Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid 6.6 DEV 24 Issues

    Scheduled Pinned Locked Moved Plus 24.03 Development Snapshots (Retired)
    squidproxydevelopmentcertificatesstoreidcachemgr
    26 Posts 3 Posters 4.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JonathanLeeJ
      JonathanLee
      last edited by

      Do users need new ssl certs?

      Make sure to upvote

      1 Reply Last reply Reply Quote 0
      • JonathanLeeJ
        JonathanLee
        last edited by

        I changed the cafile to tls-cafile and it acts like it needs a new tls certificate and not the ssl version. Again it is working, I can not access the status page it has not been configured to allow access it looks locked out. The error states http_access manager is built in and to delete that line. It works great just looks like it needs some small config changes to work with the new version. Again it wants tls-cafile= now and not cafile

        Make sure to upvote

        1 Reply Last reply Reply Quote 0
        • JonathanLeeJ
          JonathanLee
          last edited by

          The new 6.6 squid wants TLS certificates, can pfSense generate a TLS cert as a CA?

          Make sure to upvote

          1 Reply Last reply Reply Quote 0
          • JonathanLeeJ
            JonathanLee
            last edited by

            Per squid support Jeffries Amos,

            “…there are a few weird things in your TLS cipher settings, such as this sequence " EECDH+aRSA+RC4:...:!RC4 "
            Which as I understand, enables the EECDH with RC4 hash, but also forbids all uses of RC4.” …

            “Squidguard is very outdated. You should upgrade to its successor ufdbguard if possible.”

            Make sure to upvote

            M 1 Reply Last reply Reply Quote 0
            • JonathanLeeJ
              JonathanLee
              last edited by

