Squid 3.3.10 para pfsense 2.0 e 2.1 com filtro de SSL/HTTPS

gst.freitas · May 14, 2013, 12:19 AM

tem alguma ideia ??

marcelloc · May 14, 2013, 12:22 AM

tem alguma ideia ??

O squid está execuando? está ouvindo na porta que você configurou?

gst.freitas · May 14, 2013, 12:29 AM

[2.0.3-RELEASE][admin@pfSensel]/usr/local/lib(11): netstat -na | grep "3128"
tcp4       0      0 127.0.0.1.3128         *.*                    CLOSED
tcp4       0      0 192.168.0.1.3128       *.*                    CLOSED

root   19474  0.0  0.3 36312 10916  ??  Is    9:05PM   0:00.00 /usr/local/sbin/squid -f /usr/local/etc/squid/squid.conf
proxy  20154  0.0  0.4 48604 16680  ??  I     9:05PM   0:00.04 (squid-1) -f /usr/local/etc/squid/squid.conf (squid)

marcelloc · May 14, 2013, 1:43 AM

Está funcionando…

gst.freitas · May 14, 2013, 2:00 AM

mas o squidguard não..

gst.freitas · May 14, 2013, 10:31 PM

Tentei de varias formas fazer o squid funcionar e o squidguard tambem.. a maquina simplesmente não navega.. e não loga
os acesso, mesmo com o squid ativo.

Escolhi a opção transparente e não transparente.. escolhendo as intefaces "LAN"..

Gustavo

marcelloc · May 14, 2013, 11:06 PM

Tente sem o squidguard e veja nos logs do squid, principalmente o cache.log.

gst.freitas · May 14, 2013, 11:24 PM

desabilitei a integração, reinstalei o pacote.. e nada

segue o log no cache.log

2013/05/14 20:32:44 kid1| '/usr/local/etc/squid/errors/Portuguese/ERR_SECURE_CONNECT_FAIL': (2) No such file or directory
2013/05/14 20:32:44 kid1| Unable to load default error language files. Reset to backups.
2013/05/14 20:32:44 kid1| '/usr/local/etc/squid/errors/Portuguese/ERR_UNSUP_HTTPVERSION': (2) No such file or directory
2013/05/14 20:32:44 kid1| Unable to load default error language files. Reset to backups.
2013/05/14 20:32:44 kid1| '/usr/local/etc/squid/errors/Portuguese/ERR_PRECONDITION_FAILED': (2) No such file or directory
2013/05/14 20:32:44 kid1| Unable to load default error language files. Reset to backups.
2013/05/14 20:32:44 kid1| '/usr/local/etc/squid/errors/Portuguese/ERR_CONFLICT_HOST': (2) No such file or directory
2013/05/14 20:32:44 kid1| Unable to load default error language files. Reset to backups.
2013/05/14 20:32:44 kid1| '/usr/local/etc/squid/errors/Portuguese/ERR_ESI': (2) No such file or directory
2013/05/14 20:32:44 kid1| Unable to load default error language files. Reset to backups.
2013/05/14 20:32:44 kid1| '/usr/local/etc/squid/errors/Portuguese/ERR_ICAP_FAILURE': (2) No such file or directory
2013/05/14 20:32:44 kid1| Unable to load default error language files. Reset to backups.
2013/05/14 20:32:44 kid1| '/usr/local/etc/squid/errors/Portuguese/ERR_GATEWAY_FAILURE': (2) No such file or directory
2013/05/14 20:32:44 kid1| Unable to load default error language files. Reset to backups.
2013/05/14 20:32:44 kid1| '/usr/local/etc/squid/errors/Portuguese/ERR_DIR_LISTING': (2) No such file or directory
2013/05/14 20:32:44 kid1| Unable to load default error language files. Reset to backups.
2013/05/14 20:32:44 kid1| '/usr/local/etc/squid/errors/Portuguese/error-details.txt': (2) No such file or directory
2013/05/14 20:32:44 kid1| Unable to load default error language files. Reset to backups.
2013/05/14 20:32:44 kid1| Logfile: opening log /var/squid/logs/access.log
2013/05/14 20:32:44 kid1| WARNING: log parameters now start with a module name. Use 'stdio:/var/squid/logs/access.log'
2013/05/14 20:32:44 kid1| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec
2013/05/14 20:32:44 kid1| Store logging disabled
2013/05/14 20:32:44 kid1| Swap maxSize 0 + 8192 KB, estimated 630 objects
2013/05/14 20:32:44 kid1| Target number of buckets: 31
2013/05/14 20:32:44 kid1| Using 8192 Store buckets
2013/05/14 20:32:44 kid1| Max Mem  size: 8192 KB
2013/05/14 20:32:44 kid1| Max Swap size: 0 KB
2013/05/14 20:32:44 kid1| Using Least Load store dir selection
2013/05/14 20:32:44 kid1| Current Directory is /usr/local/www
2013/05/14 20:32:44 kid1| Loaded Icons.
2013/05/14 20:32:44 kid1| HTCP Disabled.
2013/05/14 20:32:44 kid1| WARNING: no_suid: setuid(0): (1) Operation not permitted
2013/05/14 20:32:44 kid1| sendto FD 19: (1) Operation not permitted
2013/05/14 20:32:44 kid1| ipcCreate: CHILD: hello write test failed

