Этот сайт лучше всего просматривать в современном браузере с включённым JavaScript.

Squid проблема с правами.

fincherling

Добрый день,

подскажите пожалуйста настраивал SQUID по инструкции на сайте https://blog.it-kb.ru/2014/06/24/forward-proxy-squid-3-3-on-ubuntu-server-14-04-lts-part-4-configure-kerberos-and-ntlm-on-samba-and-winbind/https://blog.it-kb.ru/2014/06/24/forward-proxy-squid-3-3-on-ubuntu-server-14-04-lts-part-4-configure-kerberos-and-ntlm-on-samba-and-winbind/

Проблема следующая авторизация через Kerberos работает пользователя домена распознает, а в интернет не пускает, пишет что нет доступа, скорей всего что то делаю не правильно, побывал уже два раза )

Конфигурация Squid

debug_options ALL,1 33,5 28,5 29,5 # SQUID 3.4.8 Configuration # ----------------------------------------------------------------------------- # # OPTIONS FOR AUTHENTICATION # ----------------------------------------------------------------------------- # # Negotiate Kerberos and NTLM authentication auth_param negotiate program /usr/lib/squid3/negotiate_wrapper_auth --ntlm /usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp --kerberos /usr/lib/squid3/negotiate_kerberos_auth -r -s HTTP/conductor.ekt.mbrd.ru@EKT.MBRD.RU auth_param negotiate children 200 startup=50 idle=10 auth_param negotiate keep_alive off # Only NTLM authentication auth_param ntlm program /usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp auth_param ntlm children 100 startup=20 idle=5 auth_param ntlm keep_alive off # Basic authentication via ldap for clients not authenticated via kerberos/ntlm auth_param basic program /usr/lib/squid3/basic_ldap_auth -v 3 -P -R -b "dc=ekt,dc=mbrd,dc=ru" -D squid3@ekt.mbrd.ru -W /etc/squid3/conf_param_ldappass.txt -f sAMAccountName=%s -h ekt-dc1.ekt.mbrd.ru auth_param basic children 20 auth_param basic realm "EKT-DC1.EKT.MBRD.RU SQUID Proxy Server Basic authentication!" auth_param basic credentialsttl 2 hours # ACCESS CONTROLS # ----------------------------------------------------------------------------- # # LDAP authorization external_acl_type memberof ttl=3600 ipv4 %LOGIN /usr/lib/squid3/ext_ldap_group_acl -v 3 -P -R -K -b "dc=ekt,dc=mbrd,dc=ru" -D squid3@ekt.mbrd.ru -W /etc/squid3/conf_param_ldappass.txt -f "(&(objectclass=person)(sAMAccountName=%v)(memberOf.2.840.113556.1.4.1941:=cn=%g,OU=Security Groups,OU=EKT,DC=ekt,DC=mbrd,DC=ru))" -h ekt-dc1.ekt.mbrd.ru # acl auth proxy_auth REQUIRED acl BlockedAccess external memberof "/etc/squid3/conf_param_groups_blocked.txt" acl RestrictedAccess external memberof "/etc/squid3/conf_param_groups_restricted.txt" acl StandardAccess external memberof "/etc/squid3/conf_param_groups_standard.txt" acl FullAccess external memberof "/etc/squid3/conf_param_groups_full_auth.txt" acl AnonymousAccess external memberof "/etc/squid3/conf_param_groups_full_anon.txt" acl allowedsites dstdomain "/etc/squid3/conf_param_sites_allowed.txt" acl blockedsites dstdomain "/etc/squid3/conf_param_sites_blocked.txt" acl prioritysites dstdomain "/etc/squid3/conf_param_sites_priority.txt" # acl LocalWUServers src "/etc/squid3/conf_param_computers_wsus.txt" acl GlobalWUSites dstdomain "/etc/squid3/conf_param_sites_wsus.txt" # # # Squid default ACLs # ACLs all, manager, localhost, and to_localhost are predefined. # acl manager proto cache_object # acl localhost src 127.0.0.1/32 : # acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 : acl localnet src 172.17.0.0/24 # RFC1918 possible internal network #acl localnet src 172.16.0.0/12 # RFC1918 possible internal network #acl localnet src 192.168.0.0/16 # RFC1918 possible internal network #acl localnet src fc00::/7 # RFC 4193 local private network range #acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT # # # Deny requests to certain unsafe ports http_access deny !Safe_ports # Deny CONNECT to other than secure SSL ports http_access deny CONNECT !SSL_ports # Аllow cachemgr access from localhost and localnet http_access allow localhost manager http_access allow localnet manager http_access deny manager # Allow direct access to Windows Update http_access allow GlobalWUSites LocalWUServers # Allow unrestricted access to prioritysites http_access allow prioritysites localnet # Enforce authentication, order of rules is important for authorization levels http_access deny !auth # Prevent access to basic auth prompt for BlockedAccess users http_access deny BlockedAccess all http_access allow allowedsites localnet http_access deny RestrictedAccess all http_access allow AnonymousAccess auth localnet http_access allow FullAccess auth localnet http_access deny blockedsites http_access allow StandardAccess auth localnet # And finally deny all other access to this proxy http_access deny all # # NETWORK OPTIONS # ----------------------------------------------------------------------------- # http_port 172.17.16.94 # # OPTIONS WHICH AFFECT THE NEIGHBOR SELECTION ALGORITHM # ----------------------------------------------------------------------------- # hierarchy_stoplist cgi-bin ? forward_max_tries 25 # # LOGFILE OPTIONS # ----------------------------------------------------------------------------- # # don't log AnonymousAccess access_log daemon:/var/log/squid3/access.log squid !AnonymousAccess # OPTIONS FOR TROUBLESHOOTING # ----------------------------------------------------------------------------- # cache_log /var/log/squid3/cache.log coredump_dir /var/spool/squid3 # OPTIONS FOR TUNING THE CACHE # ----------------------------------------------------------------------------- # refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern (Release|Packages(.gz)*)$ 0 20% 2880 refresh_pattern . 0 20% 4320 # ADMINISTRATIVE PARAMETERS # ----------------------------------------------------------------------------- # cache_mgr it@ekt.mtsbank.ru httpd_suppress_version_string on visible_hostname SQUID MTSBANK.RU # ERROR PAGE OPTIONS # ----------------------------------------------------------------------------- # error_directory /usr/share/squid3/errors/ru error_default_language ru # DNS OPTIONS # ----------------------------------------------------------------------------- # dns_v4_first on # #


