Erro squid [RESOLVIDO]

thi
(usa Ubuntu)

Enviado em 08/07/2013 - 12:53h

Boa tarde,

Reinstalei o meu servidor novamente e instalei o Ubuntu Server 12.4 + Squid3.

Preciso que autenticação funcione com os grupos do AD. Já estou listando os grupos e usuários do AD. Quando vou rodar o squid, apresenta o seguinte erro:

squid: ERROR: Could not send signal 1 to process 1263: (3) No such process 

Já limpei cache, log, removi swap.state etc...

Dei um squid3 -NCd1 e apresentou o seguinte:

2013/07/08 12:50:45| Starting Squid Cache version 3.1.19 for i686-pc-linux-gnu...

2013/07/08 12:50:45| Process ID 1610

2013/07/08 12:50:45| With 1024 file descriptors available

2013/07/08 12:50:45| Initializing IP Cache...

2013/07/08 12:50:45| DNS Socket created at [::], FD 5

2013/07/08 12:50:45| DNS Socket created at 0.0.0.0, FD 6

2013/07/08 12:50:45| Adding nameserver 10.1.200.23 from squid.conf

2013/07/08 12:50:45| helperOpenServers: Starting 10/10 'ntlm_auth' processes

2013/07/08 12:50:45| helperOpenServers: Starting 5/5 'ntlm_auth' processes

2013/07/08 12:50:45| helperOpenServers: Starting 5/5 'squid_ldap_group' processes

2013/07/08 12:50:46| Unlinkd pipe opened on FD 51

2013/07/08 12:50:46| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec

2013/07/08 12:50:46| Store logging disabled

2013/07/08 12:50:46| Swap maxSize 67108864 + 524288 KB, estimated 5202550 objects

2013/07/08 12:50:46| Target number of buckets: 260127

2013/07/08 12:50:46| Using 262144 Store buckets

2013/07/08 12:50:46| Max Mem  size: 524288 KB

2013/07/08 12:50:46| Max Swap size: 67108864 KB

2013/07/08 12:50:46| Version 1 of swap file with LFS support detected...

2013/07/08 12:50:46| Rebuilding storage in /var/spool/squid3 (CLEAN)

2013/07/08 12:50:46| Using Least Load store dir selection

2013/07/08 12:50:46| Set Current Directory to /var/spool/squid3

2013/07/08 12:50:46| Loaded Icons.

2013/07/08 12:50:46| Accepting  HTTP connections at [::]:3128, FD 56.

2013/07/08 12:50:46| HTCP Disabled.

2013/07/08 12:50:46| Squid plugin modules loaded: 0

2013/07/08 12:50:46| Adaptation support is off.

2013/07/08 12:50:46| Ready to serve requests.

2013/07/08 12:50:46| Done reading /var/spool/squid3 swaplog (0 entries)

2013/07/08 12:50:46| Finished rebuilding storage from disk.

2013/07/08 12:50:46|         0 Entries scanned

2013/07/08 12:50:46|         0 Invalid entries.

2013/07/08 12:50:46|         0 With invalid flags.

2013/07/08 12:50:46|         0 Objects loaded.

2013/07/08 12:50:46|         0 Objects expired.

2013/07/08 12:50:46|         0 Objects cancelled.

2013/07/08 12:50:46|         0 Duplicate URLs purged.

2013/07/08 12:50:46|         0 Swapfile clashes avoided.

2013/07/08 12:50:46|   Took 0.00 seconds (  0.00 objects/sec).

2013/07/08 12:50:46| Beginning Validation Procedure

2013/07/08 12:50:46|   Completed Validation Procedure

2013/07/08 12:50:46|   Validated 25 Entries

2013/07/08 12:50:46|   store_swap_size = 0

2013/07/08 12:50:46| WARNING: ldap_group #1 (FD 38) exited

2013/07/08 12:50:46| WARNING: ldap_group #2 (FD 40) exited

2013/07/08 12:50:46| WARNING: ldap_group #3 (FD 42) exited

2013/07/08 12:50:46| WARNING: ldap_group #4 (FD 44) exited

2013/07/08 12:50:46| Too few ldap_group processes are running

2013/07/08 12:50:46| storeDirWriteCleanLogs: Starting...

2013/07/08 12:50:46|   Finished.  Wrote 0 entries.

2013/07/08 12:50:46|   Took 0.00 seconds (  0.00 entries/sec).

FATAL: The ldap_group helpers are crashing too rapidly, need help!

 

O que pode ser?

