Cairncross
Hi All, I'm just looking into clustering Squid and wanted to see what experiences people have had. Currently we have two non-Squid proxies on two different sites. Each has a virtual IP (the VIP network is extended over the two sites) and a physical IP (though different VLANs) Site A: VIP

Re: [squid-users] Active/Backup Squid cluster

2010-06-21 Thread Nick Cairncross
Henrik, See answers: Why two VIP and how do clients select which VIP they should connect to? DHCP scopes for each VLAN are configured with the options for the auto-discovery proxy (i.e. 172.16.10.7). They are using NTLM at the moment so hostname is not a problem. Moving to Kerberos though

RE: [squid-users] Squid-Cache-Error with NTLM: got NTLMSSP command 3, expected 1

2010-06-25 Thread Nick Cairncross
I am happily using Kerberos authentication for my AD domain users. In fact the driving force was less prompts for my Mac users - Safari and some other browsers don't support Kerberos, so I also have a fallback for NTLM auth, but they are much happier using Kerberos (in firefox) and I don't take

Re: [squid-users] msktutil: Error: ldap_set_option (option=) failed (Can't contact LDAP server)

2010-06-28 Thread Nick Cairncross
Missing ldap libraries maybe? On 28/06/2010 12:32, Tom Tux tomtu...@gmail.com wrote: Hi I'm trying to generate a computer-account with msktutil: I got the following error: ... ... - ldap_connect: Connecting to LDAP server: dc1.domain.com try_tls=YES SASL/GSSAPI authentication started SASL

[squid-users] Authenticate domain user

2010-06-30 Thread Nick Cairncross
Hi All, I use Kerberos authentication for my domain computers and users. All works well except for the following scenario: If a non-domain PC (i.e. workgroup) is pointed to squid (fqdn) I receive an unsatisfiable login prompt for my squid proxy. After three attempts with domain\username and

Re: [squid-users] auth issue with chrome

2010-07-03 Thread Nick Cairncross
Benedikt, NTLM should be working for Chrome. What does cache.log say. You could also try to use Kerberos for your Firefox clients and then NTLM for Chrome. Placing the helpers in that order (Kerberos first, then NTLM) would allow you to use both -that's what I use. Then you could bin

[squid-users] Kerberos: HTTP/host and not HTTP/host.fqdn@FQDN

2010-07-16 Thread Nick Cairncross
Hi list, I think I have a problem with one of my SPNs/keytab - wondered if someone could confirm this: 3 x squid boxes on different sites, squid1, squid2 and squid3 are their hostnames. I have one AD account with the SPNs of all on it. Using fqdn for the proxy address to 2 of them results in

Re: [squid-users] Re: Kerberos: HTTP/host and not HTTP/host.fqdn@FQDN

2010-07-19 Thread Nick Cairncross
extraction changes usually the AD entry and therefore the key for your 2nd/3rd squid server. I suggest to create three separate AD entries and remove any SPN for HTTP/short-hostname. Regards Markus Nick Cairncross nick.cairncr...@condenast.co.uk wrote in message news:c8665961.b8ac%nick.cairncr

[squid-users] Real-time images

2010-07-28 Thread Nick Cairncross
Hi All, This is just a curiosity (whilst I have some time on my hands) and not something I want to put into a live environment. I once stumbled across a site which offered a program/plug-in to scan the access.log file and watch for .jpg .gif etc images. These image links were then pulled from

Re: [squid-users] Real-time images

2010-07-29 Thread Nick Cairncross
And that is why I love the Squid community: 10/10 Thanks v much - will have a play with it. N On 28/07/2010 16:40, John Doe jd...@yahoo.com wrote: The information contained in this e-mail is of a confidential nature and is intended only for the addressee. If you are not the

Re: [squid-users] Exchange Server 2007 + Outlook 2007 + Squid Proxy

2010-08-13 Thread Nick Cairncross
By-pass proxy for local/exchange URL/host, no? Easiest if you use a pac file also and specify the local addresses/subnets i.e send direct and don't touch the proxy Nick On 13/08/2010 14:49, Kale D. Michels kmich...@hri-dho.com wrote: I have my proxy server set to be used by the majority of

