On 11/09/2013 4:59 a.m., Gomes, Rich wrote:
Hi Eliezer,
Yes, it is firewalled off.
I tried matching the lines in the old to the corresponding new config with no luck.
I copied back the original squid.conf from the EL6 install and added just the lines you mentioned below with the same results
503 and 404 errors
Are you able to try the 3.3 package and see if the issues persist?
http://wiki.squid-cache.org/KnowledgeBase/RedHat. It has a lot more
upgrade support for 2.x versions built in than the 3.1 series does.
Dont forget to run "squid -k parse" to check the config is accepted by
Squid before other testing.
The 503 issues would seem to be something outside of Squid blocking
Squid from contacting the requested server. Perhapse DNS issues or bad
firewall or router configurations.
Squid does not produce 404 IIRC.
Squid only produces 404 responses on DNS failure, invalid URLs, or
requests for Squid-generated objects which do not exist.
Amos
Rich
Rich Gomes | Senior Systems Administrator, AUCA System Services | ARAMARK Uniform & Career Apparel
Tel: 781.763.4508 | Fax: 781.763.2508
Rich.Gomes@xxxxxxxxxxxxxxxxxxx | www.aramark-uniform.com
-----Original Message-----
From: Eliezer Croitoru [mailto:eliezer@xxxxxxxxxxxx]
Sent: Tuesday, September 10, 2013 12:49 PM
To: squid-users@xxxxxxxxxxxxxxx
Subject: Re: Changes to config file issues
Hey there,
From the squid.conf it seems like a basic squid server config which allows all and any user in the world to use the proxy hence it is recommended to firewall it and even if it's under nat restrict the access to the server.
I do not know exactly how the squid.conf that comes from with EL6 looks like now but I would recommend you to use it and add\change the needed lines.
I would recommend to use a newer version of squid like 3.2.X or 3.3.X but it's up to you..(and since you are testing..).
add the following settings to the squid.conf.default that comes with 3.1.10
http_access allow all
http_port 8021
The above lines are the only needed additions commpared to the old squid.conf file.
If you will need some more help just ask and dont forget to respond to the mail with the results.
Eliezer
On 09/10/2013 07:24 PM, Gomes, Rich wrote:
We had Squid 2.6.Stable21 running on an EL 5 server. Due to some new
requirements we needed to build a new server with EL6. This came with
Squid 3.1.10
Copying the old config file to the new server hasn't worked. We have had to comment out some lines which the new version no longer supports.
Squid is now able to start but every time we try to connect to an external host we receive TCP_MISS/503 and TCP_MISS/404 errors in the access log.
Here is the config from the EL5 server.
What need to be corrected to get this to work as before?
NOTE: We can switch to the EL5 server and connect without issue so it
is clearly an issue with the upgrade from 2.6.x to 3.1.x
#Recommended minimum configuration:
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst
127.0.0.0/8 acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access allow all
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access deny all
icp_access allow all
http_port 8021
hierarchy_stoplist cgi-bin ?
access_log /var/log/squid/access.log squid
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
coredump_dir /var/spool/squid
Thanks in advance
Rich Gomes | Senior Systems Administrator, AUCA System Services |
ARAMARK Uniform & Career Apparel
Tel: 781.763.4508 | Fax: 781.763.2508 Rich.Gomes@xxxxxxxxxxxxxxxxxxx
| www.aramark-uniform.com