Abs.

thi
(usa Ubuntu)

Enviado em 08/07/2013 - 12:55h

Segue o meu squid.conf para análise:

http_port 3128

visible_hostname set

auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp

auth_param ntlm children 10

auth_param ntlm keep_alive on

auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic

auth_param basic realm AUTENTICACAO

auth_param basic credentialsttl 2 hours

auth_param basic casesensitive off

#external_acl_type grupo_ad %LOGIN /usr/lib/squid3/wbinfo_group.pl

external_acl_type ldap_group %LOGIN /usr/lib/squid/squid_ldap_group -R -b "dc=network,dc=local" -D cn=mimeweb,ou=Usuarios_de_sistemas_e_correio_RJ,ou=RJ,ou=Organizacao,dc=network,dc=local -w mi88kx2 -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=%a,ou=Grupos_RJ,ou=RJ,ou=Organizacao,dc=network,dc=local))" -h vulcano.network.local



dns_nameservers 10.1.200.23



#acl all src all

acl manager proto cache_object

acl localhost src 127.0.0.1/32

acl to_localhost dst 127.0.0.0/8 0.0.0.0/32

acl localdomain dstdomain network.local



#



acl localnet src 172.16.0.0/12

acl localnet src 10.1.0.0/16

acl localnet src 10.21.0.0/16



# ACLs Personalizadas

acl autentication proxy_auth REQUIRED

acl internet external ldap_group internetrj

acl dqx external ldap_group internetdqx

acl donwload external ldap_group downloadrj

acl libera_webmail external ldap_group libera_webmail

acl executaveis external ldap_group libera_download_executaveis

acl extension url_regex -i .exe .msi

acl blacklist_webmail dstdomain "/etc/squid3/ACLs/blacklist_webmail"

#

acl SSL_ports port 443		# https

acl SSL_ports port 563		# snews

acl SSL_ports port 873		# rsync

acl Safe_ports port 80		# http

acl Safe_ports port 21		# ftp

acl Safe_ports port 443		# https

acl Safe_ports port 70		# gopher

acl Safe_ports port 210		# wais

acl Safe_ports port 1025-65535	# unregistered ports

acl Safe_ports port 280		# http-mgmt

acl Safe_ports port 488		# gss-http

acl Safe_ports port 591		# filemaker

acl Safe_ports port 777		# multiling http

acl Safe_ports port 631		# cups

acl Safe_ports port 873		# rsync

acl Safe_ports port 901		# SWAT

acl purge method PURGE

acl CONNECT method CONNECT

acl QUERY urlpath_regex cgi-bin \?

no_cache deny localdomain

no_cache deny QUERY



#Default:

# http_access deny all

#

#Recommended minimum configuration:

#

# Only allow cachemgr access from localhost

http_access allow manager localhost

http_access deny manager

# Only allow purge requests from localhost

http_access allow purge localhost

http_access deny purge

# Deny requests to unknown ports

http_access deny !Safe_ports

# Deny CONNECT to other than SSL ports

http_access deny CONNECT !SSL_ports

#

#http_access deny extension !executaveis 

#http_access deny blacklist_webmail !libera_webmail

http_access allow autentication internet

#http_access allow autentication dqx

#*#LIBERADO TEMPORARIAMENTE

http_access allow localnet

http_access allow localhost



icp_access allow localnet

icp_access deny all



hierarchy_stoplist cgi-bin ?



#Default:

cache_mem 512 MB



#Default:

maximum_object_size_in_memory 64 KB



#Default:

memory_replacement_policy heap GDSF



#Default:

cache_replacement_policy heap LFUDA



#Default:

cache_dir diskd /var/spool/squid3 65536 64 256 Q1=64 Q2=72



#Default:

minimum_object_size 0 KB



#Default:

maximum_object_size 128 MB



#Default:

cache_swap_low 50

cache_swap_high 90



access_log /var/log/squid3/access.log squid



#Default:

pid_filename /var/run/squid3.pid



#Suggested default:

refresh_pattern ^ftp:		1440	20%	10080

refresh_pattern ^gopher:	1440	0%	1440

refresh_pattern -i (/cgi-bin/|\?) 0	0%	0

refresh_pattern (Release|Packages(.gz)*)$	0	20%	2880

# example line deb packages

#refresh_pattern (\.deb|\.udeb)$   129600 100% 129600

refresh_pattern .		0	20%	4320



#Default:

# request_header_max_size 20 KB

request_header_max_size 128 KB



#Default:

# reply_header_max_size 20 KB

reply_header_max_size 128 KB



#Default:

cache_effective_user squid



#Default:

cache_effective_group squid



#visible_hostname "set"



# Leave coredumps in the first cache dir

coredump_dir /var/spool/squid3



#hosts_file /etc/hosts

 

Agradeço quem puder ajudar.
Obrigado!

thi
(usa Ubuntu)

Enviado em 08/07/2013 - 13:51h

Pessoal,

Consegui tirar os erros. Só que meu squid fica pedindo autenticação (usuário/senha) toda hora e não sai disso...

o que esta faltando?

abs

thi
(usa Ubuntu)

Enviado em 08/07/2013 - 18:23h

Alguém poderia dar uma luz ae?