Re: [squid-users] Exchange Server 2007 + Outlook 2007 + Squid Proxy

2010-08-13 Thread Nick Cairncross
. As for the prompting for external HTML that sounds like a browser/auth issue. I don't see that for my ie users. Macs however are a different matter... Nick On 13 Aug 2010, at 16:55, Jason Staudenmayer jas...@adventureaquarium.com wrote: -Original Message- From: Nick Cairncross [mailto:nick.cairncr

Re: [squid-users] NTLM not working for squid in windows server

2010-08-25 Thread Nick Cairncross
I have a related question: I have a Kerberos helper followed by an NTLM helper in my squid setup. I haven't yet figured out a way to deal with non-domain computers. Users are prompted for the login, which they can't ever satisfy. However if they enter their credentials once (e.g. domain\username

Re: [squid-users] TCP_DENIED/407 with JAVA-Applets

2010-08-26 Thread Nick Cairncross
Tom, What does useragent.log say when you use FF? Nick On 26/08/2010 09:27, Tom Tux tomtu...@gmail.com wrote: Hi I recognised, that for some Java-Applets (http://java.sun.com/applets/jdk/1.4/demo/applets/BarChart/example1.html) I got TCP_DENIED/407-errors in the access.log. Depending on the

Re: [squid-users] TCP_DENIED/407 with SSL-Sites, but the site is accessible...

2010-08-28 Thread Nick Cairncross
Tom, Just to say what I think (since you have almost the same setup as me I think): you will always get that 407 at the moment. Squid requires an authenticated user before allowing the page but you can't authenticate every method (at least that is what I have found) in my setup. Regardless

Re: [squid-users] TCP_DENIED/407 with SSL-Sites, but the site is accessible...

2010-08-31 Thread Nick Cairncross
, Tom 2010/8/28 Nick Cairncross nick.cairncr...@condenast.co.uk: Tom, Just to say what I think (since you have almost the same setup as me I think): you will always get that 407 at the moment. Squid requires an authenticated user before allowing the page but you can't authenticate every method

Re: [squid-users] Kerberos / SASL for squid_ldap_group

2010-08-31 Thread Nick Cairncross
On Mon, 30 Aug 2010 16:32:51 +0200, Maxim Burgerhout ma...@wzzrd.com wrote: Of course I just bumped into that little gem *after* I sent the previous message to this list... It has the downside of not being included in, or supported by downstream distro's though. The major upside of having

[squid-users] Tweaking squid_kerb_auth

2010-09-16 Thread Nick Cairncross
Hi, Running Kerberos auth ok for a while now and I wanted to look at possibilities of tweaking/optimising it. Current helper conf: auth_param negotiate program /usr/lib/squid/squid_kerb_auth -r -i -s GSS_C_NO_NAME auth_param negotiate children 10 auth_param negotiate keep_alive on 400 or so

Re: [squid-users] Strange performance effects on squid during off peak hours

2010-09-16 Thread Nick Cairncross
I'm with Leigh - bodiless humans. Scares the shit out of me. On 15/09/2010 14:41, Amos Jeffries squ...@treenet.co.nz wrote: On 16/09/10 01:01, Martin Sperl wrote: Hi everyone, we are seeing a strange response-time effect over 24 hours when delivering content via Squid+icap service

Re: [squid-users] Re: Tweaking squid_kerb_auth

2010-09-27 Thread Nick Cairncross
Hi Nick, The only tweaking which might be required is for MIT based libraries on a high load system to disable the replay cache by setting KRB5RCACHETYPE=none export KRB5RCACHETYPE Markus Nick Cairncross nick.cairncr...@condenast.co.uk wrote in message news:c8b7b33a.f61b%nick.cairncr

RE: [squid-users] Re: Re: Tweaking squid_kerb_auth

2010-09-28 Thread Nick Cairncross
___ From: Markus Moeller [hua...@moeller.plus.com] Sent: 27 September 2010 20:41 To: squid-users@squid-cache.org Subject: [squid-users] Re: Re: Tweaking squid_kerb_auth Nick Cairncross nick.cairncr...@condenast.co.uk wrote in message news:c8c638c1.11799

[squid-users] FATAL: Too many queued negotiateauthenticator requests

2010-09-28 Thread Nick Cairncross
Hi, I've *just* started to see the following error on my squid box and I need some assistance! It primarily serves Kerberos users and NTLM secondary: about 70/30. This comes after I've directed a new batch of users to use squid. == 2010/09/28 14:53:34| storeDirWriteCleanLogs: Starting...

