Squid 3.3.3 + SSL - erro para iniciar

diogospace
(usa Debian)

Enviado em 26/05/2017 - 16:11h

Ola Pessoal tudo bem?

Seguinte: Estou tentando fazer o squid subir, realizei a instalação pelo procedimento do link

https://www.vivaolinux.com.br/artigo/Compilacao-do-Squid-3-no-Debian-Wheezy?pagina=2 

Porém estou com dificuldade para fazer iniciar.

Segue abaixo meu squid.conf

#

# Recommended minimum configuration:

#



# Squid normally listens to port 3128

http_port 3128 intercept

https_port 3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/monkey.pem

#ssl_bump none localhost

#ssl_bump server-first all

#sslcrtd_program /lib/squid/ssl_crtd -s /etc/squid/ssl_cert/ssl_db -M 4 MB

#sslcrtd_children 5

#

#cert=/etc/squid/openssl.crt key=/etc/squid/openssl.key

#cert=/etc/squid/controler.crt key=/etc/squid/controler.Key ssl-bump intercept ignore-cc generate-host-certificates=on version=1 options=NO_SSLv2,NO_SSLv3



########################### Caminhos dos Logs ######################

access_log /var/log/squid/access.log squid

cache_log /var/log/squid/cache.log



######################## Tamanhos das Cache ########################

cache_dir ufs /var/cache/squid 2048 128 512

cache_swap_low 90

cache_swap_high 95



# Add any of your own refresh_pattern entries above these.

refresh_pattern ^ftp:           1440    20%     10080

refresh_pattern ^gopher:        1440    0%      1440

refresh_pattern -i (/cgi-bin/|\?) 0     0%      0

refresh_pattern .               0       20%     4320



visible_hostname Proxy-Controler



# Example rule allowing access from your local networks.

# Adapt to list your (internal) IP networks from where browsing

# should be allowed

#acl localnet src 10.0.0.0/8    # RFC1918 possible internal network

#acl localnet src 172.16.0.0/12 # RFC1918 possible internal network

#acl localnet src 192.168.0.0/16        # RFC1918 possible internal network

#acl localnet src 10.20.30.0/24 # RFC1918 possible internal network

#acl localnet src fc00::/7       # RFC 4193 local private network range

#acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines



#acl all src 0.0.0.0/0.0.0.0

#acl manager proto cache_object

#acl localhost src 127.0.0.1/24

acl localnet src 10.20.30.0/24

#acl localnet src 172.16.0.0/12

#acl localnet src 192.168.11.0/24



acl SSL_ports port 443

acl Safe_ports port 80          # http

acl Safe_ports port 21          # ftp

acl Safe_ports port 443         # https

acl Safe_ports port 70          # gopher

acl Safe_ports port 210         # wais

acl Safe_ports port 1025-65535  # unregistered ports

acl Safe_ports port 280         # http-mgmt

acl Safe_ports port 488         # gss-http

acl Safe_ports port 591         # filemaker

acl Safe_ports port 777         # multiling http

acl CONNECT method CONNECT



#

# Recommended minimum Access Permission configuration:

#

# Only allow cachemgr access from localhost

http_access allow localhost manager

http_access deny manager



# Deny requests to certain unsafe ports

http_access deny !Safe_ports



# Deny CONNECT to other than secure SSL ports

http_access deny CONNECT !SSL_ports





acl redes url_regex -i "/etc/squid/listas/redes.dat"

acl black_list url_regex -i "/etc/squid/listas/lista-negra.dat"

acl white_list url_regex -i "/etc/squid/listas/lista-branca.dat"

acl Controler url_regex -i "/etc/squid/listas/controler.dat"

acl sem_acesso src "/etc/squid/listas/sem_acesso.dat"

#acl FullAccess src "/etc/squid/listas/fullaccess.txt"

acl 24horas src "/etc/squid/listas/24horas.dat"



http_access allow sem_acesso Controler

#http_access allow FullAccess

http_access allow white_list

http_access deny  redes

http_access deny  black_list

http_access allow 24horas

http_access deny sem_acesso





# We strongly recommend the following be uncommented to protect innocent

# web applications running on the proxy server who think the only

# one who can access services on "localhost" is a local user

#http_access deny to_localhost



#

# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS

#



# Example rule allowing access from your local networks.

# Adapt localnet in the ACL section to list your (internal) IP networks

# from where browsing should be allowed

#http_access allow localnet

#http_access allow localhost

#

# And finally deny all other access to this proxy

#http_access deny all

#





# Uncomment and adjust the following to add a disk cache directory.

#cache_dir ufs /var/cache/squid 100 16 256





# Leave coredumps in the first cache dir

#coredump_dir /var/cache/squid





# Example rule allowing access from your local networks.

# Adapt localnet in the ACL section to list your (internal) IP networks

# from where browsing should be allowed

http_access allow localnet

http_access allow localhost



# And finally deny all other access to this proxy

http_access deny all

 

meu squid -NCd9

2017/05/26 16:10:41| Starting Squid Cache version 3.3.3 for i686-pc-linux-gnu...

2017/05/26 16:10:41| Process ID 1247

2017/05/26 16:10:41| Process Roles: master worker

2017/05/26 16:10:41| With 65536 file descriptors available

2017/05/26 16:10:41| Initializing IP Cache...

