Squid 6.5 !! Nov 6th
-
It would be interesting to see what netgate have to say about this now,
it seems that alot of cve if not all have been patched in squid 6.4 and 6.5, IMHO it would be a shame to remove this package from the list now. any chance that netgate will retreat that statement and continue to support squid or is it the final decision? @stephenw10 ? -
@kiokoman I would too, if the update fixes all of the issues why not use it?
-
J JonathanLee referenced this topic on Jan 5, 2024, 10:11 PM
-
@lg1980 What is the recommended donation for this update? Also I can start to test this Jan 8th or 9th when all the kids are back in school
-
@JonathanLee said in Squid 6.5 !! Nov 6th:
What is the recommended donation for this update? Also I can start to test this Jan 8th or 9th when all the kids are back in school
I have no economic interest in these updates and support from Squid, whatever I personally feel in relation to covering my hours/dedication to work financially.
-
Did you check this out Squid with all the updates !!!
-
@lg1980 result for use with arm processor
-
@lg1980 how can I test the package?
-
all these updates are great but what happens when it's finally done?
Netgate said squid will no longer be available in the package manager with the next major release of pfsense, so it seems squids days are numbered, at least for pfsense, which really sucks..
there's haproxy, but that lacks av integration.. people might say "it doesn't matter b/c internet traffic is encrypted.. yes, but if you're behind a proxy, then it works well!
so what are we supposed to do?
-
@jc1976 You just manually install it if you use it like us. It will be back alot of users use this.
-
ok, but if netgate removes it from the package manager and we have to manually install it, does that mean the gui portion of it will be removed and all configuring will need to be done via cli?
-
@jc1976 You would have to do it in cmd line after, and use the old packages to install manually
-
https://forum.netgate.com/topic/185029/resolved-quest-for-older-package-wget
I would not use it but if you need it like me..
I did it with Snort to stop the core dumps
Just know that Netgate recommended it be removed.
-
@JonathanLee said in Squid 6.5 !! Nov 6th:
result for use with arm processor
Oh man ! it still doesn't compile binaries for the ARM version, I don't have Netgate hardware here to test.
This is only to AMD64 version architeture.
-
@jc1976 said in Squid 6.5 !! Nov 6th:
ok, but if netgate removes it from the package manager and we have to manually install it, does that mean the gui portion of it will be removed and all configuring will need to be done via cli?
No, personally, and even to maintain pf2ad, I will maintain in a parallel repository (in this case it will be unofficial) Squid and all the tools, as well as the web interface (as it is), with the necessary updates for each package
-
Hi Luiz,
I'm starting from a clean installation of pfsense 2.7.2 and running the command fetch -q -o - https://gitlab.labexposed.com/-/snippets/15/raw/main/repo-squid66.sh | sh
I installed the packages as shown in the image.
After configuring Squid and SquidGuard I have the following errors:
- in real time
-on the client
where the ip 172.17.78.81 is the proxy
Is there anything I can do ?
-
@Michele-Trotta interesting…. What does Squids official website say about that error?
-
Hi everyone, since version 2.7.1 pfsense Squid is deprecated and that's why all these strange errors occur.
I was hoping for Luiz's patch. Before abandoning pfsense+squid I will do some more tests because it is an excellent solution.
If you have other solutions to try let me know.
Greetings
Michele -
@Michele-Trotta hello everyone on this post is already aware. This post is for work arounds. Squid itself has many new security updates already available. I am sure you are aware. Thanks, this post is just the open source community coming together to help find ways to make it work. Solutions are needed and being tested in here with high hopes of bring the latest Squid version online for die hard users. Just some open source discussion at its finest. Seems it still has some bugs with that error you see above.
Leading to Ecap over icap I wonder if that would improve security as it can work directly with DoH I am told.
DoH is a big issue with dns based security….. it’s pure https based DNS you can’t force it and it’s reaction based when you block it, ever worse is QUIC. The latest Squid updates have QUIC protocol tools to detect and inspect. That’s https over udp, and it’s a big issue within dns based cyber security detection also. That’s why Squid can’t and won’t die. It’s because Squid has solutions for all the new protocols.
We make solutions not problems.
-
@Michele-Trotta Squid has custom options you can check them on there website, I wonder if something is automatically activated when the new version is installed…
-
@Michele-Trotta check this out…
https://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit
You might have a certificate issue