              2024/04/05 07:58:24| Processing Configuration File: /usr/local/etc/squid/squid.conf (depth 0)
              2024/04/05 07:58:24| Processing: http_port 192.168.1.1:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.4096 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
              2024/04/05 07:58:24| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead.
              2024/04/05 07:58:24| WARNING: Failed to decode EC parameters '/etc/dh-parameters.4096'
              OpenSSL-saved error #1: 0x1e08010c
              2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_DH_USE
              2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_ECDH_USE
              2024/04/05 07:58:24| Processing: http_port 127.0.0.1:3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.4096 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
              2024/04/05 07:58:24| Starting Authentication on port 127.0.0.1:3128
              2024/04/05 07:58:24| Disabling Authentication on port 127.0.0.1:3128 (interception enabled)
              2024/04/05 07:58:24| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead.
              2024/04/05 07:58:24| WARNING: Failed to decode EC parameters '/etc/dh-parameters.4096'
              OpenSSL-saved error #1: 0x1e08010c
              2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_DH_USE
              2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_ECDH_USE
              2024/04/05 07:58:24| Processing: https_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.4096 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
              2024/04/05 07:58:24| Starting Authentication on port 127.0.0.1:3129
              2024/04/05 07:58:24| Disabling Authentication on port 127.0.0.1:3129 (interception enabled)
              2024/04/05 07:58:24| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in https_port. Use 'tls-cafile=' instead.
              2024/04/05 07:58:24| WARNING: Failed to decode EC parameters '/etc/dh-parameters.4096'
              OpenSSL-saved error #1: 0x1e08010c
              2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_DH_USE
              2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_ECDH_USE
              2024/04/05 07:58:24| Processing: icp_port 0
              2024/04/05 07:58:25| Processing: digest_generation off
              2024/04/05 07:58:25| Processing: dns_v4_first on
              2024/04/05 07:58:25| ERROR: Directive 'dns_v4_first' is obsolete.
              2024/04/05 07:58:25| dns_v4_first : Remove this line. Squid no longer supports preferential treatment of DNS A records.
              2024/04/05 07:58:25| Processing: pid_filename /var/run/squid/squid.pid
              2024/04/05 07:58:25| Processing: cache_effective_user squid
              2024/04/05 07:58:25| Processing: cache_effective_group proxy
              2024/04/05 07:58:25| Processing: error_default_language en
              2024/04/05 07:58:25| Processing: icon_directory /usr/local/etc/squid/icons
              2024/04/05 07:58:25| Processing: visible_hostname Lee_Family.home.arpa
              2024/04/05 07:58:25| Processing: cache_mgr jonathanlee571@gmail.com
              2024/04/05 07:58:25| Processing: access_log /var/squid/logs/access.log
              2024/04/05 07:58:25| Processing: cache_log /var/squid/logs/cache.log
              2024/04/05 07:58:25| Processing: cache_store_log none
              2024/04/05 07:58:25| Processing: netdb_filename /var/squid/logs/netdb.state
              2024/04/05 07:58:25| Processing: pinger_enable on
              2024/04/05 07:58:25| Processing: pinger_program /usr/local/libexec/squid/pinger
              2024/04/05 07:58:25| Processing: sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/lib/ssl_db -M 4MB -b 2048
              2024/04/05 07:58:25| Processing: tls_outgoing_options cafile=/usr/local/share/certs/ca-root-nss.crt
              2024/04/05 07:58:25| Processing: tls_outgoing_options capath=/usr/local/share/certs/
              2024/04/05 07:58:25| Processing: tls_outgoing_options options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE
              2024/04/05 07:58:25| ERROR: Unsupported TLS option SINGLE_DH_USE
              2024/04/05 07:58:25| ERROR: Unsupported TLS option SINGLE_ECDH_USE
              2024/04/05 07:58:25| Processing: tls_outgoing_options cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
              2024/04/05 07:58:25| Processing: sslcrtd_children 10
              2024/04/05 07:58:25| Processing: logfile_rotate 0
              2024/04/05 07:58:25| Processing: debug_options rotate=0
              2024/04/05 07:58:25| Processing: shutdown_lifetime 3 seconds
              2024/04/05 07:58:25| Processing: acl localnet src 192.168.1.0/27
              2024/04/05 07:58:25| Processing: forwarded_for transparent
              2024/04/05 07:58:25| Processing: httpd_suppress_version_string on
              2024/04/05 07:58:25| Processing: uri_whitespace strip
              2024/04/05 07:58:25| Processing: acl getmethod method GET
              2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain windowsupdate.microsoft.com
              2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain .update.microsoft.com