2017/05/26 16:10:41| DNS Socket created at [::], FD 5

2017/05/26 16:10:41| DNS Socket created at 0.0.0.0, FD 6

2017/05/26 16:10:41| Adding domain corpnet.sao from /etc/resolv.conf

2017/05/26 16:10:41| Adding domain corpnet.sao from /etc/resolv.conf

2017/05/26 16:10:41| Adding nameserver 10.20.30.254 from /etc/resolv.conf

2017/05/26 16:10:41| Adding nameserver 8.8.8.8 from /etc/resolv.conf

2017/05/26 16:10:41| /var/lib/ssl_db: (2) No such file or directory

2017/05/26 16:10:41| helperOpenServers: Starting 5/32 'ssl_crtd' processes

2017/05/26 16:10:41| Logfile: opening log /var/log/squid/access.log

2017/05/26 16:10:41| WARNING: log parameters now start with a module name. Use 'stdio:/var/log/squid/access.log'

2017/05/26 16:10:41| Unlinkd pipe opened on FD 21

2017/05/26 16:10:41| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec

2017/05/26 16:10:41| Store logging disabled

2017/05/26 16:10:41| Swap maxSize 2097152 + 262144 KB, estimated 181484 objects

2017/05/26 16:10:41| Target number of buckets: 9074

2017/05/26 16:10:41| Using 16384 Store buckets

2017/05/26 16:10:41| Max Mem  size: 262144 KB

2017/05/26 16:10:41| Max Swap size: 2097152 KB

2017/05/26 16:10:41| Rebuilding storage in /var/cache/squid (no log)

2017/05/26 16:10:41| Using Least Load store dir selection

2017/05/26 16:10:41| Current Directory is /etc/squid

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| ERROR: No forward-proxy ports configured.

2017/05/26 16:10:41| Loaded Icons.

2017/05/26 16:10:41| WARNING: No ssl_bump configured. Disabling ssl-bump on https_port 0.0.0.0:3129

2017/05/26 16:10:41| HTCP Disabled.

2017/05/26 16:10:41| Squid plugin modules loaded: 0

2017/05/26 16:10:41| Accepting NAT intercepted HTTP Socket connections at local=0.0.0.0:3128 remote=[::] FD 23 flags=41

2017/05/26 16:10:41| Accepting NAT intercepted HTTPS Socket connections at local=0.0.0.0:3129 remote=[::] FD 24 flags=41

2017/05/26 16:10:41| WARNING: ssl_crtd #1 exited

2017/05/26 16:10:41| Too few ssl_crtd processes are running (need 1/32)

2017/05/26 16:10:41| Closing HTTP port 0.0.0.0:3128

2017/05/26 16:10:41| Closing HTTPS port 0.0.0.0:3129

FATAL: The ssl_crtd helpers are crashing too rapidly, need help!

 

Por gentileza me ajudem

diogospace
(usa Debian)

Enviado em 29/05/2017 - 08:38h

Alguem para me dar uma luz ?

Buckminster
(usa Debian)

Enviado em 29/05/2017 - 08:57h

Posta aqui a parte do script do Iptables que trata do redirecionamento das portas do Squid.

http://wiki.squid-cache.org/KnowledgeBase/NoForwardProxyPorts

diogospace
(usa Debian)

Enviado em 29/05/2017 - 10:00h

root@Debian:/usr/local/squid/etc# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
REDIRECT tcp -- anywhere anywhere tcp dpt:http redir ports 3128
REDIRECT tcp -- anywhere anywhere tcp dpt:https redir ports 3128

Buckminster
(usa Debian)

Enviado em 29/05/2017 - 10:02h

Ok, isso que você postou é a saída do comando aí.

Posta aqui o conteúdo do teu script do Iptables.

diogospace
(usa Debian)

Enviado em 29/05/2017 - 17:30h

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

Buckminster
(usa Debian)

Enviado em 30/05/2017 - 10:01h

Deixe assim teu Iptables:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -t nat -A POSTROUTING -o ethx -j MASQUERADE # aqui vai a placa de rede de entrada da internet.
iptables -t nat -A PREROUTING -i ethx -p tcp --dport 80 -j REDIRECT --to-port 3128 # aqui vai a placa que sai para a tua rede interna.
iptables -t nat -A PREROUTING -i ethx -p tcp --dport 443 -j REDIRECT --to-port 3129 # aqui vai a placa que sai para a tua rede interna, a mesma da regra acima.

Faça as alterações, reinicie o Iptables e o Squid e teste.

Mas veja bem, esse é um script de Iptables básico e limitado, depois tu tem que dar uma melhorada nele, acrescentando teus bloqueios e liberações.
As políticas padrões estão como DROP para as chains INPUT e FORWARD e ACCEPT para a OUTPUT.
Caso, no teste, você não consiga navegar, altere as políticas padrões INPUT e FORWARD para ACCEPT e teste novamente.

https://www.vivaolinux.com.br/artigo/Manual-do-IPtables-Comentarios-e-sugestoes-de-regras/

diogospace
(usa Debian)

Enviado em 31/05/2017 - 17:08h

obrigado, farei e retornarei