I've seen a February thread about this problem, but it seems that it
never reached a consensus.
I've just tried to migrate from 3.3.12 to 3.4.6, but almost instantly
got timeout problems and 100% cpu usage by squid process.
I'm using kerberos auth and external_ldap_group helpers, ssl bump,
config will be attached below.
Any caching (memory or on-disk) is disabled during compile-time:
./configure \
--prefix=/opt/squid \
--sysconfdir=/etc/squid \
--disable-loadable-modules \
--disable-wccp \
--disable-wccpv2 \
--disable-eui \
--disable-htcp \
--disable-select \
--disable-poll \
--with-pthreads \
--disable-storeio \
--disable-disk-io \
--disable-removal-policies \
--enable-delay-pools \
--disable-useragent-log \
--disable-referer-log \
--enable-ssl \
--enable-ssl-crtd \
--disable-cache-digests \
--enable-icap-client \
--disable-snmp \
--disable-ident-lookups \
--enable-auth \
--enable-auth-basic="LDAP,PAM" \
--enable-auth-ntlm="smb_lm" \
--enable-auth-negotiate="kerberos" \
--enable-auth-digest="LDAP,file" \
--enable-external-acl-helpers="LDAP_group" \
--enable-zph-qos \
--with-openssl \
--disable-ipv6
Any ideas? Thanks in advance
debug_options ALL,1 rotate=1
logfile_rotate 0
cache_mgr admin@xxxxxxxxx
visible_hostname squid.domain.ru
http_port 10.1.16.19:3128 ssl-bump generate-host-certificates=on
dynamic_cert_mem_cache_size=64MB
cert=/etc/squid/ssl/ca-squid.domain.ru.pem options=NO_SSLv2,NO_SSLv3
dhparams=/etc/squid/ssl/dh2048.pem
cipher=ECDH+AESGCM:DH+AESGCM:ECDH+AES:DH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
cache_effective_user squid
cache_effective_group squid
# ICAP ACL
acl icap_whitelisted dstdomain
"/etc/squid/lists/icap_domains_whitelisted.txt"
# ICAP scanning
icap_enable on
icap_send_client_ip on
icap_send_client_username on
icap_client_username_encode off
icap_client_username_header X-Authenticated-User
icap_connect_timeout 1 second
icap_preview_enable on
icap_preview_size 1024
icap_206_enable on
icap_persistent_connections on
icap_service service_req reqmod_precache bypass=1
icap://127.0.0.1:1344/squidclamav
adaptation_access service_req deny icap_whitelisted
adaptation_access service_req allow all
icap_service service_resp respmod_precache bypass=1
icap://127.0.0.1:1344/squidclamav
adaptation_access service_resp deny icap_whitelisted
adaptation_access service_resp allow all
forwarded_for delete
httpd_suppress_version_string on
### Error messages ###
error_directory /etc/squid/errors/ru
### Cache options ###
cache_mem 1024 MB
cache deny all
auth_param basic program /opt/squid/libexec/basic_pam_auth -n squid -t
300 -o
auth_param basic children 30 startup=5 idle=5
auth_param basic credentialsttl 10800 seconds
auth_param basic realm squid.domain.ru
#auth_param negotiate program /opt/squid/libexec/negotiate_kerberos_auth
-r -s HTTP/squid.domain.ru@xxxxxxxxx
auth_param negotiate program /opt/squid/libexec/negotiate_kerberos_auth
-r -s GSS_C_NO_NAME
auth_param negotiate children 100 startup=10 idle=10
auth_param negotiate keep_alive on
authenticate_cache_garbage_interval 1 hour
authenticate_ttl 1 hour
external_acl_type squid_ldap ttl=30 negative_ttl=30 children-max=100
children-startup=10 children-idle=5 %LOGIN
/opt/squid/libexec/ext_ldap_group_acl -b "OU=Users,DC=domain,DC=ru" -s
sub -D CN=service_ldap_ro,CN=Users,DC=domain,DC=ru -W
/etc/squid/ldap.password -R -H ldap://192.168.192.18 -v 3 -S -K -f
"(&(sAMAccountName=%u)(memberOf=%g))"