2016/12/07 12.196 kid1| Checklist.cc(62) preCheck: 0xb8fb11a0 checking slow rules
2016/12/07 12.196 kid1| Acl.cc(157) matches: checking http_access
2016/12/07 12.197 kid1| Acl.cc(157) matches: checking http_access#1
2016/12/07 12.197 kid1| Acl.cc(157) matches: checking !Safe_ports
2016/12/07 12.197 kid1| Acl.cc(157) matches: checking Safe_ports
2016/12/07 12.197 kid1| Acl.cc(177) matches: checked: Safe_ports = 1
2016/12/07 12.197 kid1| Acl.cc(177) matches: checked: !Safe_ports = 0
2016/12/07 12.197 kid1| Acl.cc(177) matches: checked: http_access#1 = 0
2016/12/07 12.197 kid1| Acl.cc(157) matches: checking http_access#2
2016/12/07 12.197 kid1| Acl.cc(157) matches: checking CONNECT
2016/12/07 12.197 kid1| Acl.cc(177) matches: checked: CONNECT = 1
2016/12/07 12.197 kid1| Acl.cc(157) matches: checking !SSL_ports
2016/12/07 12.197 kid1| Acl.cc(157) matches: checking SSL_ports
2016/12/07 12.197 kid1| Acl.cc(177) matches: checked: SSL_ports = 1
2016/12/07 12.197 kid1| Acl.cc(177) matches: checked: !SSL_ports = 0
2016/12/07 12.197 kid1| Acl.cc(177) matches: checked: http_access#2 = 0
2016/12/07 12.197 kid1| Acl.cc(157) matches: checking http_access#3
2016/12/07 12.197 kid1| Acl.cc(157) matches: checking localhost
2016/12/07 12.197 kid1| Ip.cc(560) match: aclIpMatchIp: '172.17.224.101' NOT found
2016/12/07 12.197 kid1| Acl.cc(177) matches: checked: localhost = 0
2016/12/07 12.197 kid1| Acl.cc(177) matches: checked: http_access#3 = 0
2016/12/07 12.197 kid1| Acl.cc(157) matches: checking http_access#4
2016/12/07 12.197 kid1| Acl.cc(157) matches: checking localnet
2016/12/07 12.197 kid1| Ip.cc(560) match: aclIpMatchIp: '172.17.224.101' NOT found
2016/12/07 12.197 kid1| Acl.cc(177) matches: checked: localnet = 0
2016/12/07 12.197 kid1| Acl.cc(177) matches: checked: http_access#4 = 0
2016/12/07 12.197 kid1| Acl.cc(157) matches: checking http_access#5
2016/12/07 12.197 kid1| Acl.cc(157) matches: checking manager
2016/12/07 12.197 kid1| RegexData.cc(71) match: aclRegexData:: checking 'ssl.gstatic.com'
2016/12/07 12.197 kid1| RegexData.cc(82) match: aclRegexData:: looking for '(^cache_object://)'
2016/12/07 12.197 kid1| RegexData.cc(82) match: aclRegexData:: looking for '(^https?:+/squid-internal-mgr/)'
2016/12/07 12.198 kid1| Acl.cc(177) matches: checked: manager = 0
2016/12/07 12.198 kid1| Acl.cc(177) matches: checked: http_access#5 = 0
2016/12/07 12.198 kid1| Acl.cc(157) matches: checking http_access#6
2016/12/07 12.198 kid1| Acl.cc(157) matches: checking GlobalWUSites
2016/12/07 12.198 kid1| DomainData.cc(131) match: aclMatchDomainList: checking 'ssl.gstatic.com'
2016/12/07 12.198 kid1| DomainData.cc(135) match: aclMatchDomainList: 'ssl.gstatic.com' NOT found
2016/12/07 12.198 kid1| Acl.cc(177) matches: checked: GlobalWUSites = 0
2016/12/07 12.198 kid1| Acl.cc(177) matches: checked: http_access#6 = 0
2016/12/07 12.198 kid1| Acl.cc(157) matches: checking http_access#7
2016/12/07 12.198 kid1| Acl.cc(157) matches: checking prioritysites
2016/12/07 12.198 kid1| DomainData.cc(131) match: aclMatchDomainList: checking 'ssl.gstatic.com'
2016/12/07 12.198 kid1| DomainData.cc(135) match: aclMatchDomainList: 'ssl.gstatic.com' NOT found
2016/12/07 12.198 kid1| Acl.cc(177) matches: checked: prioritysites = 0
2016/12/07 12.198 kid1| Acl.cc(177) matches: checked: http_access#7 = 0
2016/12/07 12.198 kid1| Acl.cc(157) matches: checking http_access#8
2016/12/07 12.198 kid1| Acl.cc(157) matches: checking !auth
2016/12/07 12.198 kid1| Acl.cc(157) matches: checking auth
2016/12/07 12.198 kid1| UserRequest.cc(373) authenticate: No connection authentication type
2016/12/07 12.198 kid1| User.cc(68) User: Initialised auth_user '0xb8fa8038'.
2016/12/07 12.198 kid1| UserRequest.cc(115) UserRequest: initialised request 0xb8faab80
2016/12/07 12.198 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.198 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.198 kid1| client_side.cc(785) setAuth: Adding connection-auth to local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1 from new Negotiate handshake request
2016/12/07 12.198 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.198 kid1| AclProxyAuth.cc(143) checkForAsync: checking password via authenticator
2016/12/07 12.198 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.198 kid1| Acl.cc(62) AuthenticateAcl: returning 2 sending credentials to helper.
2016/12/07 12.198 kid1| Acl.cc(177) matches: checked: auth = -1 async
2016/12/07 12.198 kid1| Acl.cc(177) matches: checked: !auth = -1 async
2016/12/07 12.199 kid1| Acl.cc(177) matches: checked: http_access#8 = -1 async
2016/12/07 12.199 kid1| Acl.cc(177) matches: checked: http_access = -1 async
2016/12/07 12.199 kid1| client_side.cc(3046) clientParseRequests: Not parsing new requests, as this request may need the connection
2016/12/07 12.199 kid1| AsyncJob.cc(146) callEnd: ConnStateData status out: 
2016/12/07 12.199 kid1| AsyncCallQueue.cc(53) fireNext: leaving ConnStateData:(local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1, data=0xb8d2a558, size=313, buf=0xb8f544c8)
2016/12/07 12.201 kid1| UserRequest.cc(260) HandleReply: Need to challenge the client with a server token: 'TlRMTVNTUAACAAAABgAGADgAAAAVgoniGOwaL91c1n4AAAAAAAAAAHgAeAA+AAAABgEAAAAAAA9FAEsAVAACAAYARQBLAFQAAQASAEMATwBOAEQAVQBDAFQATwBSAAQAFgBlAGsAdAAuAG0AYgByAGQALgByAHUAAwAqAGMAbwBuAGQAdQBjAHQAbwByAC4AZQBrAHQALgBtAGIAcgBkAC4AcgB1AAcACABqXxF3XFDSAQAAAAA='
2016/12/07 12.201 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.201 kid1| InnerNode.cc(87) resumeMatchingAt: checking http_access at 7
2016/12/07 12.201 kid1| InnerNode.cc(87) resumeMatchingAt: checking http_access#8 at 0
2016/12/07 12.201 kid1| InnerNode.cc(87) resumeMatchingAt: checking !auth at 0
2016/12/07 12.201 kid1| Acl.cc(157) matches: checking auth
2016/12/07 12.201 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.202 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.202 kid1| UserRequest.cc(152) authenticate: need to challenge client 'TlRMTVNTUAACAAAABgAGADgAAAAVgoniGOwaL91c1n4AAAAAAAAAAHgAeAA+AAAABgEAAAAAAA9FAEsAVAACAAYARQBLAFQAAQASAEMATwBOAEQAVQBDAFQATwBSAAQAFgBlAGsAdAAuAG0AYgByAGQALgByAHUAAwAqAGMAbwBuAGQAdQBjAHQAbwByAC4AZQBrAHQALgBtAGIAcgBkAC4AcgB1AAcACABqXxF3XFDSAQAAAAA='!
2016/12/07 12.202 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.202 kid1| Acl.cc(68) AuthenticateAcl: returning 3 sending authentication challenge.
2016/12/07 12.202 kid1| Checklist.cc(55) markFinished: 0xb8fb11a0 answer AUTH_REQUIRED for AuthenticateAcl exception
2016/12/07 12.202 kid1| Acl.cc(177) matches: checked: auth = -1
2016/12/07 12.202 kid1| InnerNode.cc(90) resumeMatchingAt: checked: !auth = -1
2016/12/07 12.202 kid1| InnerNode.cc(90) resumeMatchingAt: checked: http_access#8 = -1
2016/12/07 12.202 kid1| InnerNode.cc(90) resumeMatchingAt: checked: http_access = -1
2016/12/07 12.202 kid1| Checklist.cc(155) checkCallback: ACLChecklist:: 0xb8fb11a0 answer=AUTH_REQUIRED
2016/12/07 12.202 kid1| client_side_request.cc(781) clientAccessCheckDone: Proxy Auth Message = <null>
2016/12/07 12.202 kid1| FilledChecklist.cc(58) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0xbff3c754
2016/12/07 12.202 kid1| Checklist.cc(189) ~ACLChecklist: ACLChecklist::~ACLChecklist: destroyed 0xbff3c754
2016/12/07 12.202 kid1| FilledChecklist.cc(58) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0xbff3c754
2016/12/07 12.202 kid1| Checklist.cc(189) ~ACLChecklist: ACLChecklist::~ACLChecklist: destroyed 0xbff3c754
2016/12/07 12.203 kid1| store_client.cc(349) doCopy: store_client:: co: 0, hi: 2133
2016/12/07 12.203 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.203 kid1| AsyncCall.cc(18) AsyncCall: The AsyncCall clientWriteComplete constructed, this=0xb8cdfb18 
2016/12/07 12.203 kid1| FilledChecklist.cc(58) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0xb8fb11a0
2016/12/07 12.203 kid1| Checklist.cc(189) ~ACLChecklist: ACLChecklist::~ACLChecklist: destroyed 0xb8fb11a0
2016/12/07 12.204 kid1| AsyncCall.cc(85) ScheduleCall: IoCallback.cc(127) will call clientWriteComplete(local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1, data=0xb8fb34a0) 
2016/12/07 12.204 kid1| AsyncCallQueue.cc(51) fireNext: entering clientWriteComplete(local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1, data=0xb8fb34a0)
2016/12/07 12.204 kid1| AsyncCall.cc(30) make: make call clientWriteComplete 
2016/12/07 12.204 kid1| client_side.cc(1943) writeComplete: local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1, sz 2521, err 0, off 2521, len 2133
2016/12/07 12.204 kid1| client_side.cc(1964) writeComplete: local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1 Keeping Alive
2016/12/07 12.204 kid1| client_side.cc(1626) keepaliveNextRequest: ConnnStateData(local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1), Context(local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1)
2016/12/07 12.204 kid1| client_side_request.cc(267) ~ClientHttpRequest: httpRequestFree: ssl.gstatic.com
2016/12/07 12.204 kid1| Checklist.cc(62) preCheck: 0xbff3c774 checking fast ACLs
2016/12/07 12.204 kid1| Acl.cc(157) matches: checking access_log daemon:/var/log/squid3/access.log
2016/12/07 12.204 kid1| Acl.cc(157) matches: checking (access_log daemon:/var/log/squid3/access.log line)
2016/12/07 12.204 kid1| Acl.cc(157) matches: checking !AnonymousAccess
2016/12/07 12.204 kid1| Acl.cc(157) matches: checking AnonymousAccess
2016/12/07 12.204 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.205 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.205 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.205 kid1| Checklist.cc(115) goAsync: 0xbff3c774 a fast-only directive uses a slow ACL!
2016/12/07 12.205 kid1| Acl.cc(64) AuthenticateAcl: cannot go async; returning 2
2016/12/07 12.205 kid1| Checklist.cc(55) markFinished: 0xbff3c774 answer DUNNO for aclMatchExternal exception
2016/12/07 12.205 kid1| Acl.cc(177) matches: checked: AnonymousAccess = -1
2016/12/07 12.205 kid1| Acl.cc(177) matches: checked: !AnonymousAccess = -1
2016/12/07 12.205 kid1| Acl.cc(177) matches: checked: (access_log daemon:/var/log/squid3/access.log line) = -1
2016/12/07 12.205 kid1| Acl.cc(177) matches: checked: access_log daemon:/var/log/squid3/access.log = -1
2016/12/07 12.205 kid1| FilledChecklist.cc(58) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0xbff3c774
2016/12/07 12.205 kid1| Checklist.cc(189) ~ACLChecklist: ACLChecklist::~ACLChecklist: destroyed 0xbff3c774
2016/12/07 12.205 kid1| client_side.cc(2998) clientParseRequests: local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1: attempting to parse
2016/12/07 12.206 kid1| client_side.cc(1696) keepaliveNextRequest: local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1: calling conn->readNextRequest()
2016/12/07 12.206 kid1| client_side.cc(1583) readNextRequest: local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1 reading next req
2016/12/07 12.206 kid1| AsyncCall.cc(18) AsyncCall: The AsyncCall ConnStateData: constructed, this=0xb8fa9f00 
2016/12/07 12.206 kid1| client_side.cc(258) readSomeData: local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1: reading request...
2016/12/07 12.206 kid1| AsyncCall.cc(18) AsyncCall: The AsyncCall ConnStateData: constructed, this=0xb8ce51e0 
2016/12/07 12.206 kid1| AsyncCallQueue.cc(53) fireNext: leaving clientWriteComplete(local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1, data=0xb8fb34a0)
2016/12/07 12.219 kid1| AsyncCall.cc(85) ScheduleCall: IoCallback.cc(127) will call ConnStateData:(local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1, data=0xb8d2a558, size=877, buf=0xb8f544c8) 
2016/12/07 12.219 kid1| AsyncCallQueue.cc(51) fireNext: entering ConnStateData:(local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1, data=0xb8d2a558, size=877, buf=0xb8f544c8)
2016/12/07 12.219 kid1| AsyncCall.cc(30) make: make call ConnStateData: 
2016/12/07 12.219 kid1| AsyncJob.cc(117) callStart: ConnStateData status in: 
2016/12/07 12.219 kid1| client_side.cc(3059) clientReadRequest: local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1 size 877
2016/12/07 12.219 kid1| client_side.cc(2998) clientParseRequests: local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1: attempting to parse
2016/12/07 12.220 kid1| client_side.cc(2322) parseHttpRequest: parseHttpRequest: req_hdr = {Host: ssl.gstatic.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36
Proxy-Authorization: Negotiate TlRMTVNTUAADAAAAGAAYAIYAAAAiASIBngAAAAYABgBYAAAADgAOAF4AAAAaABoAbAAAABAAEADAAQAAFYKI4gYBsR0AAAAP8lbbgronMNDmHmnFGIZIWmUAawB0AHUAcwBoAGEAawBvAHYARQBLAFQALQBUAE0ATgAtADgANAA2ADYAOQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABP+zos1MGF8Dc0zvf7NaLYAQEAAAAAAABqXxF3XFDSAdCDKgdWxN1HAAAAAAIABgBFAEsAVAABABIAQwBPAE4ARABVAEMAVABPAFIABAAWAGUAawB0AC4AbQBiAHIAZAAuAHIAdQADACoAYwBvAG4AZAB1AGMAdABvAHIALgBlAGsAdAAuAG0AYgByAGQALgByAHUABwAIAGpfEXdcUNIBBgAEAAIAAAAIADAAMAAAAAAAAAAAAAAAADAAAAczkE3vvYdX27h5+2ivgbHN3oklNYH/WggxuhTJpW3JCgAQAAAAAAAAAAAAAAAAAAAAAAAJACIASABUAFQAUAAvADEANwAyAC4AMQA3AC4AMQA2AC4AOQA0AAAAAAAAAAAAAAAAAKhetQRTAabjGbTaPGcMTVI=