Obrigado!

Buckminster
(usa Debian)

Enviado em 08/07/2013 - 19:10h

Qual esquema de autenticação você está usando?

auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp

auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic

Ou é um ou é outro.

Você não leu com atenção o link do Manual do Squid traduzido que te enviei no outro tópico?

thi
(usa Ubuntu)

Enviado em 08/07/2013 - 19:23h

Fala amigão...

Cara, eu nunca fiz autenticação no AD... to meio perdido hehe...

Estão os 2 habilitados. Mas eu já deixei somente um dos 2 e mesmo assim não rolou...

Neste momento não apresenta nenhum erro... Mas fica pedindo autenticação (login/senha) e não sai disso...

O que pode ser? Neste momento, meu squid.conf esta assim:

http_port 3128

visible_hostname set

auth_param ntlm program /usr/bin/ntlm_auth vulcano/set --helper-protocol=squid-2.5-ntlmssp

auth_param ntlm children 30

auth_param ntlm keep_alive on

#

auth_param basic program /usr/bin/ntlm_auth vulcano/set --helper-protocol=squid-2.5-basic

auth_param basic children 5

auth_param basic realm Proxy Squid - Digite suas credenciais 

auth_param basic credentialsttl 5 hours

auth_param basic casesensitive off

#external_acl_type ldap_group %LOGIN /usr/lib/squid3/wbinfo_group.pl

external_acl_type ldap_group %LOGIN /usr/lib/squid3/squid_ldap_group -R -b "dc=vulcano,dc=local" -D cn=mimeweb,ou=Usuarios_de_sistemas_e_correio_RJ,ou=RJ,ou=Organizacao,dc=vulcano,dc=local -w mi88kx2 -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=%a,ou=Grupos_RJ,ou=RJ,ou=Organizacao,dc=vulcano,dc=local))" -h vulcano.network.local

#

dns_nameservers 10.1.200.23



#acl all src all

acl manager proto cache_object

acl localhost src 127.0.0.1/32

acl to_localhost dst 127.0.0.0/8 0.0.0.0/32

acl localdomain dstdomain vulcano.local



#



acl localnet1 src 172.16.0.0/12

acl localnet2 src 10.1.0.0/16

acl localnet3 src 10.21.0.0/16



# ACLs Personalizadas



acl autentication proxy_auth REQUIRED

acl internet external ldap_group internetrj

acl dqx external ldap_group internetdqx

#acl donwload external ldap_group downloadrj

#acl libera_webmail external ldap_group libera_webmail

#acl executaveis external ldap_group libera_download_executaveis

acl extension url_regex -i .exe .msi

acl blacklist_webmail dstdomain "/etc/squid3/ACLs/blacklist_webmail"

#

acl SSL_ports port 443		# https

acl SSL_ports port 563		# snews

acl SSL_ports port 873		# rsync

acl Safe_ports port 80		# http

acl Safe_ports port 21		# ftp

acl Safe_ports port 443		# https

acl Safe_ports port 70		# gopher

acl Safe_ports port 210		# wais

acl Safe_ports port 1025-65535	# unregistered ports

acl Safe_ports port 280		# http-mgmt

acl Safe_ports port 488		# gss-http

acl Safe_ports port 591		# filemaker

acl Safe_ports port 777		# multiling http

acl Safe_ports port 631		# cups

acl Safe_ports port 873		# rsync

acl Safe_ports port 901		# SWAT

acl purge method PURGE

acl CONNECT method CONNECT

acl QUERY urlpath_regex cgi-bin \?

no_cache deny localdomain

no_cache deny QUERY







#Default:

#

#Recommended minimum configuration:

#

# Only allow cachemgr access from localhost

http_access allow manager localhost

http_access deny manager

# Only allow purge requests from localhost

http_access allow purge localhost

http_access deny purge

# Deny requests to unknown ports

http_access deny !Safe_ports

# Deny CONNECT to other than SSL ports

http_access deny CONNECT !SSL_ports

#

#http_access deny extension !executaveis 

#http_access deny blacklist_webmail !libera_webmail

http_access allow autentication internet

http_access allow autentication dqx

#*#LIBERADO TEMPORARIAMENTE

http_access allow localnet1

http_access allow localnet2

http_access allow localnet3

http_access allow localhost



icp_access allow localnet1

icp_access allow localnet2

icp_access allow localnet3

icp_access deny all



hierarchy_stoplist cgi-bin ?



