Hi,
I am a total beginner in Linux server administration and I appreciate all your help you are willing to provide. Sorry for the long post and my not-so-great English.
I am having a bit of a problem understanding what is going on here and where did I do something wrong. Here are the steps I took.
I installed Ubuntu 12.04 server from a CD and updated.
Code:sudo apt-get update sudo apt-get upgradeI have installed various software (apache2, php, mysql etc.), configured and confirmed that it works.Code:uname -a Linux MyHostname.MyDomain.local 3.2.0-29-generic #46-Ubuntu SMP Fri Jul 27 17:03:23 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux
A requirement for this setup is for all users on my network to manually setup proxy settings in their browser to myproxyhost on port 3128 as they do not have any access to the internet and this server should be their "window to the world" when it comes to browsing the web.
And next in line of services was installation of some proxy. I wanted to try out squid3 so I did
I created some custom squid.conf which I took from the webCode:sudo apt-get install squid3
Everything works like a charm but the funny thing I've noticed is that I am able to browse the following websites (note the https):Code:# ACCESS CONTROLS OPTIONS # ==================== # acl QUERY urlpath_regex -i cgi-bin ? .php$ .asp$ .shtml$ .cfm$ .cfml$ .phtml$ .php3$ localhost acl all src acl localnet src 10.0.0.0/8 acl localnet src 192.168.1.0/24 # Your network here acl localhost src 127.0.0.1/32 acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 81 3128 1025-65535 acl sslports port 443 563 81 2087 10000 acl manager proto cache_object acl purge method PURGE acl connect method CONNECT acl ym dstdomain .messenger.yahoo.com .psq.yahoo.com acl ym dstdomain .us.il.yimg.com .msg.yahoo.com .pager.yahoo.com acl ym dstdomain .rareedge.com .ytunnelpro.com .chat.yahoo.com acl ym dstdomain .voice.yahoo.com acl ymregex url_regex yupdater.yim ymsgr myspaceim # http_access deny ym http_access deny ymregex http_access allow manager localhost http_access deny manager http_access allow purge localhost http_access deny purge http_access deny !safeports http_access deny CONNECT !sslports http_access allow localhost http_access allow localnet http_access deny all # # NETWORK OPTIONS # ..... # http_port 3128 # # OPTIONS WHICH AFFECT THE CACHE SIZE # ============================== # cache_mem 64 MB maximum_object_size_in_memory 1024 KB memory_replacement_policy heap GDSF cache_replacement_policy heap LFUDA cache_dir aufs /home/precise/cache 10000 14 256 maximum_object_size 128000 KB cache_swap_low 95 cache_swap_high 99 # # LOGFILE PATHNAMES AND CACHE DIRECTORIES # ================================== # access_log /var/log/squid3/access.log cache_log /var/log/squid3/cache.log #cache_log /dev/null cache_store_log none logfile_rotate 5 log_icp_queries off # # OPTIONS FOR TUNING THE CACHE # ======================== # cache deny QUERY refresh_pattern ^ftp: 1440 20% 10080 reload-into-ims refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i .(gif|png|jp?g|ico|bmp|tiff?)$ 10080 95% 43200 override-expire override-lastmod reload-into-ims ignore-no-cache ignore-private refresh_pattern -i .(rpm|cab|deb|exe|msi|msu|zip|tar|xz|bz|bz2|lzma|gz|tgz|rar|bin|7z|doc?|xls?|ppt?|pdf|nth|psd|sis)$ 10080 90% 43200 override-expire override-lastmod reload-into-ims ignore-no-cache ignore-private refresh_pattern -i .(avi|iso|wav|mid|mp?|mpeg|mov|3gp|wm?|swf|flv|x-flv|axd)$ 43200 95% 432000 override-expire override-lastmod reload-into-ims ignore-no-cache ignore-private refresh_pattern -i .(html|htm|css|js)$ 1440 75% 40320 refresh_pattern -i .index.(html|htm)$ 0 75% 10080 refresh_pattern -i (/cgi-bin/|?) 0 0% 0 refresh_pattern . 