}
2016/12/07 12.220 kid1| client_side.cc(2326) parseHttpRequest: parseHttpRequest: end = {
}
2016/12/07 12.220 kid1| client_side.cc(2330) parseHttpRequest: parseHttpRequest: prefix_sz = 877, req_line_sz = 38
2016/12/07 12.220 kid1| client_side.cc(2346) parseHttpRequest: parseHttpRequest: Request Header is
Host: ssl.gstatic.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36
Proxy-Authorization: Negotiate TlRMTVNTUAADAAAAGAAYAIYAAAAiASIBngAAAAYABgBYAAAADgAOAF4AAAAaABoAbAAAABAAEADAAQAAFYKI4gYBsR0AAAAP8lbbgronMNDmHmnFGIZIWmUAawB0AHUAcwBoAGEAawBvAHYARQBLAFQALQBUAE0ATgAtADgANAA2ADYAOQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABP+zos1MGF8Dc0zvf7NaLYAQEAAAAAAABqXxF3XFDSAdCDKgdWxN1HAAAAAAIABgBFAEsAVAABABIAQwBPAE4ARABVAEMAVABPAFIABAAWAGUAawB0AC4AbQBiAHIAZAAuAHIAdQADACoAYwBvAG4AZAB1AGMAdABvAHIALgBlAGsAdAAuAG0AYgByAGQALgByAHUABwAIAGpfEXdcUNIBBgAEAAIAAAAIADAAMAAAAAAAAAAAAAAAADAAAAczkE3vvYdX27h5+2ivgbHN3oklNYH/WggxuhTJpW3JCgAQAAAAAAAAAAAAAAAAAAAAAAAJACIASABUAFQAUAAvADEANwAyAC4AMQA3AC4AMQA2AC4AOQA0AAAAAAAAAAAAAAAAAKhetQRTAabjGbTaPGcMTVI=