              2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain download.windowsupdate.com
              2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain redir.metaservices.microsoft.com
              2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain images.metaservices.microsoft.com
              2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain c.microsoft.com
              2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain www.download.windowsupdate.com
              2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain wustat.windows.com
              2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain crl.microsoft.com
              2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain sls.microsoft.com
              2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain productactivation.one.microsoft.com
              2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain ntservicepack.microsoft.com
              2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain dc1-st.ksn.kaspersky-labs.com
              2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain dc1-file.ksn.kaspersky-labs.com
              2024/04/05 07:58:25| Processing: acl windowsupdate dstdomain dc1.ksn.kaspersky-labs.com
              2024/04/05 07:58:25| Processing: acl rewritedoms dstdomain .facebook.com .akamaihd.net .fbcdn.net .google.com .static.com .apple.com .oracle.com .sun.com .java.com .adobe.com .steamstatic.com .steampowered.com .steamcontent.com .google.com
              2024/04/05 07:58:25| Processing: store_id_program /usr/local/libexec/squid/storeid_file_rewrite /var/squid/storeid/storeid_rewrite.txt
              2024/04/05 07:58:25| Processing: store_id_children 10 startup=5 idle=1 concurrency=0
              2024/04/05 07:58:25| Processing: always_direct allow !getmethod
              2024/04/05 07:58:25| Processing: store_id_access deny connect
              2024/04/05 07:58:25| Processing: store_id_access deny !getmethod
              2024/04/05 07:58:25| Processing: store_id_access allow rewritedoms
              2024/04/05 07:58:25| Processing: reload_into_ims on
              2024/04/05 07:58:25| Processing: max_stale 20 years
              2024/04/05 07:58:25| Processing: minimum_expiry_time 0
              2024/04/05 07:58:25| Processing: refresh_pattern -i squid.internal 10080 80% 79900 override-lastmod override-expire ignore-reload ignore-no-store ignore-must-revalidate ignore-private ignore-auth
              2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-must-revalidate' is obsolete. Remove it.
              2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-auth' is obsolete. Remove it.
              2024/04/05 07:58:25| Processing: refresh_pattern -i apple.com/..(cab|exe|msi|msu|msf|asf|wmv|wma|dat|zip|dist)$ 0 80% 43200 refresh-ims
              2024/04/05 07:58:25| Processing: refresh_pattern -i (download|adcdownload).apple.com/..(pkg|dmg) 4320 100% 43200
              2024/04/05 07:58:25| Processing: refresh_pattern -i appldnld.apple.com 129600 100% 129600
              2024/04/05 07:58:25| Processing: refresh_pattern -i phobos.apple.com 129600 100% 129600
              2024/04/05 07:58:25| Processing: refresh_pattern -i iosapps.itunes.apple.com 129600 100% 129600
              2024/04/05 07:58:25| Processing: refresh_pattern -i microsoft.com/..(cab|exe|msi|msu|msf|asf|wma|dat|zip)$ 4320 80% 43200 refresh-ims
              2024/04/05 07:58:25| Processing: refresh_pattern -i windowsupdate.com/..(cab|exe|msi|msu|msf|asf|wma|wmv)|dat|zip)$ 4320 80% 43200 refresh-ims
              2024/04/05 07:58:25| Processing: refresh_pattern -i windows.com/..(cab|exe|msi|msu|msf|asf|wmv|wma|dat|zip)$ 4320 80% 43200 refresh-ims
              2024/04/05 07:58:25| Processing: refresh_pattern -i microsoft.com/.              .(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200
              2024/04/05 07:58:25| Processing: refresh_pattern -i windowsupdate.com/..(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200
              2024/04/05 07:58:25| Processing: refresh_pattern -i windows.com/.              .(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200
              2024/04/05 07:58:25| Processing: refresh_pattern -i .windowsupdate.com/..(cab|exe) 259200 100% 259200
              2024/04/05 07:58:25| Processing: refresh_pattern -i .update.microsoft.com/..(cab|exe|dll|msi|psf) 259200 100% 259200
              2024/04/05 07:58:25| Processing: refresh_pattern windowsupdate.com/..(cab|exe|dll|msi|psf) 10080 100% 43200
              2024/04/05 07:58:25| Processing: refresh_pattern download.microsoft.com/.              .(cab|exe|dll|msi|psf) 10080 100% 43200
              2024/04/05 07:58:25| Processing: refresh_pattern www.microsoft.com/..(cab|exe|dll|msi|psf) 10080 100% 43200
              2024/04/05 07:58:25| Processing: refresh_pattern au.download.windowsupdate.com/.              .(cab|exe|dll|msi|psf) 4320 100% 43200
              2024/04/05 07:58:25| Processing: refresh_pattern bg.v4.pr.dl.ws.microsoft.com/..(cab|exe|dll|msi|psf) 4320 100% 43200
              2024/04/05 07:58:25| Processing: refresh_pattern update.microsoft.com/.              .(cab|exe) 43200 100% 129600
