*From:*squid-users <squid-users-bounces@xxxxxxxxxxxxxxxxxxxxx> *On
Behalf Of *squid-users-request@xxxxxxxxxxxxxxxxxxxxx
*Sent:* Tuesday, April 23, 2024 6:00 AM
*To:* squid-users@xxxxxxxxxxxxxxxxxxxxx
*Subject:* [External] squid-users Digest, Vol 116, Issue 31
*Caution:*This is an external email and has a suspicious subject or
content. Please take care when clicking links or opening attachments.
When in doubt, contact your IT Department
Send squid-users mailing list submissions to
squid-users@xxxxxxxxxxxxxxxxxxxxx <mailto:squid-users@xxxxxxxxxxxxxxxxxxxxx>
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.squid-cache.org/listinfo/squid-users
<https://lists.squid-cache.org/listinfo/squid-users>
or, via email, send a message with subject or body 'help' to
squid-users-request@xxxxxxxxxxxxxxxxxxxxx
<mailto:squid-users-request@xxxxxxxxxxxxxxxxxxxxx>
You can reach the person managing the list at
squid-users-owner@xxxxxxxxxxxxxxxxxxxxx
<mailto:squid-users-owner@xxxxxxxxxxxxxxxxxxxxx>
When replying, please edit your Subject line so it is more specific
than "Re: Contents of squid-users digest..."
Today's Topics:
1. Re: Warm cold times (Amos Jeffries)
2. Re: Container Based Issues Lock Down Password and Terminate
SSL (Amos Jeffries)
----------------------------------------------------------------------
Message: 1
Date: Tue, 23 Apr 2024 19:41:37 +1200
From: Amos Jeffries <squid3@xxxxxxxxxxxxx <mailto:squid3@xxxxxxxxxxxxx>>
To: squid-users@xxxxxxxxxxxxxxxxxxxxx
<mailto:squid-users@xxxxxxxxxxxxxxxxxxxxx>
Subject: Re: Warm cold times
Message-ID: <9d8f4de6-c797-4e70-aaf5-c073f45c3390@xxxxxxxxxxxxx
<mailto:9d8f4de6-c797-4e70-aaf5-c073f45c3390@xxxxxxxxxxxxx>>
Content-Type: text/plain; charset=UTF-8; format=flowed
On 22/04/24 17:42, Jonathan Lee wrote:
> Has anyone else taken up the fun challenge of doing windows update
caching. It is amazing when it works right. It is a complex
configuration, but it is worth it to see a warm download come down that
originally took 30 mins instantly to a second client. I didn?t know how
much of the updates are the same across different vendor laptops.
>
There have been several people over the years.
The collected information is being gathered at
<https://wiki.squid-cache.org/ConfigExamples/Caching/WindowsUpdates
<https://wiki.squid-cache.org/ConfigExamples/Caching/WindowsUpdates>>
If you would like to check and update the information for the current
Windows 11 and Squid 6, etc. that would be useful.
Wiki updates are now made using github PRs against the repository at
<https://github.com/squid-cache/squid-cache.github.io
<https://github.com/squid-cache/squid-cache.github.io>>.
> Amazing stuff Squid team.
> I wish I could get some of the Roblox Xbox stuff to cache but it?s a
night to get running with squid in the first place, I had to splice a
bunch of stuff and also wpad the Xbox system.
FWIW, what I have seen from routing perspective is that Roblox likes to
use custom ports and P2P connections for a lot of things. So no high
expectations there, but anything cacheable is great news.
>> On Apr 18, 2024, at 23:55, Jonathan Lee wrote:
>>
>> ?Does anyone know the current warm cold download times for dynamic
cache of windows updates?
>>
>> I can say my experience was a massive increase in the warm download
it was delivered in under a couple mins versus 30 or so to download it
cold. The warm download was almost instant on the second device. Very
green energy efficient.