Re: [squid-users] Quick question: AuthNTLMUserRequest::authenticate: need to ask helper

2010-10-01 Thread Nick Cairncross
'today there were 60 unique IPs' that used the proxy.. Or is that more a job for Calamaris or other reporter..? Nick Squid3.20STABLE, RHEL5.3x86 On 01/10/2010 13:10, Amos Jeffries squ...@treenet.co.nz wrote: On 01/10/10 23:46, Nick Cairncross wrote: Is the cache.log entry AuthNTLMUserRequest

Re: [squid-users] got NTLMSSP command 3, expected 1

2010-10-04 Thread Nick Cairncross
On 04/10/2010 07:48, guest01 gues...@gmail.com wrote: got NTLMSSP command 3, expected 1 As you say isn't that because a Kerberos client is trying to send auth and thus not capable of NTLM? Can you track it down to the requesting machine(s) and client? It's like my Mac Safaris can only use NTLM

Re: [squid-users] got NTLMSSP command 3, expected 1

2010-10-04 Thread Nick Cairncross
On Mon, Oct 4, 2010 at 9:44 AM, Nick Cairncross nick.cairncr...@condenast.co.uk wrote: On 04/10/2010 07:48, guest01 gues...@gmail.com wrote: got NTLMSSP command 3, expected 1 As you say isn't that because a Kerberos client is trying to send auth and thus not capable of NTLM? Can you track

[squid-users] reverse proxy

2010-10-04 Thread Nick Cairncross
Hi list, A few idle moments on my hands I wanted to investigate getting a Squid box working behind my ADSL router. Squid would be listening on, say, 80 to incoming requests. ADSL router would be port forwarding 80 to it. I have a machine which runs a lot of web browseable add-ons all listening

[squid-users] Squid 3 STABLE 20 max_challenge_

2010-10-05 Thread Nick Cairncross
Hi list, Just checking, but the parameters: 'max_challenge_reuses' and 'max_challenge_lifetime' can't be used in 3 Stable 20 and there is no equivalent/new directive? I wanted to allow my authenticated users' sessions to be re-used for a certain length of time and amount to trim down on

Re: [squid-users] reverse proxy

2010-10-07 Thread Nick Cairncross
On 04/10/2010 10:51, Amos Jeffries squ...@treenet.co.nz wrote: On 04/10/10 22:38, Nick Cairncross wrote: Hi list, A few idle moments on my hands I wanted to investigate getting a Squid box working behind my ADSL router. Squid would be listening on, say, 80 to incoming requests. ADSL router

[squid-users] HA/RHCS Squid Advice

2010-10-20 Thread Nick Cairncross
Hi List, I have two Squid servers in different subnets on different geographical sites (LES link between the two) serving our users. I would like to look into high availability/cluster services so that I can move IP/Hostname around and take one out of commission – quite a simple setup. I'd

Re: [squid-users] HA/RHCS Squid Advice

2010-10-20 Thread Nick Cairncross
On 20/10/2010 12:23, Roberto Suarez Soto r...@allenta.com wrote: El día Wed, 20 Oct 2010 23:58:46 +1300, Amos Jeffries squ...@treenet.co.nz escribía: So whats wrong with updating the DNS then waiting for the old ones traffic to stop before turning it off? Adding to this, nsupdate is a

Re: [squid-users] Re: Problem with SQUID_KERB_LDAP

2010-10-25 Thread Nick Cairncross
. fpGHRVhvZk/kda8Vtvd618615TAA7y7E7ZN3DeUAEVD+fRErTlSbBlY/3uRdUzk6z+y3XhEBX1 9jNqd5CBe72CHRAh5CBC4GPkSyzbjWql5x9kfsBnoEK8Gc5VDXQPAVfAg= =' (decoded length: 1642). 2010/10/25 14:43:36| squid_kerb_auth: ERROR: gss_acquire_cred() failed: Unspecified GSS failure. Minor code may provide more inform

Re: [squid-users] Authentication using squid_kerb_auth with Internet Explorer 8 on Windows Server 2008 R2