2016/12/07 12.220 kid1| client_side.cc(2367) parseHttpRequest: repare absolute URL from 
2016/12/07 12.220 kid1| client_side.cc(2404) parseHttpRequest: parseHttpRequest: Complete request received
2016/12/07 12.220 kid1| client_side.cc(3036) clientParseRequests: local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1: parsed a request
2016/12/07 12.220 kid1| client_side.cc(2754) clientProcessRequest: URL domain ssl.gstatic.com overrides header Host: ssl.gstatic.com
2016/12/07 12.220 kid1| client_side.cc(925) clientSetKeepaliveFlag: clientSetKeepaliveFlag: http_ver = 1.1
2016/12/07 12.220 kid1| client_side.cc(927) clientSetKeepaliveFlag: clientSetKeepaliveFlag: method = CONNECT
2016/12/07 12.220 kid1| client_side.h(108) mayUseConnection: This 0xb8fb34a0 marked 1
2016/12/07 12.220 kid1| client_side.cc(2510) connNoteUseOfBuffer: conn->in.notYetUsed = 0
2016/12/07 12.220 kid1| Checklist.cc(62) preCheck: 0xb8fb11a0 checking slow rules
2016/12/07 12.220 kid1| Acl.cc(157) matches: checking http_access
2016/12/07 12.220 kid1| Acl.cc(157) matches: checking http_access#1
2016/12/07 12.221 kid1| Acl.cc(157) matches: checking !Safe_ports
2016/12/07 12.221 kid1| Acl.cc(157) matches: checking Safe_ports
2016/12/07 12.221 kid1| Acl.cc(177) matches: checked: Safe_ports = 1
2016/12/07 12.221 kid1| Acl.cc(177) matches: checked: !Safe_ports = 0
2016/12/07 12.221 kid1| Acl.cc(177) matches: checked: http_access#1 = 0
2016/12/07 12.221 kid1| Acl.cc(157) matches: checking http_access#2
2016/12/07 12.221 kid1| Acl.cc(157) matches: checking CONNECT
2016/12/07 12.221 kid1| Acl.cc(177) matches: checked: CONNECT = 1
2016/12/07 12.221 kid1| Acl.cc(157) matches: checking !SSL_ports
2016/12/07 12.221 kid1| Acl.cc(157) matches: checking SSL_ports
2016/12/07 12.221 kid1| Acl.cc(177) matches: checked: SSL_ports = 1
2016/12/07 12.221 kid1| Acl.cc(177) matches: checked: !SSL_ports = 0
2016/12/07 12.221 kid1| Acl.cc(177) matches: checked: http_access#2 = 0
2016/12/07 12.221 kid1| Acl.cc(157) matches: checking http_access#3
2016/12/07 12.221 kid1| Acl.cc(157) matches: checking localhost
2016/12/07 12.222 kid1| Ip.cc(560) match: aclIpMatchIp: '172.17.224.101' NOT found
2016/12/07 12.222 kid1| Acl.cc(177) matches: checked: localhost = 0
2016/12/07 12.222 kid1| Acl.cc(177) matches: checked: http_access#3 = 0
2016/12/07 12.222 kid1| Acl.cc(157) matches: checking http_access#4
2016/12/07 12.222 kid1| Acl.cc(157) matches: checking localnet
2016/12/07 12.222 kid1| Ip.cc(560) match: aclIpMatchIp: '172.17.224.101' NOT found
2016/12/07 12.222 kid1| Acl.cc(177) matches: checked: localnet = 0
2016/12/07 12.222 kid1| Acl.cc(177) matches: checked: http_access#4 = 0
2016/12/07 12.222 kid1| Acl.cc(157) matches: checking http_access#5
2016/12/07 12.222 kid1| Acl.cc(157) matches: checking manager
2016/12/07 12.222 kid1| RegexData.cc(71) match: aclRegexData:: checking 'ssl.gstatic.com'
2016/12/07 12.222 kid1| RegexData.cc(82) match: aclRegexData:: looking for '(^cache_object://)'
2016/12/07 12.222 kid1| RegexData.cc(82) match: aclRegexData:: looking for '(^https?:+/squid-internal-mgr/)'
2016/12/07 12.222 kid1| Acl.cc(177) matches: checked: manager = 0
2016/12/07 12.222 kid1| Acl.cc(177) matches: checked: http_access#5 = 0
2016/12/07 12.222 kid1| Acl.cc(157) matches: checking http_access#6
2016/12/07 12.222 kid1| Acl.cc(157) matches: checking GlobalWUSites
2016/12/07 12.222 kid1| DomainData.cc(131) match: aclMatchDomainList: checking 'ssl.gstatic.com'
2016/12/07 12.222 kid1| DomainData.cc(135) match: aclMatchDomainList: 'ssl.gstatic.com' NOT found
2016/12/07 12.222 kid1| Acl.cc(177) matches: checked: GlobalWUSites = 0
2016/12/07 12.222 kid1| Acl.cc(177) matches: checked: http_access#6 = 0
2016/12/07 12.223 kid1| Acl.cc(157) matches: checking http_access#7
2016/12/07 12.223 kid1| Acl.cc(157) matches: checking prioritysites
2016/12/07 12.223 kid1| DomainData.cc(131) match: aclMatchDomainList: checking 'ssl.gstatic.com'
2016/12/07 12.223 kid1| DomainData.cc(135) match: aclMatchDomainList: 'ssl.gstatic.com' NOT found
2016/12/07 12.223 kid1| Acl.cc(177) matches: checked: prioritysites = 0
2016/12/07 12.223 kid1| Acl.cc(177) matches: checked: http_access#7 = 0
2016/12/07 12.223 kid1| Acl.cc(157) matches: checking http_access#8
2016/12/07 12.223 kid1| Acl.cc(157) matches: checking !auth
2016/12/07 12.223 kid1| Acl.cc(157) matches: checking auth
2016/12/07 12.223 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.223 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.224 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.224 kid1| AclProxyAuth.cc(143) checkForAsync: checking password via authenticator
2016/12/07 12.224 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.224 kid1| Acl.cc(62) AuthenticateAcl: returning 2 sending credentials to helper.
2016/12/07 12.224 kid1| Acl.cc(177) matches: checked: auth = -1 async
2016/12/07 12.224 kid1| Acl.cc(177) matches: checked: !auth = -1 async
2016/12/07 12.224 kid1| Acl.cc(177) matches: checked: http_access#8 = -1 async
2016/12/07 12.224 kid1| Acl.cc(177) matches: checked: http_access = -1 async
2016/12/07 12.224 kid1| client_side.cc(3046) clientParseRequests: Not parsing new requests, as this request may need the connection
2016/12/07 12.224 kid1| AsyncJob.cc(146) callEnd: ConnStateData status out: 
2016/12/07 12.224 kid1| AsyncCallQueue.cc(53) fireNext: leaving ConnStateData:(local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1, data=0xb8d2a558, size=877, buf=0xb8f544c8)
2016/12/07 12.234 kid1| UserRequest.cc(285) HandleReply: authenticated user ushakov
2016/12/07 12.235 kid1| User.cc(101) absorb: auth_user '0xb8fa8038*3' into auth_user '0xb8fa4730'.
2016/12/07 12.235 kid1| User.cc(14) ~User: doing nothing to clear Negotiate scheme data for '0xb8fa8038'
2016/12/07 12.235 kid1| User.cc(157) ~User: Freeing auth_user '0xb8fa8038'.
2016/12/07 12.235 kid1| UserRequest.cc(310) HandleReply: Successfully validated user via Negotiate. Username 'ushakov'
2016/12/07 12.235 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.235 kid1| InnerNode.cc(87) resumeMatchingAt: checking http_access at 7
2016/12/07 12.235 kid1| InnerNode.cc(87) resumeMatchingAt: checking http_access#8 at 0
2016/12/07 12.235 kid1| InnerNode.cc(87) resumeMatchingAt: checking !auth at 0
2016/12/07 12.235 kid1| Acl.cc(157) matches: checking auth
2016/12/07 12.235 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.235 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.236 kid1| UserRequest.cc(93) valid: Validated. Auth: '0xb8faab80'.
2016/12/07 12.236 kid1| Acl.cc(348) cacheMatchAcl: ACL:: cache hit on acl 'auth' (0xb8b625d8)
2016/12/07 12.236 kid1| Acl.cc(177) matches: checked: auth = 1
2016/12/07 12.236 kid1| InnerNode.cc(90) resumeMatchingAt: checked: !auth = 0
2016/12/07 12.236 kid1| InnerNode.cc(90) resumeMatchingAt: checked: http_access#8 = 0
2016/12/07 12.236 kid1| Acl.cc(157) matches: checking http_access#9
2016/12/07 12.236 kid1| Acl.cc(157) matches: checking BlockedAccess
2016/12/07 12.236 kid1| Acl.cc(177) matches: checked: BlockedAccess = 0
2016/12/07 12.236 kid1| Acl.cc(177) matches: checked: http_access#9 = 0
2016/12/07 12.236 kid1| Acl.cc(157) matches: checking http_access#10
2016/12/07 12.236 kid1| Acl.cc(157) matches: checking allowedsites
2016/12/07 12.236 kid1| DomainData.cc(131) match: aclMatchDomainList: checking 'ssl.gstatic.com'
2016/12/07 12.236 kid1| DomainData.cc(135) match: aclMatchDomainList: 'ssl.gstatic.com' NOT found
2016/12/07 12.236 kid1| Acl.cc(177) matches: checked: allowedsites = 0
2016/12/07 12.236 kid1| Acl.cc(177) matches: checked: http_access#10 = 0
2016/12/07 12.236 kid1| Acl.cc(157) matches: checking http_access#11
2016/12/07 12.236 kid1| Acl.cc(157) matches: checking RestrictedAccess
2016/12/07 12.236 kid1| Acl.cc(177) matches: checked: RestrictedAccess = 0
2016/12/07 12.236 kid1| Acl.cc(177) matches: checked: http_access#11 = 0
2016/12/07 12.237 kid1| Acl.cc(157) matches: checking http_access#12
2016/12/07 12.237 kid1| Acl.cc(157) matches: checking AnonymousAccess
2016/12/07 12.237 kid1| Acl.cc(177) matches: checked: AnonymousAccess = 0
2016/12/07 12.237 kid1| Acl.cc(177) matches: checked: http_access#12 = 0
2016/12/07 12.237 kid1| Acl.cc(157) matches: checking http_access#13
2016/12/07 12.237 kid1| Acl.cc(157) matches: checking FullAccess
2016/12/07 12.237 kid1| Acl.cc(177) matches: checked: FullAccess = 0
2016/12/07 12.237 kid1| Acl.cc(177) matches: checked: http_access#13 = 0
2016/12/07 12.237 kid1| Acl.cc(157) matches: checking http_access#14
2016/12/07 12.237 kid1| Acl.cc(157) matches: checking blockedsites
2016/12/07 12.237 kid1| DomainData.cc(131) match: aclMatchDomainList: checking 'ssl.gstatic.com'
2016/12/07 12.237 kid1| DomainData.cc(135) match: aclMatchDomainList: 'ssl.gstatic.com' NOT found
2016/12/07 12.238 kid1| Acl.cc(177) matches: checked: blockedsites = 0
2016/12/07 12.238 kid1| Acl.cc(177) matches: checked: http_access#14 = 0
2016/12/07 12.238 kid1| Acl.cc(157) matches: checking http_access#15
2016/12/07 12.238 kid1| Acl.cc(157) matches: checking StandardAccess
2016/12/07 12.238 kid1| Acl.cc(177) matches: checked: StandardAccess = 0
2016/12/07 12.238 kid1| Acl.cc(177) matches: checked: http_access#15 = 0
2016/12/07 12.238 kid1| Acl.cc(157) matches: checking http_access#16
2016/12/07 12.238 kid1| Acl.cc(157) matches: checking all
2016/12/07 12.238 kid1| Ip.cc(560) match: aclIpMatchIp: '172.17.224.101' found
2016/12/07 12.238 kid1| Acl.cc(177) matches: checked: all = 1