              2024/04/05 07:58:25| Processing: refresh_pattern ([^.]+.)?(download|(windows)?update).(microsoft.)?com/..(cab|exe|msi|msp|psf) 4320 100% 43200
              2024/04/05 07:58:25| Processing: refresh_pattern update.microsoft.com/.              .(cab|exe|dll|msi|psf) 10080 100% 43200
              2024/04/05 07:58:25| Processing: refresh_pattern -i .update.microsoft.com/..(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600
              2024/04/05 07:58:25| Processing: refresh_pattern -i .windowsupdate.com/.              .(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600
              2024/04/05 07:58:25| Processing: refresh_pattern -i .download.microsoft.com/..(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600
              2024/04/05 07:58:25| Processing: refresh_pattern -i .ws.microsoft.com/.              .(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600
              2024/04/05 07:58:25| Processing: refresh_pattern ([^.]+.)?(cs|content[1-9]|hsar|content-origin|client-download).[steampowered|steamcontent].com/.. 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
              2024/04/05 07:58:25| Processing: refresh_pattern ([^.]+.)?.akamai.steamstatic.com/.. 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
              2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+.)?.adobe.com/..(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
              2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+.)?.java.com/.              .(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
              2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+.)?.sun.com/..(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
              2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+.)?.oracle.com/.              .(zip|exe|tar.gz) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod
              2024/04/05 07:58:25| Processing: refresh_pattern -i appldnld.apple.com 43200 100% 43200 ignore-reload ignore-no-store override-expire override-lastmod
              2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+.)?apple.com/..(ipa) 43200 100% 43200 ignore-reload ignore-no-store override-expire override-lastmod
              2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+.)?.google.com/.              .(exe|crx) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
              2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
              2024/04/05 07:58:25| Processing: refresh_pattern -i ([^.]+.)?g.static.com/..(exe|crx) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
              2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
              2024/04/05 07:58:25| Processing: refresh_pattern ^http?://              .facebook.com/* 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
              2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
              2024/04/05 07:58:25| Processing: refresh_pattern -i pixel.facebook.com..(jpg|png|gif|ico|css|js) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
              2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
              2024/04/05 07:58:25| Processing: refresh_pattern -i .akamaihd.net..(jpg|png|gif|ico|css|js) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
              2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
              2024/04/05 07:58:25| Processing: refresh_pattern -i (facebook.com).(jpg|png|gif) 10080 80% 43200 store-stale override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
              2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
              2024/04/05 07:58:25| Processing: refresh_pattern static.(xx|ak).fbcdn.net.(jpg|gif|png) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
              2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
              2024/04/05 07:58:25| Processing: refresh_pattern ^https?://profile.ak.fbcdn.net*.(jpg|gif|png) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
              2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
              2024/04/05 07:58:25| Processing: refresh_pattern -i .video.ak.fbcdn.net..(mp4|flv|mp3|amf) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
              2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
              2024/04/05 07:58:25| Processing: refresh_pattern (audio|video)/(webm|mp4) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private
              2024/04/05 07:58:25| UPGRADE: refresh_pattern option 'ignore-no-cache' is obsolete. Remove it.
              2024/04/05 07:58:25| Processing: acl https_login url_regex -i ^https.              (login|Login).*
              2024/04/05 07:58:25| Processing: cache deny https_login
              2024/04/05 07:58:25| Processing: range_offset_limit 512 MB windowsupdate
              2024/04/05 07:58:25| Processing: range_offset_limit 0
              2024/04/05 07:58:25| Processing: quick_abort_min -1 KB
              2024/04/05 07:58:25| Processing: cache_mem 64 MB
              2024/04/05 07:58:25| Processing: maximum_object_size_in_memory 256 KB
              2024/04/05 07:58:25| Processing: memory_replacement_policy heap LFUDA