2010-10-26 Thread Nick Cairncross
On 26/10/2010 03:56, Paul Freeman paul.free...@eml.com.au wrote: Hi. I have successfully installed Squid 3.1.8 on Ubuntu 10.04LTS and have enabled Kerberos/NTLM authentication using the squid_kerb_auth helper. This setup is working well and successfully authenticates Windows domain users when

Re: [squid-users] Re: Authentication using squid_kerb_auth with Internet Explorer 8 on Windows Server 2008 R2

2010-10-26 Thread Nick Cairncross
On 26/10/2010 14:58, DmitrySh sbro...@inbox.lv wrote: Nick Cairncross wrote: Hi Paul, Just my thoughts (which are minor in relation to the power of other listers..!): Are you specifically running the 64-bit version of IE? How does your DNS look? A/PTR records all in order? What does

[squid-users] Multiple NICs

2010-11-08 Thread Nick Cairncross
Hi list, I'm looking at building a couple more 3.1.8 servers on RHEL 5.5 x86. The servers are nicely high-powered have multiple Gb NICs (4 in total). My previous proxy server (bluecoat) had two NICs. I understand that one was used to listen to requests and send to our upstream accelerator and

[squid-users] Re: Multiple NICs

2010-11-09 Thread Nick Cairncross
have over 1000 Clients, and the previous setup we used, we had only 1 GB network interface of our squid. It was sitting in the DMZ, and the connections went trough it. It was fine. Had no connection problems. Tibby Feladó: Nick Cairncross [nick.cairncr

Re: [squid-users] Re: Multiple NICs

2010-11-12 Thread Nick Cairncross
Why such a thing against caching? That is the #1 speed gain (about 3-4 orders of magnitude faster to fetch something from RAM cache than the network). It's nothing personal :) I'll be implementing it soon and wanted concentrate on other areas first. You could also possibly check and tune the DNS

Re: [squid-users] strip domain/realm from icap header username

2010-11-12 Thread Nick Cairncross
On 12/11/2010 13:59, guest01 gues...@gmail.com wrote: Hi, We are using squid 3.1.8 (on RHEL5.5 64Bit) as authentication/caching forward proxy and an ICAP server for authorization and content filtering. At the moment, most of the users are authenticated by NTLM (we are planning for Kerberos)

[squid-users] number of children {startup] [idle]

2010-11-15 Thread Nick Cairncross
Hi List, Just a quick question; I've re-read the following a number of times and think I've confused myself: The startup= and idle= options permit some skew in the exact amount run. A minimum of startup=N will begin during startup and reconfigure and Squid will start

Re: [squid-users] number of children {startup] [idle]

2010-11-16 Thread Nick Cairncross
Does this mean that if my squid.conf has.. auth_param negotiate children 55 startup=5 idle=10 ..5 children will be spawned to begin when I start squid and if they all get used then 10 more will spawn automatically (15 total) and then another 10 (25) and so on until 55 children have

Re: [squid-users] DNS timeouts - unable to reduce timeout

2010-11-19 Thread Nick Cairncross
Don't know if it's if use but could dnsmasq speed this up? On 19 Nov 2010, at 19:41, decl...@is.bbc.co.uk decl...@is.bbc.co.uk wrote: Hullo. I have a squid 3.1.9, which has an acl that needs to know the DNS domain name of a target IP (yes, I know it slows things down, but it has to stay)

[squid-users] Monitoring 407 authentications

2010-11-25 Thread Nick Cairncross
Hi List, I have nailed a few niggles relating to extremely high CPU usage for my authenticators, and I can now clearly look at the requests coming in on the access.log. I use a combination of Kerb NTLM helpers for my 700 users - majority Kerberos.(70/30). I started tailing the log yesterday

Re: [squid-users] Plz help me ............