2016/12/07 12.238 kid1| Acl.cc(177) matches: checked: http_access#16 = 1
2016/12/07 12.238 kid1| InnerNode.cc(90) resumeMatchingAt: checked: http_access = 1
2016/12/07 12.238 kid1| Checklist.cc(55) markFinished: 0xb8fb11a0 answer DENIED for match
2016/12/07 12.238 kid1| Checklist.cc(155) checkCallback: ACLChecklist:: 0xb8fb11a0 answer=DENIED
2016/12/07 12.238 kid1| Gadgets.cc(103) aclIsProxyAuth: aclIsProxyAuth: called for all
2016/12/07 12.238 kid1| Gadgets.cc(108) aclIsProxyAuth: aclIsProxyAuth: returning 0
2016/12/07 12.238 kid1| FilledChecklist.cc(58) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0xbff3c754
2016/12/07 12.238 kid1| Checklist.cc(189) ~ACLChecklist: ACLChecklist::~ACLChecklist: destroyed 0xbff3c754
2016/12/07 12.238 kid1| FilledChecklist.cc(58) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0xbff3c754
2016/12/07 12.238 kid1| Checklist.cc(189) ~ACLChecklist: ACLChecklist::~ACLChecklist: destroyed 0xbff3c754
2016/12/07 12.239 kid1| store_client.cc(349) doCopy: store_client:: co: 0, hi: 2660
2016/12/07 12.239 kid1| AsyncCall.cc(18) AsyncCall: The AsyncCall clientWriteComplete constructed, this=0xb8cdfb18 
2016/12/07 12.239 kid1| FilledChecklist.cc(58) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0xb8fb11a0
2016/12/07 12.240 kid1| Checklist.cc(189) ~ACLChecklist: ACLChecklist::~ACLChecklist: destroyed 0xb8fb11a0
2016/12/07 12.240 kid1| AsyncCall.cc(85) ScheduleCall: IoCallback.cc(127) will call clientWriteComplete(local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1, data=0xb8fb34a0) 
2016/12/07 12.240 kid1| AsyncCallQueue.cc(51) fireNext: entering clientWriteComplete(local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1, data=0xb8fb34a0)
2016/12/07 12.240 kid1| AsyncCall.cc(30) make: make call clientWriteComplete 
2016/12/07 12.240 kid1| client_side.cc(1943) writeComplete: local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1, sz 2812, err 0, off 2812, len 2660
2016/12/07 12.240 kid1| client_side.cc(1964) writeComplete: local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1 Keeping Alive
2016/12/07 12.240 kid1| client_side.cc(1626) keepaliveNextRequest: ConnnStateData(local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1), Context(local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1)
2016/12/07 12.240 kid1| client_side_request.cc(267) ~ClientHttpRequest: httpRequestFree: ssl.gstatic.com
2016/12/07 12.240 kid1| Checklist.cc(62) preCheck: 0xbff3c774 checking fast ACLs
2016/12/07 12.240 kid1| Acl.cc(157) matches: checking access_log daemon:/var/log/squid3/access.log
2016/12/07 12.240 kid1| Acl.cc(157) matches: checking (access_log daemon:/var/log/squid3/access.log line)
2016/12/07 12.240 kid1| Acl.cc(157) matches: checking !AnonymousAccess
2016/12/07 12.241 kid1| Acl.cc(157) matches: checking AnonymousAccess
2016/12/07 12.241 kid1| Acl.cc(177) matches: checked: AnonymousAccess = 0
2016/12/07 12.241 kid1| Acl.cc(177) matches: checked: !AnonymousAccess = 1
2016/12/07 12.241 kid1| Acl.cc(177) matches: checked: (access_log daemon:/var/log/squid3/access.log line) = 1
2016/12/07 12.241 kid1| Acl.cc(177) matches: checked: access_log daemon:/var/log/squid3/access.log = 1
2016/12/07 12.241 kid1| Checklist.cc(55) markFinished: 0xbff3c774 answer ALLOWED for match
2016/12/07 12.241 kid1| FilledChecklist.cc(58) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0xbff3c774
2016/12/07 12.242 kid1| Checklist.cc(189) ~ACLChecklist: ACLChecklist::~ACLChecklist: destroyed 0xbff3c774
2016/12/07 12.242 kid1| client_side.cc(2998) clientParseRequests: local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1: attempting to parse
2016/12/07 12.242 kid1| client_side.cc(1696) keepaliveNextRequest: local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1: calling conn->readNextRequest()
2016/12/07 12.242 kid1| client_side.cc(1583) readNextRequest: local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1 reading next req
2016/12/07 12.242 kid1| AsyncCall.cc(18) AsyncCall: The AsyncCall ConnStateData: constructed, this=0xb8d2a628 
2016/12/07 12.242 kid1| client_side.cc(258) readSomeData: local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1: reading request...
2016/12/07 12.242 kid1| AsyncCall.cc(18) AsyncCall: The AsyncCall ConnStateData: constructed, this=0xb8ce51e0 
2016/12/07 12.242 kid1| AsyncCallQueue.cc(53) fireNext: leaving clientWriteComplete(local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1, data=0xb8fb34a0)
2016/12/07 12.254 kid1| AsyncCall.cc(85) ScheduleCall: IoCallback.cc(127) will call ConnStateData:(local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1, data=0xb8d2a558, size=0, buf=0xb8f544c8) 
2016/12/07 12.254 kid1| AsyncCallQueue.cc(51) fireNext: entering ConnStateData:(local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1, data=0xb8d2a558, size=0, buf=0xb8f544c8)
2016/12/07 12.254 kid1| AsyncCall.cc(30) make: make call ConnStateData: 
2016/12/07 12.254 kid1| AsyncJob.cc(117) callStart: ConnStateData status in: 
2016/12/07 12.254 kid1| client_side.cc(3059) clientReadRequest: local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1 size 0
2016/12/07 12.254 kid1| client_side.cc(3095) clientReadRequest: local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1 closed?
2016/12/07 12.254 kid1| client_side.cc(2492) connFinishedWithConn: local=172.17.16.94 remote=172.17.224.101 FD 10 flags=1 closed
2016/12/07 12.254 kid1| AsyncCall.cc(85) ScheduleCall: comm.cc(942) will call ConnStateData:(FD -1, data=0xb8d2a558) 
2016/12/07 12.254 kid1| AsyncJob.cc(146) callEnd: ConnStateData status out: 
2016/12/07 12.254 kid1| AsyncCallQueue.cc(53) fireNext: leaving ConnStateData:(local=172.17.16.94 remote=172.17.224.101 flags=1, data=0xb8d2a558, size=0, buf=0xb8f544c8)
2016/12/07 12.254 kid1| AsyncCallQueue.cc(51) fireNext: entering ConnStateData:(FD -1, data=0xb8d2a558)
2016/12/07 12.254 kid1| AsyncCall.cc(30) make: make call ConnStateData: 
2016/12/07 12.254 kid1| AsyncJob.cc(117) callStart: ConnStateData status in: 
2016/12/07 12.255 kid1| client_side.cc(864) swanSong: local=172.17.16.94 remote=172.17.224.101 flags=1
2016/12/07 12.255 kid1| client_side.cc(4661) unpinConnection: 
2016/12/07 12.255 kid1| client_side.cc(835) setAuth: WARNING: Graceful closure on local=172.17.16.94 remote=172.17.224.101 flags=1 due to connection-auth erase from ConnStateData: cleanup
2016/12/07 12.255 kid1| UserRequest.cc(121) ~UserRequest: freeing request 0xb8faab80
2016/12/07 12.255 kid1| client_side.cc(4426) stopReceiving: receiving error (local=172.17.16.94 remote=172.17.224.101 flags=1): connection-auth removed; old sending error: none
2016/12/07 12.255 kid1| client_side.cc(895) ~ConnStateData: local=172.17.16.94 remote=172.17.224.101 flags=1
2016/12/07 12.255 kid1| AsyncCallQueue.cc(53) fireNext: leaving ConnStateData:(FD -1, data=0xb8d2a558)
2016/12/07 12 kid1| Logfile: opening log stdio:/var/log/squid3/netdb.state
2016/12/07 12 kid1| Logfile: closing log stdio:/var/log/squid3/netdb.state
2016/12/07 12 kid1| NETDB state saved; 0 entries, 0 msec
2016/12/07 13.976 kid1| User.cc(216) cacheCleanup: Cleaning the user cache now
2016/12/07 13.976 kid1| User.cc(217) cacheCleanup: Current time: 1481098307
2016/12/07 13.977 kid1| User.cc(230) cacheCleanup: Cache entry:
	Type: 4
	Username: ushakov
	expires: 1481099721
	references: 2
2016/12/07 13.977 kid1| User.cc(230) cacheCleanup: Cache entry:
	Type: 2
	Username: ushakov
	expires: 1481099500
	references: 2
2016/12/07 13.977 kid1| User.cc(244) cacheCleanup: Finished cleaning the user cache.
2016/12/07 13 kid1| Logfile: opening log stdio:/var/log/squid3/netdb.state
2016/12/07 13 kid1| Logfile: closing log stdio:/var/log/squid3/netdb.state
2016/12/07 13 kid1| NETDB state saved; 0 entries, 0 msec
2016/12/07 14.978 kid1| User.cc(216) cacheCleanup: Cleaning the user cache now
2016/12/07 14.978 kid1| User.cc(217) cacheCleanup: Current time: 1481101907
2016/12/07 14.978 kid1| User.cc(230) cacheCleanup: Cache entry:
	Type: 4
	Username: ushakov
	expires: 1481099721
	references: 2
2016/12/07 14.978 kid1| User.cc(233) cacheCleanup: Removing user ushakov from cache due to timeout.
2016/12/07 14.979 kid1| User.cc(14) ~User: doing nothing to clear Negotiate scheme data for '0xb8fa4730'
2016/12/07 14.979 kid1| User.cc(157) ~User: Freeing auth_user '0xb8fa4730'.
2016/12/07 14.979 kid1| User.cc(230) cacheCleanup: Cache entry:
	Type: 2
	Username: ushakov
	expires: 1481099500
	references: 2
2016/12/07 14.979 kid1| User.cc(233) cacheCleanup: Removing user ushakov from cache due to timeout.
2016/12/07 14.979 kid1| User.cc(244) cacheCleanup: Finished cleaning the user cache.
2016/12/07 14.979 kid1| User.cc(14) ~User: doing nothing to clear NTLM scheme data for '0xb8bf70b8'
2016/12/07 14.979 kid1| User.cc(157) ~User: Freeing auth_user '0xb8bf70b8'.
2016/12/07 14 kid1| Logfile: opening log stdio:/var/log/squid3/netdb.state
2016/12/07 14 kid1| Logfile: closing log stdio:/var/log/squid3/netdb.state
2016/12/07 14 kid1| NETDB state saved; 0 entries, 0 msec
2016/12/07 15.980 kid1| User.cc(216) cacheCleanup: Cleaning the user cache now
2016/12/07 15.980 kid1| User.cc(217) cacheCleanup: Current time: 1481105507
2016/12/07 15.980 kid1| User.cc(244) cacheCleanup: Finished cleaning the user cache.
2016/12/07 15 kid1| Logfile: opening log stdio:/var/log/squid3/netdb.state
2016/12/07 15 kid1| Logfile: closing log stdio:/var/log/squid3/netdb.state
2016/12/07 15 kid1| NETDB state saved; 0 entries, 0 msec