              2024/04/05 07:58:25| Processing: cache_replacement_policy heap LFUDA
              2024/04/05 07:58:25| Processing: minimum_object_size 0 KB
              2024/04/05 07:58:25| Processing: maximum_object_size 512 MB
              2024/04/05 07:58:25| Processing: cache_dir diskd /var/squid/cache 64000 256 256
              2024/04/05 07:58:25| Processing: offline_mode off
              2024/04/05 07:58:25| Processing: cache_swap_low 90
              2024/04/05 07:58:25| Processing: cache_swap_high 95
              2024/04/05 07:58:25| Processing: acl donotcache dstdomain "/var/squid/acl/donotcache.acl"
              2024/04/05 07:58:25| Processing: cache deny donotcache
              2024/04/05 07:58:25| Processing: cache allow all
              2024/04/05 07:58:25| Processing: refresh_pattern ^ftp: 1440 20% 10080
              2024/04/05 07:58:25| Processing: refresh_pattern ^gopher: 1440 0% 1440
              2024/04/05 07:58:25| Processing: refresh_pattern -i (/cgi-bin/|?) 0 0% 0
              2024/04/05 07:58:25| Processing: refresh_pattern . 0 20% 4320
              2024/04/05 07:58:25| Processing: acl allsrc src all
              2024/04/05 07:58:25| Processing: acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 8080 3128 3129 1025-65535
              2024/04/05 07:58:25| Processing: acl sslports port 443 563 8080 5223 2197
              2024/04/05 07:58:25| Processing: acl purge method PURGE
              2024/04/05 07:58:25| Processing: acl connect method CONNECT
              2024/04/05 07:58:25| Processing: acl HTTP proto HTTP
              2024/04/05 07:58:25| Processing: acl HTTPS proto HTTPS
              2024/04/05 07:58:25| Processing: acl step1 at_step SslBump1
              2024/04/05 07:58:25| Processing: acl step2 at_step SslBump2
              2024/04/05 07:58:25| Processing: acl step3 at_step SslBump3
              2024/04/05 07:58:25| Processing: acl banned_hosts src "/var/squid/acl/banned_hosts.acl"
              2024/04/05 07:58:25| Processing: acl whitelist dstdom_regex -i "/var/squid/acl/whitelist.acl"
              2024/04/05 07:58:25| Processing: acl blacklist dstdom_regex -i "/var/squid/acl/blacklist.acl"
              2024/04/05 07:58:25| Processing: http_access allow manager localhost
              2024/04/05 07:58:25| Processing: acl ext_manager src 192.168.1.1
              2024/04/05 07:58:25| Processing: acl ext_manager src 127.0.0.1
              2024/04/05 07:58:25| Processing: http_access allow manager ext_manager
              2024/04/05 07:58:25| Processing: http_access deny manager
              2024/04/05 07:58:25| Processing: http_access allow purge localhost
              2024/04/05 07:58:25| Processing: http_access deny purge
              2024/04/05 07:58:25| Processing: http_access deny !safeports
              2024/04/05 07:58:25| Processing: http_access deny CONNECT !sslports
              2024/04/05 07:58:25| Processing: http_access allow localhost
              2024/04/05 07:58:25| Processing: quick_abort_min 0 KB
              2024/04/05 07:58:25| Processing: quick_abort_max 0 KB
              2024/04/05 07:58:25| Processing: quick_abort_pct 95
              2024/04/05 07:58:25| Processing: request_body_max_size 0 KB
              2024/04/05 07:58:25| Processing: delay_pools 1
              2024/04/05 07:58:25| Processing: delay_class 1 2
              2024/04/05 07:58:25| Processing: delay_parameters 1 -1/-1 -1/-1
              2024/04/05 07:58:25| Processing: delay_initial_bucket_level 100
              2024/04/05 07:58:25| Processing: delay_access 1 allow allsrc
              2024/04/05 07:58:25| Processing: deny_info TCP_RESET allsrc
              2024/04/05 07:58:25| Processing: url_rewrite_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf
              2024/04/05 07:58:25| Processing: url_rewrite_bypass off
              2024/04/05 07:58:25| Processing: url_rewrite_children 32 startup=8 idle=4 concurrency=0
              2024/04/05 07:58:25| Processing: http_access deny banned_hosts
              2024/04/05 07:58:25| Processing: http_access allow whitelist
              2024/04/05 07:58:25| Processing: http_access deny blacklist
              2024/04/05 07:58:25| Processing: request_header_access X-GoogApps-Allowed-Domains deny all
              2024/04/05 07:58:25| Processing: request_header_add X-GoogApps-Allowed-Domains consumer_accounts
              2024/04/05 07:58:25| Processing: acl youtubedst dstdomain -n www.youtube.com m.youtube.com youtubei.googleapis.com youtube.googleapis.com www.youtube-nocookie.com
              2024/04/05 07:58:25| Processing: request_header_access YouTube-Restrict deny all
              2024/04/05 07:58:25| Processing: request_header_add YouTube-Restrict none youtubedst
              2024/04/05 07:58:25| Processing: acl sglog url_regex -i sgr=ACCESSDENIED
              2024/04/05 07:58:25| Processing: http_access deny sglog
              2024/04/05 07:58:25| Processing: acl localhost src 192.168.1.1/32
              2024/04/05 07:58:25| Processing: acl no_miss url_regex -i gateway.facebook.com/ws/realtime?
              2024/04/05 07:58:25| Processing: acl no_miss url_regex -i web-chat-e2ee.facebook.com/ws/chat
              2024/04/05 07:58:25| Processing: acl CONNECT method CONNECT