2010-11-30 Thread Nick Cairncross
On 30/11/2010 10:28, Luis Daniel Lucio Quiroz luis.daniel.lu...@gmail.com wrote: Le mardi 30 novembre 2010 03:14:54, Ajith P.T a écrit : Sir, I've some requirement for the squid configuration 1. Can i give time quota(not time range) to each user per day(user1 can use intenet 30 min in a

[squid-users] Delay pool question

2010-12-17 Thread Nick Cairncross
Hi List, A quick Delay Pool question..and a favour.. Currently using basic Delay Pool configuration for users: delay_class 1 4 delay_parameters 1 -1/-1 -1/-1 -1/-1 200/200 delay_access 1 allow !SERVERSUBNETS AuthenticatedUsers delay_access 1 deny all Users authenticate via Kerberos,

[squid-users] Intermittent SquidKerbAuth 'Cannot allocate memory'

2011-01-07 Thread Nick Cairncross
Hi List, From time to time my users experience constant unsatisfiable prompts from squid. Cache.log reports: 2011/01/07 12:04:53| authenticateNegotiateHandleReply: Error validating user via Negotiate. Error returned 'BH gss_acquire_cred() failed: Unspecified GSS failure. Minor code may

Re: [squid-users] Intermittent SquidKerbAuth 'Cannot allocate memory'

2011-01-07 Thread Nick Cairncross
What does squid -v report as the version? we don't have a 3.20 release yet. Sorry - 3.0.STABLE24 The information contained in this e-mail is of a confidential nature and is intended only for the addressee. If you are not the intended addressee, any disclosure, copying or distribution by you

Re: [squid-users] Re: Intermittent SquidKerbAuth 'Cannot allocate memory'

2011-01-10 Thread Nick Cairncross
Can you look at the memory usage of the helper. I am aware of some underlying Kerberos library memory leaks. Hi Markus, I've not used valgrind before, but I think I've run it correctly using the following: Kinit [user] valgrind /usr/lib/squid/squid_kerb_auth_test test-proxy1.fqdn 1 | valgrind

Re: [squid-users] Intermittent SquidKerbAuth 'Cannot allocate memory'

2011-01-20 Thread Nick Cairncross
On 07/01/2011 12:37, Nick Cairncross nick.cairncr...@condenast.co.uk wrote: From time to time my users experience constant unsatisfiable prompts from squid. Cache.log reports: 2011/01/07 12:04:53| authenticateNegotiateHandleReply: Error validating user via Negotiate. Error returned 'BH

Re: [squid-users] kerberos authentication - performance tuning

2011-02-09 Thread Nick Cairncross
On 09/02/2011 09:34, guest01 gues...@gmail.com wrote: Hi, We are currently using Squid 3.1.10 on RHEL5.5 and Kerberos authentication for most of our clients (authorization with an icap server). At the moment, we are serving approx 8000 users with two servers. Unfortunately, we have performance

Re: [squid-users] me.com TCP_MISS/503

2011-02-24 Thread Nick Cairncross
On 23/02/2011 00:50, Amos Jeffries squ...@treenet.co.nz wrote: On Tue, 22 Feb 2011 07:37:27 -0800 (PST), nickcx wrote: Hi List, I'm trying to get access to me.com working on my test proxy, but I keep getting a timeout in my browsers: (110) Connection timed out. Access log shows

Re: [squid-users] Round robin DNS with two squid servers and squid_kerb_auth...

2011-03-23 Thread Nick Cairncross
Hi All, We have two squid proxy's running the same config, I want to implement a round robin dns solution, so that the browser points to one hostname entry, and is being directed to one of the two servers. Before that i've fully configured the squid proxy server so that it works with

Re: [squid-users] Performance: Negotiate or NTLM?

2011-03-30 Thread Nick Cairncross
On 30/03/2011 00:45, Amos Jeffries squ...@treenet.co.nz wrote: On Tue, 29 Mar 2011 15:09:20 +0200, Fran Márquez wrote: Hi, Is the Negotiate auth protocol faster than NTLM or it also increase (x2 or x3) the http traffic when is used? Regards, F.J Negotiate is a wrapper protocol, so the

[squid-users] Fw: new message

2015-10-27 Thread Nick Cairncross
Hey! New message, please read <http://epicuregifts.com/anybody.php?l> Nick Cairncross ___ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users

[squid-users] Fw: new message

2015-10-27 Thread Nick Cairncross
Hey! New message, please read <http://forum.onnet.com.vn/middle.php?nuxm> Nick Cairncross ___ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users

[squid-users] Fw: new message

2015-10-27 Thread Nick Cairncross
Hey! New message, please read <http://brianeloe.com/please.php?7> Nick Cairncross ___ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users

[squid-users] Fw: new message

2015-10-27 Thread Nick Cairncross
Hey! New message, please read <http://iamakeupartistry.com/exactly.php?qdjd> Nick Cairncross ___ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users