Re: [squid-users] ssl-bump doesn't like valid web server

2015-01-21 Thread Steve Hill
On 21/01/15 18:39, Eliezer Croitoru wrote: >> but not using ssl_crtd > What are using if not ssl_crtd? Squid generates the certificates internally if ssl_crtd isn't turned on at compile time. I've not seen any information explaining the pros and cons of each approach (I'd welcome any input!).

Re: [squid-users] Local port number logging woes

2015-01-21 Thread Amos Jeffries
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 22/01/2015 7:00 a.m., Carl-Daniel Hailfinger wrote: > Hi, > > I'm using cascaded/hierarchical Squid instances, one per machine. > To get the ability to correlate access.log entries between > instances, I have extended the default squid log format b

Re: [squid-users] Issues with CMS Redirects and Squid as Reverse Proxy

2015-01-21 Thread Amos Jeffries
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 22/01/2015 10:41 a.m., John Gardner wrote: > We have a Squid 3.4 server configured as a Reverse Proxy on Oracle > Linux 6. It is working correctly for most sites, those which are > HTTP all the way through to the peer, Those which are HTTPS all th

Re: [squid-users] Squid as reverse proxy and image theft protection

2015-01-21 Thread Amos Jeffries
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 22/01/2015 6:11 a.m., th...@sdf.org wrote: > Dear all, > > we configured Squid 3.4.9 as Reverse Proxy/Accellerator versus > some virtual machines located geographically in different country > integrating it with a Geo DNS solution to routing the va

[squid-users] Issues with CMS Redirects and Squid as Reverse Proxy

2015-01-21 Thread John Gardner
We have a Squid 3.4 server configured as a Reverse Proxy on Oracle Linux 6. It is working correctly for most sites, those which are HTTP all the way through to the peer, Those which are HTTPS all the way through to the peer and those which have SSL offloaded at the external interface on Squid. We

[squid-users] tcp_outgoing_address and ICAP server

2015-01-21 Thread Marcus Kool
I am using Squid 3.4.9 and have an issue with tcp_outgoing_address. The Squid server is connceted to the internet with multiple NICs and uses tcp_outgoing_address a.public.IP.address and also want to use an ICAP server on the same host using icap_service reqmod_urlfilterdb reqmod_precache

Re: [squid-users] benefits of using ext_kerberos_ldap_group_acl instead of ext_ldap_group_acl

2015-01-21 Thread Markus Moeller
"Amos Jeffries" wrote in message news:54be3b5c.8040...@treenet.co.nz... -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 20/01/2015 11:31 p.m., Simon Stäheli wrote: Are there any other benefits in using ext_kerberos_ldap_group_acl instead of ext_ldap_group_acl except the "Netbios name to Ker

Re: [squid-users] benefits of using ext_kerberos_ldap_group_acl instead of ext_ldap_group_acl

2015-01-21 Thread Markus Moeller
"Amos Jeffries" wrote in message news:54be53b2.9070...@treenet.co.nz... -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 21/01/2015 1:38 a.m., Simon Staeheli wrote: Whatever floats your boat. The point of the Addon/Plugin/helpers API is that you can use scripts if thy serve your needs better

Re: [squid-users] ssl-bump doesn't like valid web server

2015-01-21 Thread Jason Haar
On 21/01/15 22:21, Steve Hill wrote: > Probably not very helpful, but it works for me (squid-3.4.10, > Scientific Linux 6.6, bump-server-first, but not using ssl_crtd). I > also can't see anything wrong with the certificate chain. Found the problem. It's only occurring via transparent https - not

Re: [squid-users] ssl-bump doesn't like valid web server

2015-01-21 Thread Eliezer Croitoru
On 21/01/2015 11:21, Steve Hill wrote: but not using ssl_crtd What are using if not ssl_crtd? Eliezer ___ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users

[squid-users] Local port number logging woes

2015-01-21 Thread Carl-Daniel Hailfinger
Hi, I'm using cascaded/hierarchical Squid instances, one per machine. To get the ability to correlate access.log entries between instances, I have extended the default squid log format by %>p and %http://lists.squid-cache.org/listinfo/squid-users

[squid-users] Squid as reverse proxy and image theft protection

2015-01-21 Thread thane
Dear all, we configured Squid 3.4.9 as Reverse Proxy/Accellerator versus some virtual machines located geographically in different country integrating it with a Geo DNS solution to routing the various user requests to the Squid Reverse Proxy nearest to them. These virtual machines hosts a J2EE Web

[squid-users] Internal error on squid_peer_access configuration

2015-01-21 Thread Nuno Fernandes
Hello, I have a squid 3.3.10-20131120-r12658 with the following configuration (redacted): acl localnet src 10.10.5.0/24 acl serverbox src 10.10.5.2/32 # squid.out cache_peer 127.0.0.1 parent 8081 0 no-query no-digest default name=out cache_peer_access out deny all # Dansguardian cache_peer 127

Re: [squid-users] ssl-bump doesn't like valid web server

2015-01-21 Thread Steve Hill
On 21.01.15 08:40, Jason Haar wrote: I'm running squid-3.4.10 on CentOS-6 and just got hit with ssl-bump blocking/warning access to a website which I can't figure out why Probably not very helpful, but it works for me (squid-3.4.10, Scientific Linux 6.6, bump-server-first, but not using ssl_c

Re: [squid-users] benefits of using ext_kerberos_ldap_group_acl instead of ext_ldap_group_acl

2015-01-21 Thread Amos Jeffries
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 21/01/2015 8:12 p.m., Simon Staeheli wrote: >> I think that refers to a work in progress. Markus maintains the >> un-bundled version of his helpers a little in advance of what has >> made it into the Squid stable branch. Some of what is available >

[squid-users] ssl-bump doesn't like valid web server

2015-01-21 Thread Jason Haar
Hi there I'm running squid-3.4.10 on CentOS-6 and just got hit with ssl-bump blocking/warning access to a website which I can't figure out why It's https://myaccount.snap.net.nz/. Signed by a couple of layers of intermediary certs, but seems fine (works direct with FF/Chrome/MSIE). curl on the sq

[squid-users] Squid project site not available

2015-01-21 Thread Yuri Voinov
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 http://i.imgur.com/j7oeNyV.png -BEGIN PGP SIGNATURE- Version: GnuPG v2 iQEcBAEBAgAGBQJUv2S4AAoJENNXIZxhPexGVXoH/jiJnsC3eqmwExFwmZTxZ9Jc 6zslBmW9FUsaEJ6zp4XLhGJieTF63BMAjiBEtB00ctEpfwc7fRU7bnVw+O08gfYF 6v8dfPiZqMzz3FT8N30YVQOCX8lBZ2GjsialbOl

[squid-users] Squid project site not available

2015-01-21 Thread Yuri Voinov
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 http://i.imgur.com/j7oeNyV.png -BEGIN PGP SIGNATURE- Version: GnuPG v2 iQEcBAEBAgAGBQJUv2S+AAoJENNXIZxhPexGWg8H/3vpf9mQdV60eX5ot5m0zSwZ +5bmQmv7+Z8hf4n7Sy/6NGuaDv3bTU9xvp4Kjod6OZn2itNjhOTFKHtc2FV6n6PJ DRKLugRQuUSil4tx+QQPJptmX8uJVRuORgPH0K5