              2024/04/05 07:58:25| Processing: acl wuCONNECT dstdomain www.update.microsoft.com
              2024/04/05 07:58:25| Processing: acl wuCONNECT dstdomain sls.microsoft.com
              2024/04/05 07:58:25| Processing: http_access allow CONNECT wuCONNECT localnet
              2024/04/05 07:58:25| Processing: http_access allow CONNECT wuCONNECT localhost
              2024/04/05 07:58:25| Processing: http_access allow windowsupdate localnet
              2024/04/05 07:58:25| Processing: http_access allow windowsupdate localhost
              2024/04/05 07:58:25| Processing: http_access deny manager
              2024/04/05 07:58:25| Processing: acl BrokenButTrustedServers dstdomain "/usr/local/pkg/dstdom.broken"
              2024/04/05 07:58:25| Processing: acl DomainMismatch ssl_error SQUID_X509_V_ERR_DOMAIN_MISMATCH
              2024/04/05 07:58:25| Processing: sslproxy_cert_error allow BrokenButTrustedServers DomainMismatch
              2024/04/05 07:58:25| Processing: sslproxy_cert_error deny all
              2024/04/05 07:58:25| Processing: acl splice_only src 192.168.1.8 #Tasha iPhone
              2024/04/05 07:58:25| Processing: acl splice_only src 192.168.1.10 #Jon iPhone
              2024/04/05 07:58:25| Processing: acl splice_only src 192.168.1.11 #Amazon Fire
              2024/04/05 07:58:25| Processing: acl splice_only src 192.168.1.15 #Tasha HP
              2024/04/05 07:58:25| Processing: acl splice_only src 192.168.1.16 #iPad
              2024/04/05 07:58:25| Processing: acl NoSSLIntercept ssl::server_name_regex -i "/usr/local/pkg/url.nobump"
              2024/04/05 07:58:25| /usr/local/etc/squid/squid.conf line 276: acl NoSSLIntercept ssl::server_name_regex -i "/usr/local/pkg/url.nobump"
              2024/04/05 07:58:25| WARNING: there are more than 100 regular expressions. Consider using less REs or use rules without expressions like 'dstdomain'.
              2024/04/05 07:58:25| Processing: acl markBumped annotate_client bumped=true
              2024/04/05 07:58:25| Processing: acl bump_only src 192.168.1.3 #webtv
              2024/04/05 07:58:25| Processing: acl bump_only src 192.168.1.4 #toshiba
              2024/04/05 07:58:25| Processing: acl bump_only src 192.168.1.5 #imac
              2024/04/05 07:58:25| Processing: acl bump_only src 192.168.1.9 #macbook
              2024/04/05 07:58:25| Processing: acl bump_only src 192.168.1.13 #dell
              2024/04/05 07:58:25| Processing: ssl_bump peek step1
              2024/04/05 07:58:25| Processing: miss_access deny no_miss
              2024/04/05 07:58:25| Processing: ssl_bump splice https_login
              2024/04/05 07:58:25| Processing: ssl_bump splice splice_only
              2024/04/05 07:58:25| Processing: ssl_bump splice NoSSLIntercept
              2024/04/05 07:58:25| Processing: ssl_bump bump bump_only markBumped
              2024/04/05 07:58:25| Processing: ssl_bump stare all
              2024/04/05 07:58:25| Processing: acl markedBumped note bumped true
              2024/04/05 07:58:25| Processing: url_rewrite_access deny markedBumped
              2024/04/05 07:58:25| Processing: http_access deny all
              2024/04/05 07:58:25| Processing: read_ahead_gap 64 KB
              2024/04/05 07:58:25| Processing: negative_ttl 1 second
              2024/04/05 07:58:25| Processing: connect_timeout 30 seconds
              2024/04/05 07:58:25| Processing: request_timeout 60 seconds
              2024/04/05 07:58:25| Processing: half_closed_clients off
              2024/04/05 07:58:25| Processing: shutdown_lifetime 10 seconds
              2024/04/05 07:58:25| Processing: negative_dns_ttl 1 seconds
              2024/04/05 07:58:25| Processing: ignore_unknown_nameservers on
              2024/04/05 07:58:25| Processing: pipeline_prefetch 100
              2024/04/05 07:58:25| Processing: http_access allow localnet
              2024/04/05 07:58:25| Processing: http_access deny allsrc
              2024/04/05 07:58:25| WARNING: use of 'override-expire' in 'refresh_pattern' violates HTTP
              2024/04/05 07:58:25| WARNING: use of 'override-lastmod' in 'refresh_pattern' violates HTTP
              2024/04/05 07:58:25| WARNING: use of 'reload-into-ims' in 'refresh_pattern' violates HTTP
              2024/04/05 07:58:25| WARNING: use of 'ignore-reload' in 'refresh_pattern' violates HTTP
              2024/04/05 07:58:25| WARNING: use of 'ignore-no-store' in 'refresh_pattern' violates HTTP
              2024/04/05 07:58:25| WARNING: use of 'ignore-private' in 'refresh_pattern' violates HTTP
              2024/04/05 07:58:25| Requiring client certificates.
              2024/04/05 07:58:25| Loaded signing certificate: /CN=internal-ca/C=US/ST=California/L=Roseville/O=Homeuse
              2024/04/05 07:58:26| Not requiring any client certificates
              2024/04/05 07:58:26| Loaded signing certificate: /CN=internal-ca/C=US/ST=California/L=Roseville/O=Homeuse
              2024/04/05 07:58:26| Not requiring any client certificates
              2024/04/05 07:58:26| Loaded signing certificate: /CN=internal-ca/C=US/ST=California/L=Roseville/O=Homeuse
              2024/04/05 07:58:27| Not requiring any client certificates