fincherling

Нашел ошибку: не правильно был указан путь к группа поменял на:

# LDAP authorization

external_acl_type memberof ttl=3600 ipv4 %LOGIN /usr/lib/squid3/ext_ldap_group_acl -v 3 -P -R -K -b "dc=ekt,dc=mbrd,dc=ru" -D squid3@ekt.mbrd.ru -W /etc/squid3/conf_param_ldappass.txt -f "(&(objectclass=person)(sAMAccountName=%v)(memberOf.2.840.113556.1.4.1941:=cn=%g,OU=EKT,OU=Groups,OU=Security Groups,DC=ekt,DC=mbrd,DC=ru))" -h ekt-dc1.ekt.mbrd.ru

Но после изменения все ровно в интернет не пускает.

fincherling

Прошу помощи!

Алексей Максимов

Первое, что вижу:

acl localnet src 172.17.0.0/24 # RFC1918 possible internal network

2016/12/07 12.197 kid1| Ip.cc(560) match: aclIpMatchIp: '172.17.224.101' NOT found

2016/12/07 12.197 kid1| Acl.cc(177) matches: checked: localnet = 0

Дальше, наверно, и смысла смотреть нету.

fincherling

Исправил сети

acl localnet src 172.17.16.0/24 # RFC1918 possible internal network

acl localnet src 172.17.244.0/24 # RFC1918 possible internal network

Подскажите пожалуйста не совсем понятно почему появляется эта ошибка ?

2016/12/07 12.197 kid1| Ip.cc(560) match: aclIpMatchIp: '172.17.224.101' NOT found

2016/12/07 12.197 kid1| Acl.cc(177) matches: checked: localnet = 0

Алексей Максимов

Потому что 172.17.224.101 это адрес не входящий в сеть 172.17.0.0/24

Попробуйте использовать более широкие сети, в которые входят ваши клиенты, например 172.16.0.0/12

fincherling

Изменил подсеть на

acl localnet src 172.0.0.0/8 # RFC1918 possible internal network

перезапустил сервер выходят теже саые ошибки

2016/12/08 13.648 kid1| Acl.cc(157) matches: checking localhost

2016/12/08 13.648 kid1| Ip.cc(560) match: aclIpMatchIp: '172.17.224.101' NOT found

2016/12/08 13.648 kid1| Acl.cc(177) matches: checked: localhost = 0

2016/12/08 13.648 kid1| Acl.cc(177) matches: checked: http_access#3 = 0

2016/12/08 13.649 kid1| Acl.cc(157) matches: checking http_access#4

2016/12/08 13.649 kid1| Acl.cc(157) matches: checking localnet

2016/12/08 13.649 kid1| Ip.cc(560) match: aclIpMatchIp: '172.17.224.101' found

fincherling

подскажите куда копать, могу прислать полный лог. :

Алексей Максимов

Можете вложить в виде вложения здесь, чтобы вся фактура проблемы была в одном месте.

fincherling

Прикрепил лог сквида.

https://drive.google.com/open?id=0B4OidcJ-Cd1FemliaGVlS3ZNRVU

fincherling

Самое забавное что я развернул дома debian настроил по этой же инструкции и у меня те же самые ошибки, подскажите пожалуйста где в конфигурации squid я ошибся ?

