[squid-users] R: Squid 100% CPU and possible attack

2015-10-28 Thread Job
Hello to everybody and thank you! By upgrading to squid 3.4.4 thje problem solves! I think there is something on Squid 3.1.8, in conjunction with Dansguardian, that creates some loops the telnettting firewall's LAN ethernet to the 8080 (Dansguardian) port! Francesco _

Re: [squid-users] R: Squid 100% CPU and possible attack

2015-10-26 Thread FredB
> > I have investigate better about the problem that brings up CPU and > Squid process over 100%! > We have this situation: Dansguardian on port 8080 and Squid on port > 3128. > And without DansGuardian, same problem ? > cgi-bin/a2/out.cgi Hum, Avast somewhere ? In your log do you have the

Re: [squid-users] R: Squid 100% CPU and possible attack

2015-10-26 Thread Eliezer Croitoru
Hey Job, There are still missing parts. If telnet or nc results with this it usually means bad setup(considering the information). You will need to describe in more detail your setup with subnets+routers and iptables rules on the CentOS machine. What do you do in the telnetting? just running "

[squid-users] R: Squid 100% CPU and possible attack

2015-10-26 Thread Job
Hello Amos! >Something that would cause a machine to make lots of HTTP requests. >You have provided almost no information about the network, it >configuration, or uses etc. Having eliminated the usual problem(s) it is >a waste of time to guess. I have investigate better about the problem that bri

Re: [squid-users] R: Squid 100% CPU and possible attack

2015-10-23 Thread Amos Jeffries
On 23/10/2015 8:41 p.m., Job wrote: >>> That looks like the side effects of a forwarding loop DoS. Look for the >>> following line in your squid.conf and remove it: > >>> via off > > Hello Amos! > > I do not have via off in my squid.conf, so i think it is set to on, default > value. > > Other

[squid-users] R: Squid 100% CPU and possible attack

2015-10-23 Thread Job
>>That looks like the side effects of a forwarding loop DoS. Look for the >>following line in your squid.conf and remove it: >> via off Hello Amos! I do not have via off in my squid.conf, so i think it is set to on, default value. Otherwise, i redirect outbount http/80 to the internal 8080 on

[squid-users] R: Squid 100% CPU and possible attack

2015-10-23 Thread Job
Hello Eliezer, i use Linux CentOS; i think i will study fail2ban. It seems very very interesting, thank you for the suggestion! Francesco Da: squid-users [squid-users-boun...@lists.squid-cache.org] per conto di Eliezer Croitoru [elie...@ngtech.co.il] Inv