              Make sure to upvote

              1 Reply Last reply Reply Quote 0
              • M
                michmoor LAYER 8 Rebel Alliance @JonathanLee
                last edited by michmoor

                @JonathanLee said in Squid 6.6 DEV 24 Issues:

                “Squidguard is very outdated. You should upgrade to its successor ufdbguard if possible.”

                Am i reading that correctly? Squidguard maintainer is saying to use a different project?
                If so....umm...I think this closes out your issue then.
                Also i have confirmed that there are no SG maintainers on the NetGate side.
                So my friend that leaves you without package support from Netgate and without support from a maintainer.

                Firewall: NetGate,Palo Alto-VM,Juniper SRX
                Routing: Juniper, Arista, Cisco
                Switching: Juniper, Arista, Cisco
                Wireless: Unifi, Aruba IAP
                JNCIP,CCNP Enterprise

                JonathanLeeJ 2 Replies Last reply Reply Quote 0
                • JonathanLeeJ
                  JonathanLee @michmoor
                  last edited by JonathanLee

                  @michmoor I am sure google likes that unaccountability. This project has been around from the 90s and still is going, someone maintained it as it is now at 6.6. Marcus fixed squidguard a couple months ago too. I don’t understand the animosity towards it, it works better then DNS based systems, again google can hide lots with the dns versions.

                  Make sure to upvote

                  1 Reply Last reply Reply Quote 1
                  • JonathanLeeJ
                    JonathanLee @michmoor
                    last edited by

                    @michmoor what’s ufdbguard?

                    Make sure to upvote

                    M 1 Reply Last reply Reply Quote 0
                    • M
                      michmoor LAYER 8 Rebel Alliance @JonathanLee
                      last edited by

                      @JonathanLee said in Squid 6.6 DEV 24 Issues:

                      ufdbguard

                      https://www.urlfilterdb.com/products/ufdbguard.html

                      Firewall: NetGate,Palo Alto-VM,Juniper SRX
                      Routing: Juniper, Arista, Cisco
                      Switching: Juniper, Arista, Cisco
                      Wireless: Unifi, Aruba IAP
                      JNCIP,CCNP Enterprise

                      JonathanLeeJ 1 Reply Last reply Reply Quote 1
                      • JonathanLeeJ
                        JonathanLee @michmoor
                        last edited by

                        @michmoor
                        | WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in https_port. Use 'tls-cafile=' instead.

                        I am going to fix this in git hub if I can find the variable name this is a simple fix.

                        Make sure to upvote

                        1 Reply Last reply Reply Quote 0
                        • JonathanLeeJ
                          JonathanLee
                          last edited by

                          Screenshot 2024-04-05 at 15.05.45.png

                          Found it I am going to submit a commit to the package to fix this error it was listed in the older version also however the logs were disabled for it and it would only show up when you ran

                          squid -k parse

                          Make sure to upvote

                          1 Reply Last reply Reply Quote 0
                          • JonathanLeeJ
                            JonathanLee
                            last edited by

                            @JonathanLee said in Squid 6.6 DEV 24 Issues:

                            | WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in https_port. Use 'tls-cafile=' instead.

