squid и торренты и неправильная настройка фаервола = мегазло. установил на новой машине минимум, ipcad + lightsquid + cron + Open-VM-Tools. установленный заранее squid squidguard снесены, ибо увидел что попаданий в кэш чуть больше 0%. В прошлой реализации моего сквида попадание было под 30-40%, за счет обновлений всяких программ.
торренты отловил snort-ом на прошлой машине. (после непонятно чего, перестала идти маршрутизация; откат на бекапы не помог.)
Вопрос. ipcad в такой настройке только входящий трафик считает? У отловленных пользователей мной были прибиты торренты со стоящими на раздаче файлами, т.е. актуальноть подсчета всего трафика велика.
tolog.sh
#!/bin/sh
net1="10.0.0"
net2="10.0.1"
net3="172.31.8"
ttime=`/usr/bin/rsh localhost sh ip acco | grep 'Accounting data saved' | awk '{print ($4)}'`
rsh localhost clear ip accounting
rsh localhost show ip accounting checkpoint | grep $net1 | awk -v vtime=$ttime '{if ($5 != 0) print (vtime".000",1,$2,"TCP_MISS/200",$4,"CONNECT",$1":"$5,"-","DIRECT/"$1,"-")}' >> /var/squid/logs/access.log
rsh localhost show ip accounting checkpoint | grep $net2 | awk -v vtime=$ttime '{if ($5 != 0) print (vtime".000",1,$2,"TCP_MISS/200",$4,"CONNECT",$1":"$5,"-","DIRECT/"$1,"-")}' >> /var/squid/logs/access.log
rsh localhost show ip accounting checkpoint | grep $net3 | awk -v vtime=$ttime '{if ($5 != 0) print (vtime".000",1,$2,"TCP_MISS/200",$4,"CONNECT",$1":"$5,"-","DIRECT/"$1,"-")}' >> /var/squid/logs/access.log
chown proxy:proxy /var/squid/logs/access.log
ipcad.conf
#
# Simple configuration file for ipcad.
# Copyright (c) 2001, 2002, 2003, 2004
# Lev Walkin <vlm@lionet.info>.
#
# Please see ipcad.conf.default file or ipcad.conf(5) manual page for
# complete file format explanation.
# /usr/local/etc
capture-ports enable; # Enable ports capturing for RSH (no effect on NetFlow).
interface "em2_vlan10" filter "ip and dst net 10.0.0.0/24 and not src net 10.0.0.0/24";
interface "em2_vlan20" filter "ip and dst net 10.0.1.0/24 and not src net 10.0.1.0/24";
interface "em2_vlan30" filter "ip and dst net 172.31.8.0/24 and not src net 172.31.8.0/24";
# Specify interfaces.
#interface eth0; # Listen on Ethernet interface...
#interface eth1; # ...and another onw.
#interface ppp*; # Listen on all PPP interfaces.
# Preserve internal IP ranges, aggregate external ones.
aggregate 10.0.0.0/24 strip 32; /* Don't aggregate 192.168.0.0 */
aggregate 10.0.1.0/24 strip 32; /* Don't aggregate 192.168.0.0 */
aggregate 172.31.8.0/24 strip 32; /* Don't aggregate 192.168.0.0 */
aggregate 0.0.0.0/0 strip 32; /* Drop the last octet of all other IPs */
# Aggregate port numbers.
#aggregate 1024-65535 into 65535; /* Aggregate wildly */
#aggregate 3128-3128 into 3128; /* Protect these ports */
#aggregate 150-1023 into 1023; /* General low range */
rsh enable at 127.0.0.1;
rsh root@127.0.0.1 admin; /* Can shutdown ipcad */
rsh root@127.0.0.1 backup; /* Can dump/restore/import accounting table */
rsh root@127.0.0.1; /* Can view and modify accounting tables */
rsh 127.0.0.1 view-only; /* Other users can view current tables */
# Uncomment this to export NetFlow information to specified destination.
# netflow export destination 127.0.0.1 9996;
chroot=/var/log/ipcad;
pidfile = ipcad.pid; # Will be created under /tmp
memory_limit = 80m;
# Dump file for -r and -s command line options.
dumpfile = ipcad.dump;</vlm@lionet.info>