1440 90% 10080 # quick_abort_min 0 KB quick_abort_max 0 KB quick_abort_pct 100 store_avg_object_size 13 KB # # HTTP OPTIONS # =========== vary_ignore_expire on # # ANONIMITY OPTIONS # =============== # request_header_access From deny all request_header_access Server deny all request_header_access Link deny all request_header_access Via deny all request_header_access X-Forwarded-For deny all # # TIMEOUTS # ======= # forward_timeout 240 second connect_timeout 30 second peer_connect_timeout 5 second read_timeout 600 second request_timeout 60 second shutdown_lifetime 10 second half_closed_clients off # # ADMINISTRATIVE PARAMETERS # ===================== # cache_mgr ninja cache_effective_user proxy cache_effective_group proxy httpd_suppress_version_string on visible_hostname ninja # ftp_list_width 32 ftp_passive on ftp_sanitycheck on # # DNS OPTIONS # ========== # dns_timeout 10 seconds dns_nameservers 8.8.8.8 8.8.4.4 # DNS Server # # MISCELLANEOUS # =========== # memory_pools off client_db off reload_into_ims on coredump_dir /cache pipeline_prefetch on offline_mode off # #Marking ZPH #========== zph_mode tos zph_local 0x04 zph_parent 0 zph_option 136 ### END CONFIGURATION ###
https://mail.yahoo.com
https://accounts.google.com
https://login.live.com
https://twitter.com
BUT unable to browse following websites
https://help.ubuntu.com/
https://www.facebook.com/
due to error
I did some research and found out that support for ssl is not built by default and that I should download source and rebuild it myself with --enable-ssl option. I did this by following a merge of information found on this forum and on other webpages:Code:The proxy server is refusing connections Firefox is configured to use a proxy server that is refusing connections. Check the proxy settings to make sure that they are correct. Contact your network administrator to make sure the proxy server is working.
add the --enable-ssl line among the other --enable-blah- linesCode:apt-get install devscripts build-essential apt-get source squid3 apt-get build-dep squid3 cd squid3-3.1.19 nano debian/rules # or whatever editor you use
Now I have:Code:debuild -us -uc cd .. dpkg -i squid3_3.1.19-1ubuntu3.12.04.1_amd64.deb squid3-common_3.1.19-1ubuntu3.12.04.1_all.deb squid3-dbg_3.1.19-1ubuntu3.12.04.1_amd64.deb
and it didn't solve the problem - proxy server is refusing connections when I try to connect to e.g. https://help.ubuntu.com.Code:$ squid3 -v Squid Cache: Version 3.1.19 configure options: '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--libexecdir=${prefix}/lib/squid3' '--srcdir=.' '--disable-maintainer-mode' '--disable-dependency-tracking' '--disable-silent-rules' '--datadir=/usr/share/squid3' '--sysconfdir=/etc/squid3' '--mandir=/usr/share/man' '--with-cppunit-basedir=/usr' '--enable-inline' '--enable-async-io=8' '--enable-storeio=ufs,aufs,diskd' '--enable-removal-policies=lru,heap' '--enable-delay-pools' '--enable-cache-digests' '--enable-underscores' '--enable-icap-client' '--enable-ssl' '--enable-follow-x-forwarded-for' '--enable-auth=basic,digest,ntlm,negotiate' '--enable-basic-auth-helpers=LDAP,MSNT,NCSA,PAM,SASL,SMB,YP,DB,POP3,getpwnam,squid_radius_auth,multi-domain-NTLM' '--enable-ntlm-auth-helpers=smb_lm,' '--enable-digest-auth-helpers=ldap,password' '--enable-negotiate-auth-helpers=squid_kerb_auth' '--enable-external-acl-helpers=ip_user,ldap_group,session,unix_group,wbinfo_group' '--enable-arp-acl' '--enable-esi' '--enable-zph-qos' '--enable-wccpv2' '--disable-translation' '--with-logdir=/var/log/squid3' '--with-pidfile=/var/run/squid3.pid' '--with-filedescriptors=65536' '--with-large-files' '--with-default-user=proxy' '--enable-linux-netfilter' 'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security' 'LDFLAGS=-Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now' 'CPPFLAGS=-D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security' --with-squid=/home/myuser/squid3/squid3-3.1.19
Thank you for reading this post!
Please help!
Robert
Adv Reply
Bookmarks