>>
>>
>> Does squid 5.8 or 6 work better on warm delivery?
There is no significant differences AFAIK. They both come down to what
you have configured. That said, the ongoing improvements may make v6
some amount of "better" - even if only trivial.
>> Is there a way to make 100 percent sure a docker container can?t get
inside the cache?
For Windows I would expect the only "100% sure" way is to completely
forbid access to the disk where the cache is stored.
The rest of your questions are about container management and Windows
configuration. Which are kind of off-topic.
Cheers
Amos
------------------------------
Message: 2
Date: Tue, 23 Apr 2024 20:03:42 +1200
From: Amos Jeffries <squid3@xxxxxxxxxxxxx <mailto:squid3@xxxxxxxxxxxxx>>
To: squid-users@xxxxxxxxxxxxxxxxxxxxx
<mailto:squid-users@xxxxxxxxxxxxxxxxxxxxx>
Subject: Re: Container Based Issues Lock Down Password
and Terminate SSL
Message-ID: <58c41ee7-b88c-4d5a-bd12-220d44465067@xxxxxxxxxxxxx
<mailto:58c41ee7-b88c-4d5a-bd12-220d44465067@xxxxxxxxxxxxx>>
Content-Type: text/plain; charset=UTF-8; format=flowed
On 23/04/24 11:52, Jonathan Lee wrote:
> Hello fellow Squid Accelerator/Dynamic Cache/Web Cache Users/PfSense
users
>
> I think this might resolve any container based issues/fears if they
> happened to get into the cache. Ie a Docker Proxy got installed and
> tried to data marshal the network card inside of a freeBSD jail or
> something like that. Biggest fear with my cache it is a big cache now
>
> Please yet me know what you think or if it is wrong.
>
> Here is my configuration. I wanted to share it as it might help to
> secure some of this.
FTR, this config was auto-generated by pfsense. A number of things which
that tool forces into the config could be done much better in the latest
Squid, but the tool does not do due to needing to support older Squid
version.
>
> Keep in mine I use cachemgr.cgi within Squidlight so I had to set the
> password and I have to also adapt the php status file to include the
> password and also the sqlight php file.
>
> After that the status and gui pages work still with the new password.
> Only issues area that it shows up in clear text when it goes over the
> proxy I can see my password clear as day again that was an issue listed
> inside the Squid O?REILLY book also.
Please ensure you are using the latest Squid v6 release. That release
has both a number of security fixes, and working https:// URL access to
the manager reports.
The cachemgr.cgi tool is deprecated fro a number of issues including
that style of embedding passwords in the URLs.
Francesco and I have created a tool that can be found at
<https://github.com/yadij/cachemgr.js/blob/master/README.md
<https://github.com/yadij/cachemgr.js/blob/master/README.md>> for basic
access to the reports directly from Browser.
That tool uses HTTP authentication configured via the well-documented
proxy_auth ACLs and http_access for more secure access than the old URL
based mechanism (which still exists, just deprecated).
Cheers
Amos
------------------------------
Subject: Digest Footer
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx <mailto:squid-users@xxxxxxxxxxxxxxxxxxxxx>
https://lists.squid-cache.org/listinfo/squid-users
<https://lists.squid-cache.org/listinfo/squid-users>
------------------------------
End of squid-users Digest, Vol 116, Issue 31
********************************************
*//*
*/
<http://www.pbandt.bank>
CONFIDENTIALITY NOTICE: The information contained in and attached to
this email is intended only for the confidential use of the person or
entity to which the email is addressed. This email and any attachments
may contain privileged and confidential information. If you are not the
intended recipient, you are notified that you received this email in
error and that any reading, retention, use or distribution of this email
and attachments is strictly prohibited. If you received this email in
error, you are requested to immediately notify us by calling
888-728-3550 or by return email and immediately and permanently delete
the email and any attachments. Thank you. /*//
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
https://lists.squid-cache.org/listinfo/squid-users