Алексей Максимов

fincherling написал
Изменил подсеть на

acl localnet src 172.0.0.0/8 # RFC1918 possible internal network

перезапустил сервер выходят теже саые ошибки

2016/12/08 13.648 kid1| Acl.cc(157) matches: checking localhost

2016/12/08 13.648 kid1| Ip.cc(560) match: aclIpMatchIp: '172.17.224.101' NOT found

2016/12/08 13.648 kid1| Acl.cc(177) matches: checked: localhost = 0

2016/12/08 13.648 kid1| Acl.cc(177) matches: checked: http_access#3 = 0

2016/12/08 13.649 kid1| Acl.cc(157) matches: checking http_access#4

2016/12/08 13.649 kid1| Acl.cc(157) matches: checking localnet

2016/12/08 13.649 kid1| Ip.cc(560) match: aclIpMatchIp: '172.17.224.101' found

На самом деле это никакие не ошибки. В первом случае squid проверяет, подпадает ли адрес клиента под ACL "localhost" и совершенно справедливо говорит, что не подпадает. Во тором случае squid проверяет, подпадает ли адрес клиента под ACL "localnet" и также справедливо говорит, что подпадает. Здесь всё совершенно штатно. Проблема в чём-то другом. Из выложенной портянки ничего не углядел.

Нужно.

1) squid.conf

2) access.log (НЕ ВЕСЬ и не за 300 лет, а только на момент воспроизведения проблемы)

3) cache.log (на момент воспроизведения проблемы)

Логи пока в обычном режиме (без тонн дебага) .

Вообще здесь в форуме про Squid уже неоднократно обсуждался порядок отладки и отлова проблем. Читайте другие ветки. Сначала отключаете всю авторизацию и проверяете работает ли без авторизации доступ. Если работает, то включаете по одному хелперы аутентификации - сначала только basic и т.д.

fincherling

Добрый день,

По поводу:

016/12/08 13.648 kid1| Ip.cc(560) match: aclIpMatchIp: '172.17.224.101' NOT found

2016/12/08 13.648 kid1| Acl.cc(177) matches: checked: localhost = 0

2016/12/08 13.648 kid1| Acl.cc(177) matches: checked: http_access#3 = 0

2016/12/08 13.649 kid1| Acl.cc(157) matches: checking http_access#4

2016/12/08 13.649 kid1| Acl.cc(157) matches: checking localnet

2016/12/08 13.649 kid1| Ip.cc(560) match: aclIpMatchIp: '172.17.224.101' found

С этим я тоже разобрался и выяснил что это не ошибка а просто поиск по acl

На домашней виртуальной машине мне удалось решить проблему которая была в следующем:

В 95% инструкций путь к группам и юзерам указывается ou=,ou,dc=,=dc=, но в остальных 5% указывается в последней директории CN, почитав понял что указывая CN ты подразумеваешь наличие объектов в конечном каталоге.

Дак вот я заменил у конечных каталогов с ou на cn и все заработало , думал что придя на работе проделаю не сложную манипуляцию и будет счастье, но это ситуацию не спасло squid писал "нет доступа" решил воспользоватся вашим советом и отключить все хелперы да и в принципе половину конфигурации которая будет выложена ниже, но по мне не понятной причине squid в интернет не пускает пока не пропишешь http_access allow all , хотя в localnet подсесть указана и ниже предоставлен ей доступ

http://dropmefiles.com/H2E7Z

Алексей Максимов

Вложенный конфг squid, если это вообще так можно назвать, результата никакого не даст.

Самые основные правила http_access закомментированы, acl "localnet" не определён, в acl "localhost" вообще чепуха написана, хотя в данном случае это не критично.

Вы хотите, чтобы такая конфигурация работала?

fincherling

Заработало вот с такой конфигурацией когда я повторно указал ниже http_access allow localnet

# Аllow cachemgr access from localhost and localnet

http_access allow localnet manager

http_access deny manager

# Allow direct access to Windows Update

http_access allow GlobalWUSites LocalWUServers

# Allow unrestricted access to prioritysites

http_access allow prioritysites localnet

# Enforce authentication, order of rules is important for authorization levels

http_access deny !auth

# Prevent access to basic auth prompt for BlockedAccess users

http_access deny BlockedAccess all

http_access allow allowedsites localnet

http_access deny RestrictedAccess all

http_access allow AnonymousAccess auth localnet

http_access allow FullAccess auth localnet

http_access deny blockedsites

http_access allow StandardAccess auth localnet

http_access allow localnet

Подскажите почему именно так ? Ведь у вас в инструкции повторно acl не объявляется, да и я дома не делал.

fincherling

Разобрался если прописать localnet как я прописывал выше то пускает просто по диапазону IP

Может ли эта проблема в общем быть из за того что по умолчанию в линукс привязывается не правильный принципал ?

Default principal: administrator@EKT.MBRD.RU

А должен быть Default principal: conductor@EKT.MBRD.RU в ключе прописан тоже conductor

klist

Default principal: administrator@EKT.MBRD.RU

Valid starting Expires Service principal

12.12.2016 13 12.12.2016 23 krbtgt/EKT.MBRD.RU@EKT.MBRD.RU

renew until 12.12.2016 23

Если может из за этого , то как его отвязать ?

fincherling

Включив дебаг по хелперам удалось найти лог в котором описана процедура сопоставления логина и группы , но по какой то причине squid пишет что доступ запрещен.

Это может быть из за ключа ?

2016/12/13 12.159 kid1| external_acl.cc(1518) Start: externalAclLookup: will wait for the result of 'ushakov Internet_IT_ekt' in 'memberof' (ch=0xb8054158).

2016/12/13 12.159 kid1| external_acl.cc(874) aclMatchExternal: "ushakov Internet_IT_ekt": return -1.

2016/12/13 12.159 kid1| Acl.cc(177) matches: checked: StandardAccess = -1 async

2016/12/13 12.159 kid1| Acl.cc(177) matches: checked: http_access#14 = -1 async

2016/12/13 12.159 kid1| InnerNode.cc(90) resumeMatchingAt: checked: http_access = -1 async

2016/12/13 12.159 kid1| cbdata.cc(348) cbdataInternalFree: cbdataFree: 0xb81a7240

2016/12/13 12.159 kid1| cbdata.cc(365) cbdataInternalFree: cbdataFree: Freeing 0xb81a7240

2016/12/13 12.159 kid1| helper.cc(1208) GetFirstAvailable: GetFirstAvailable: Running servers 5

2016/12/13 12.159 kid1| cbdata.cc(419) cbdataInternalLock: cbdataLock: 0xb803dac8=3

2016/12/13 12.159 kid1| cbdata.cc(419) cbdataInternalLock: cbdataLock: 0xb803dac8=4

2016/12/13 12.159 kid1| AsyncCall.cc(18) AsyncCall: The AsyncCall helperHandleRead constructed, this=0xb8421278

2016/12/13 12.159 kid1| cbdata.cc(419) cbdataInternalLock: cbdataLock: 0xb803dac8=5

2016/12/13 12.159 kid1| cbdata.cc(456) cbdataInternalUnlock: cbdataUnlock: 0xb803dac8=4

2016/12/13 12.159 kid1| cbdata.cc(456) cbdataInternalUnlock: cbdataUnlock: 0xb803dac8=3

2016/12/13 12.159 kid1| comm.cc(167) comm_read: comm_read, queueing read for local= remote= FD 154 flags=1; asynCall 0xb8421278*1

2016/12/13 12.159 kid1| ModEpoll.cc(139) SetSelect: FD 154, type=1, handler=1, client_data=0xb4ea5294, timeout=0

2016/12/13 12.160 kid1| AsyncCallQueue.cc(53) fireNext: leaving helperHandleRead(local= remote= FD 154 flags=1, data=0xb803dac8, size=5, buf=0xb8032598)

2016/12/13 12.160 kid1| cbdata.cc(456) cbdataInternalUnlock: cbdataUnlock: 0xb803dac8=2

2016/12/13 12.160 kid1| EventLoop.cc(61) checkEngine: Engine 0xbffb5f10 is idle.

2016/12/13 12.160 kid1| EventLoop.cc(61) checkEngine: Engine 0xbffb5ef8 is idle.

2016/12/13 12.160 kid1| ModEpoll.cc(290) DoSelect: got FD 152 events=4 monitoring=1d F->read_handler=1 F->write_handler=1

2016/12/13 12.160 kid1| ModEpoll.cc(312) DoSelect: Calling write handler on FD 152

2016/12/13 12.160 kid1| Write.cc(60) HandleWrite: local= remote= FD 152 flags=1: off 0, sz 24.

