Hello, i have a problem here :) System - freebsd 10.1, squid 3.5.5 + kerberos
(MIT), 50 users total.
Without any auth my squid works fine, system is not loaded. When i enable
Kerberos auth internet slowly goes down and crushing after a while, at logs i
see:
2015/07/09 11:47:14 kid1| WARNING: All 60/60 negotiateauthenticator processes
are busy.
2015/07/09 11:47:14 kid1| WARNING: 72 pending requests queued
If i put 100 childrens at config it won't help too.
TTL are fine:
auth_param negotiate program
/usr/local/libexec/squid/negotiate_kerberos_auth -r -s
HTTP/comp.domain....@domain.com
auth_param negotiate children 60 startup=15 idle=1
auth_param negotiate keep_alive on
auth_param basic program /usr/local/libexec/squid/basic_ldap_auth -R -D
u...@domain.com -w "pass" -b "DC=domain,DC=com" -f "sAMAccountName=%s" -h
domain.com
auth_param basic credentialsttl 8 hours
auth_param basic children 10
authenticate_ttl 8 hour
external_acl_type nt_group ttl=1200 %LOGIN
/usr/local/libexec/squid/ext_ldap_group_acl -R -b "DC=domain,DC=com" -f
"(&(sAMAccountName=%v)(memberOf=CN=%a,OU=squid,DC=domain,DC=com))" -D
u...@domain.com -w "pass" -h domain.com
KRB5.CONF
[libdefaults]
default_realm = DOMAIN.COM
dns_lookup_realm = no
dns_lookup_kdc = no
ticket_lifetime = 24h
default_keytab_name = /usr/local/etc/squid/comp.domain.com.keytab
default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc
des-cbc-md5
default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc
des-cbc-md5
permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc
des-cbc-md5
[realms]
DOMAIN.COM = {
kdc = kd1.domain.com
kdc = kd2.domain.com
admin_server = kd1.domain.com
default_domain = domain.com
}
[domain_realm]
.domain.com = DOMAIN.COM
domain.com = DOMAIN.COM
Server shutting down in like 7 mins, i can't even restart squid(system endless
trying to kill squid PID), can't even make kill -9, not working (but system
load is very low)
Can you please help me to find out what is wrong? Is there any way to monitor
what happens with negotiate_kerberos_auth processes ?
_______________________________________________
squid-users mailing list
squid-users@lists.squid-cache.org
http://lists.squid-cache.org/listinfo/squid-users