#Default:

cache_mem 512 MB



#Default:

maximum_object_size_in_memory 64 KB



#Default:

memory_replacement_policy heap GDSF



#Default:

cache_replacement_policy heap LFUDA



#Default:

cache_dir diskd /var/spool/squid3 65536 64 256 Q1=64 Q2=72



#Default:

minimum_object_size 0 KB



#Default:

maximum_object_size 128 MB



#Default:

cache_swap_low 50

cache_swap_high 90



access_log /var/log/squid3/access.log squid



#Default:

pid_filename /var/run/squid3.pid



#Suggested default:

refresh_pattern ^ftp:		1440	20%	10080

refresh_pattern ^gopher:	1440	0%	1440

refresh_pattern -i (/cgi-bin/|\?) 0	0%	0

refresh_pattern (Release|Packages(.gz)*)$	0	20%	2880

# example line deb packages

#refresh_pattern (\.deb|\.udeb)$   129600 100% 129600

refresh_pattern .		0	20%	4320



#Default:

# request_header_max_size 20 KB

request_header_max_size 128 KB



#Default:

# reply_header_max_size 20 KB

reply_header_max_size 128 KB



#Default:

cache_effective_user squid



#Default:

cache_effective_group squid



#visible_hostname "set"



# Leave coredumps in the first cache dir

coredump_dir /var/spool/squid3



#hosts_file /etc/hosts 

Abs.

Buckminster
(usa Debian)

Enviado em 08/07/2013 - 19:49h

auth_param basic program /usr/bin/ntlm_auth vulcano/set --helper-protocol=squid-2.5-basic
auth_param basic children 5
auth_param basic realm Proxy Squid - Digite suas credenciais
auth_param basic credentialsttl 5 hours
auth_param basic casesensitive off

Comente todas as linhas acima, reinicie o Squid e teste.

Para o AD leia no link abaixo "Opções de Configuração NEGOTIATE":

http://www.vivaolinux.com.br/artigo/Manual-traduzido-do-Squid/?pagina=3

thi
(usa Ubuntu)

Enviado em 08/07/2013 - 20:32h

Li o trecho sobre o NEGOTIATE. Obrigado pela ajuda amigo, e me desculpe mas essa parte de autenticação eu sou leigo. Vai existir necessidade de modificar o squid.conf?

Na hora que abre o browser, ele joga a tela de login/senha, mesmo que vc digite o usuário/senha do AD ele não faz nada.

Amanhã comento as linhas, testo e retorno aqui, espero que resolva.

Abraço!

thi
(usa Ubuntu)

Enviado em 09/07/2013 - 09:27h

Bom dia amigo,

Comentei as linhas acima e persiste o mesmo problema, pedindo autenticação de login/senha.

Tá tudo certinho, configurado... n sei mais o que fazer...

Obs: Quando abre a o popup pedindo autenticação login/senha, ele aponta para:

Conectar a: IP_DO_PROXY

Não era pra estar buscando autenticação no AD? como altero isso?

Obrigado!

thi
(usa Ubuntu)

Enviado em 09/07/2013 - 11:22h

galera dá um help ae...

já tentei de tudo o.O

Buckminster
(usa Debian)

Enviado em 09/07/2013 - 13:11h

Veja isto:
http://www.vivaolinux.com.br/artigo/Integrando-autenticacao-do-Squid-ao-Active-Directory

thi
(usa Ubuntu)

Enviado em 09/07/2013 - 13:51h

Já tinha visto esse tópico. Minhas configurações estão batendo. Consigo listar users, groups, net ads info, consigo dar echo no user e group a resposta da OK... enfim

só não consigo autenticar os grupos no AD.

Obs: Como dito anteriormente, acho estranho porque no ato da autenticação (conforme imagem abaixo), ele redireciona para o próprio servidor proxy (ip) e não para o ip do serv. AD o.O

Segue:
http://imageshack.us/photo/my-images/534/etb6.jpg/?sa=0

Abs.