acl proxy_full_access external squid_ldap
CN=proxy_full_access,OU=Proxy,OU=Groups,DC=domain,DC=ru
acl proxy_email_access external squid_ldap
CN=proxy_email_access,OU=Proxy,OU=Groups,DC=domain,DC=ru
acl proxy_hr_access external squid_ldap
CN=proxy_hr_access,OU=Proxy,OU=Groups,DC=domain,DC=ru
acl proxy_no_access external squid_ldap
CN=proxy_no_access,OU=Proxy,OU=Groups,DC=domain,DC=ru
acl proxy_no_access_expired external squid_ldap
CN=Expired_Passwords,OU=Groups,DC=domain,DC=ru
### Delay Pools ###
delay_pools 1
delay_class 1 4
delay_access 1 deny all
delay_parameters 1 -1/-1 -1/-1 -1/-1 8000/16000
### File lists ###
include "/etc/squid/lists.conf"
### File ACLs ###
## Lists ##
acl lists_block_dom dstdomain "/etc/squid/lists/domains_blocked.txt"
acl lists_fun_dom dstdomain "/etc/squid/lists/domains_fun.txt"
acl lists_job_dom dstdomain "/etc/squid/lists/domains_job.txt"
## Custom Lists ##
acl domains_whitelisted dstdomain "/etc/squid/lists/domains_whitelisted.txt"
acl domains_ssl_direct dstdomain "/etc/squid/lists/domains_ssl_direct.txt"
acl domains_mail dstdomain "/etc/squid/lists/domains_mail.txt"
acl domains_no_auth dstdomain "/etc/squid/lists/domains_no_auth.txt"
acl ip_ssl_direct dst "/etc/squid/lists/ip_ssl_direct.txt"
# SSL exceptions
acl domains_ssl_error dstdomain "/etc/squid/lists/domains_ssl_error.txt"
# SSL Proxying
ssl_bump none domains_ssl_direct
ssl_bump none ip_ssl_direct
ssl_bump client-first domains_ssl_error
ssl_bump server-first all
sslproxy_options NO_SSLv2,NO_SSLv3
sslproxy_cipher
ECDH+AESGCM:DH+AESGCM:ECDH+AES:DH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
# sslproxy_flags DONT_VERIFY_PEER
sslproxy_cert_error allow domains_ssl_error
sslproxy_cert_error deny all
sslcrtd_program /opt/squid/libexec/ssl_crtd -s /etc/squid/ssl/ssl_db -M
128MB
sslcrtd_children 50 startup=10 idle=10
always_direct allow all
### Port based ACLs ###
acl ports_allowed port 20
acl ports_allowed port 21
acl ports_allowed port 80
acl ports_allowed port 443
acl ports_allowed port 9000
acl ports_connect port 443
acl ports_connect port 9000
### Time period ACLs ###
acl time_fun time MTWHF 13:00-14:00 18:30-23:00
acl time_blocked time MTWHF 23:00-23:59 00:00-8:00
acl time_weekends time SA 00:00-23:59
### Other ACLs ###
acl net_domain src 10.0.0.0/8
acl net_domain src 192.168.20.0/24
acl method_connect method CONNECT
acl proxy_authorized proxy_auth REQUIRED
### Access lists ###
http_access deny !net_domain
http_access allow domains_no_auth ports_allowed
http_access deny !proxy_authorized
http_access deny proxy_no_access
http_access deny proxy_no_access_expired
#http_access deny !proxy_full_access time_blocked
http_access deny !proxy_full_access !time_fun lists_fun_dom
http_access deny !proxy_full_access lists_block_dom !domains_whitelisted
http_access deny !proxy_email_access !proxy_full_access
!domains_whitelisted lists_mail_dom
http_access deny !proxy_hr_access !proxy_full_access lists_job_dom
http_access allow proxy_mudak_access
http_access deny method_connect !ports_connect
http_access deny !ports_allowed
http_access allow all
deny_info https://support.domain.ru/pass_change proxy_no_access_expired
### Other parameters ###
access_log stdio:/var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
cache_store_log none
logfile_rotate 90
mime_table /etc/squid/mime.conf
request_header_max_size 20 KB
request_body_max_size 0 KB
via on
shutdown_lifetime 3 seconds