                            Screenshot 2024-04-05 at 15.10.29.png

                            Make sure to upvote

                            1 Reply Last reply Reply Quote 0
                            • JonathanLeeJ
                              JonathanLee
                              last edited by

                              Nope that didn't fix it Screenshot 2024-04-05 at 15.14.47.png

                              Make sure to upvote

                              1 Reply Last reply Reply Quote 0
                              • JonathanLeeJ
                                JonathanLee
                                last edited by

                                Screenshot 2024-04-05 at 15.19.35.png

                                I found the error for the tis-cafile that fixed some of the errors. I am going to resubmit the changes

                                Make sure to upvote

                                1 Reply Last reply Reply Quote 0
                                • JonathanLeeJ
                                  JonathanLee
                                  last edited by JonathanLee

                                  @JonathanLee said in Squid 6.6 DEV 24 Issues:

                                  2024/04/05 07:58:24| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead.

                                  Screenshot 2024-04-05 at 15.22.53.png

                                  This fixed the

                                  2024/04/05 07:58:24| WARNING: UPGRADE: 'cafile=/usr/local/share/certs/ca-root-nss.crt' is deprecated in http_port. Use 'tls-cafile=' instead.

                                  One error gone 1
                                  Screenshot 2024-04-05 at 16.00.22.png

                                  Make sure to upvote

                                  1 Reply Last reply Reply Quote 1
                                  • JonathanLeeJ
                                    JonathanLee
                                    last edited by

                                    If anyone wants to let me know what part of the cipher should be removed please let me know so I can fix the RC4 issue.

                                    https://github.com/pfsense/FreeBSD-ports/pull/1365

                                    Working on this also Per Squid support Amos Jeffries

                                    "Also there are a few weird things in your TLS cipher settings, such as this sequence " EECDH+aRSA+RC4:...:!RC4 "
                                    Which as I understand, enables the EECDH with RC4 hash, but also forbids all uses of RC4."

                                    Are we to disable RC4 because of the security issues? Or are we leaving it it has both listed.

                                    if (empty($settings['sslproxy_compatibility_mode']) || ($settings['sslproxy_compatibility_mode'] == 'modern')) {
					// Modern cipher suites
					$sslproxy_cipher = "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS";
					$sslproxy_options .= ",NO_TLSv1";
				} else {
					$sslproxy_cipher = "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS";
				}

                                    Make sure to upvote

                                    1 Reply Last reply Reply Quote 0
                                    • JonathanLeeJ
                                      JonathanLee
                                      last edited by

                                      FIX ME
                                      line of code 1261 in /usr/local/pkg/squid.inc
                                      FIX ME
                                      line of code 1235-1241 in usr/local/pkg/squid.inc

                                      Make sure to upvote

                                      JonathanLeeJ 1 Reply Last reply Reply Quote 0
                                      • JonathanLeeJ
                                        JonathanLee @JonathanLee
                                        last edited by

                                        @JonathanLee

                                        https://github.com/pfsense/FreeBSD-ports/pull/1366

                                        Fix for non support

                                        2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_DH_USE
                                        2024/04/05 07:58:24| ERROR: Unsupported TLS option SINGLE_ECDH_USE

                                        Make sure to upvote

                                        1 Reply Last reply Reply Quote 0
                                        • JonathanLeeJ
                                          JonathanLee
                                          last edited by

                                          HAPPY DANCE!! I FINALLY SOMETHING WITH SQUID'S CODE ALL MY COLLEGE AND UNIVERSITY WORK AND I FINALLY GOT TO FIX SOMETHING!!!!

                                          🏫

                                          Make sure to upvote

                                          1 Reply Last reply Reply Quote 1
                                          • JonathanLeeJ
                                            JonathanLee
                                            last edited by

                                            I have to go back to my Everything Bagel Version because my wife is home, but I changed the code on 5.8 and it fixed the errors also

                                            Make sure to upvote

                                            1 Reply Last reply Reply Quote 1
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.