2016/12/13 12.160 kid1| Write.cc(100) HandleWrite: write() returns 24

2016/12/13 12.160 kid1| IoCallback.cc(108) finish: called for local= remote= FD 152 flags=1 (0, 0)

2016/12/13 12.160 kid1| AsyncCall.cc(85) ScheduleCall: IoCallback.cc(127) will call helperDispatchWriteDone(local= remote= FD 152 flags=1, data=0xb803c738, size=24, buf=0xb8417458)

2016/12/13 12.160 kid1| AsyncCallQueue.cc(51) fireNext: entering helperDispatchWriteDone(local= remote= FD 152 flags=1, data=0xb803c738, size=24, buf=0xb8417458)

2016/12/13 12.160 kid1| AsyncCall.cc(30) make: make call helperDispatchWriteDone

2016/12/13 12.160 kid1| cbdata.cc(510) cbdataReferenceValid: cbdataReferenceValid: 0xb803c738

2016/12/13 12.160 kid1| cbdata.cc(348) cbdataInternalFree: cbdataFree: 0xb840c678

2016/12/13 12.160 kid1| cbdata.cc(365) cbdataInternalFree: cbdataFree: Freeing 0xb840c678

2016/12/13 12.160 kid1| AsyncCallQueue.cc(53) fireNext: leaving helperDispatchWriteDone(local= remote= FD 152 flags=1, data=0xb803c738, size=24, buf=0xb8417458)

2016/12/13 12.160 kid1| cbdata.cc(456) cbdataInternalUnlock: cbdataUnlock: 0xb803c738=2

2016/12/13 12.160 kid1| EventLoop.cc(61) checkEngine: Engine 0xbffb5f10 is idle.

2016/12/13 12.160 kid1| EventLoop.cc(61) checkEngine: Engine 0xbffb5ef8 is idle.

2016/12/13 12.161 kid1| ModEpoll.cc(290) DoSelect: got FD 152 events=4 monitoring=1d F->read_handler=1 F->write_handler=0

2016/12/13 12.161 kid1| ModEpoll.cc(319) DoSelect: no write handler for FD 152

2016/12/13 12.161 kid1| ModEpoll.cc(139) SetSelect: FD 152, type=2, handler=0, client_data=0, timeout=0

2016/12/13 12.161 kid1| EventLoop.cc(61) checkEngine: Engine 0xbffb5f10 is idle.

2016/12/13 12.161 kid1| EventLoop.cc(61) checkEngine: Engine 0xbffb5ef8 is idle.

2016/12/13 12.163 kid1| ModEpoll.cc(290) DoSelect: got FD 152 events=1 monitoring=19 F->read_handler=1 F->write_handler=0

2016/12/13 12.164 kid1| ModEpoll.cc(296) DoSelect: Calling read handler on FD 152

2016/12/13 12.164 kid1| comm.cc(138) commHandleRead: comm_read_try: FD 152, size 4095, retval 5, errno 0

2016/12/13 12.164 kid1| IoCallback.cc(108) finish: called for local= remote= FD 152 flags=1 (0, 0)

2016/12/13 12.164 kid1| AsyncCall.cc(85) ScheduleCall: IoCallback.cc(127) will call helperHandleRead(local= remote= FD 152 flags=1, data=0xb803c738, size=5, buf=0xb83b6618)

2016/12/13 12.164 kid1| AsyncCallQueue.cc(51) fireNext: entering helperHandleRead(local= remote= FD 152 flags=1, data=0xb803c738, size=5, buf=0xb83b6618)

2016/12/13 12.164 kid1| AsyncCall.cc(30) make: make call helperHandleRead

2016/12/13 12.164 kid1| cbdata.cc(510) cbdataReferenceValid: cbdataReferenceValid: 0xb803c738

2016/12/13 12.164 kid1| helper.cc(906) helperHandleRead: helperHandleRead: 5 bytes from memberof #Hlpr0

2016/12/13 12.164 kid1| helper.cc(915) helperHandleRead: accumulated=ERR

2016/12/13 12.164 kid1| helper.cc(932) helperHandleRead: helperHandleRead: end of reply found

2016/12/13 12.164 kid1| cbdata.cc(510) cbdataReferenceValid: cbdataReferenceValid: 0xb84094f8

2016/12/13 12.164 kid1| cbdata.cc(456) cbdataInternalUnlock: cbdataUnlock: 0xb84094f8=0

2016/12/13 12.164 kid1| HelperReply.cc(23) parse: Parsing helper buffer

2016/12/13 12.164 kid1| HelperReply.cc(42) parse: Buff length is larger than 2

2016/12/13 12.164 kid1| HelperReply.cc(50) parse: helper Result = ERR

2016/12/13 12.164 kid1| external_acl.cc(1375) externalAclHandleReply: reply={result=ERR}

2016/12/13 12.164 kid1| cbdata.cc(510) cbdataReferenceValid: cbdataReferenceValid: 0xb7fc5228

2016/12/13 12.164 kid1| external_acl.cc(1290) external_acl_cache_add: external_acl_cache_add: Adding 'ushakov Internet_IT_ekt' = DENIED

2016/12/13 12.164 kid1| external_acl.cc(1293) external_acl_cache_add: updating existing entry

2016/12/13 12.164 kid1| cbdata.cc(456) cbdataInternalUnlock: cbdataUnlock: 0xb7fc5228=5

2016/12/13 12.164 kid1| cbdata.cc(510) cbdataReferenceValid: cbdataReferenceValid: 0xb8054158

2016/12/13 12.164 kid1| cbdata.cc(456) cbdataInternalUnlock: cbdataUnlock: 0xb8054158=0

2016/12/13 12.164 kid1| cbdata.cc(510) cbdataReferenceValid: cbdataReferenceValid: 0xb7fee600

2016/12/13 12.164 kid1| cbdata.cc(510) cbdataReferenceValid: cbdataReferenceValid: 0xb7fc6dc8

2016/12/13 12.164 kid1| InnerNode.cc(87) resumeMatchingAt: checking http_access at 13

2016/12/13 12.164 kid1| InnerNode.cc(87) resumeMatchingAt: checking http_access#14 at 0

2016/12/13 12.164 kid1| Acl.cc(157) matches: checking StandardAccess

2016/12/13 12.164 kid1| external_acl.cc(805) aclMatchExternal: acl="memberof"

2016/12/13 12.164 kid1| external_acl.cc(896) aclMatchExternal: entry = { date=1481614629, result=DENIED tag= log= }

Алексей Максимов

Почитайте этот топик https://forum.it-kb.ru/viewtopic.php?f=52&t=70

fincherling

squid -k check -- ошибок нет

А вот при запросе ошибка.. побывал с OU менять на CN

/usr/lib/squid3/ext_ldap_group_acl -d -v 3 -P -R -K -b "dc=ekt,dc=mbrd,dc=ru" -D squid3@ekt.mbrd.ru -W /etc/squid3/conf_param_ldappass.txt -f "(&(objectclass=person)(sAMAccountName=%v)(memberOf.2.840.113556.1.4.1941:=cn=%g,OU=EKT,OU=Groups,OU=Security Groups,DC=ekt,DC=mbrd,DC=ru))" -h ekt-dc1.ekt.mbrd.ru

ext_ldap_group_acl.cc(583): pid=31596 OK

ext_ldap_group_acl.cc(722): pid=31596 filter '(&(objectclass=person)(sAMAccountName=ushakov)(memberOf.2.840.113556.1.4.1941:=cn=internet_IT_ekt,OU=EKT,OU=Groups,OU=Security Groups,DC=ekt,DC=mbrd,DC=ru))', searchbase 'dc=ekt,dc=mbrd,dc=ru'

ERR

fincherling

Изменил путь к группам на оборот, Все получилось.. странно... но когда забил такой вариант в сквид ничего не поменялось.

/usr/lib/squid3/ext_ldap_group_acl -d -v 3 -P -R -K -b "dc=ekt,dc=mbrd,dc=ru" -D squid3@ekt.mbrd.ru -W /etc/squid3/conf_param_ldappass.txt -f "(&(objectclass=person)(sAMAccountName=%v)(memberOf.2.840.113556.1.4.1941:=cn=%g,OU=Security Groups,OU=Groups,OU=EKT,DC=ekt,DC=mbrd,DC=ru))" -h ekt-dc1.ekt.mbrd.ru

ushakov internet_IT_ekt

ext_ldap_group_acl.cc(583): pid=8202 OK

ext_ldap_group_acl.cc(722): pid=8202 filter '(&(objectclass=person)(sAMAccountName=ushakov)(memberOf.2.840.113556.1.4.1941:=cn=internet_IT_ekt,OU=Security Groups,OU=Groups,OU=EKT,DC=ekt,DC=mbrd,DC=ru))', searchbase 'dc=ekt,dc=mbrd,dc=ru'

Следующая страница »