marcelloc · May 15, 2013, 12:35 AM

Consegue interpretar o que o log esta mostrando?

Mude a linguagem do relatório.

Subi uma atualização agora a pouco para corrigir os warnings de acl para 127.0.0.1. Basta reinstalar o pacote.

gst.freitas · May 15, 2013, 12:46 AM

ja mudei. e continua sem acessar.. só acessa sem passar pelo proxy..

marcelloc · May 15, 2013, 1:21 AM

@gst.freitas:

ja mudei. e continua sem acessar.. só acessa sem passar pelo proxy..

E o que tem nos logs? Passe mais informações para facilitar o diagnostico.

gst.freitas · May 15, 2013, 1:41 AM

2013/05/14 21:52:04 kid1| Max Mem  size: 8192 KB
2013/05/14 21:52:04 kid1| Max Swap size: 0 KB
2013/05/14 21:52:04 kid1| Using Least Load store dir selection
2013/05/14 21:52:04 kid1| Current Directory is /usr/local/www
2013/05/14 21:52:04 kid1| Loaded Icons.
2013/05/14 21:52:04 kid1| HTCP Disabled.
2013/05/14 21:52:04 kid1| WARNING: no_suid: setuid(0): (1) Operation not permitted
2013/05/14 21:52:04 kid1| sendto FD 19: (1) Operation not permitted
2013/05/14 21:52:04 kid1| ipcCreate: CHILD: hello write test failed

as telas

marcelloc · May 15, 2013, 1:58 AM

ps ax | grep squid

nestat -an | grep -i listen

Consegue ver o squid rodando e ouvindo na 3128?

gst.freitas · May 15, 2013, 2:43 AM

esta rodando, mas não na porta, apesar que esta setado na 3128.

[2.0.3-RELEASE][admin@pfSense]/var/squid/logs(31): netstat  -an | grep -i listen
tcp4       0      0 *.80                   *.*                    LISTEN
tcp4       0      0 *.8080                 *.*                    LISTEN
tcp6       0      0 *.53                   *.*                    LISTEN
tcp4       0      0 *.53                   *.*                    LISTEN
tcp4       0      0 *.443                  *.*                    LISTEN
tcp4       0      0 *.22                   *.*                    LISTEN
tcp6       0      0 *.22                   *.*                    LISTEN
[2.0.3-RELEASE][admin@pfSense]/var/squid/logs(32): ps ax | grep squid
 3776  ??  Is     0:00.00 /usr/local/sbin/squid -f /usr/local/etc/squid/squid.conf
 4021  ??  I      0:00.08 (squid-1) -f /usr/local/etc/squid/squid.conf (squid)
25013   0  R+     0:00.00 grep squid

a porta esta CLOSED..

tcp4       0      0 192.168.0.8.8080       192.168.0.3.50584      ESTABLISHED
tcp4       0      0 127.0.0.1.3128         *.*                    CLOSED
tcp4       0      0 192.168.0.8.3128       *.*                    CLOSED
tcp4       0     52 192.168.0.8.22         192.168.0.3.59640      ESTABLISHED

continua apresentando erro de linguagem.. mesmo escolhendo "ingles"

2013/05/14 23:51:36 kid1| '/usr/local/etc/squid/errors/English/ERR_SECURE_CONNECT_FAIL': (2) No such file or directory
2013/05/14 23:51:36 kid1| Unable to load default error language files. Reset to backups.
2013/05/14 23:51:36 kid1| '/usr/local/etc/squid/errors/English/ERR_UNSUP_HTTPVERSION': (2) No such file or directory
2013/05/14 23:51:36 kid1| Unable to load default error language files. Reset to backups.
2013/05/14 23:51:36 kid1| '/usr/local/etc/squid/errors/English/ERR_PRECONDITION_FAILED': (2) No such file or directory
2013/05/14 23:51:36 kid1| Unable to load default error language files. Reset to backups.
2013/05/14 23:51:36 kid1| '/usr/local/etc/squid/errors/English/ERR_CONFLICT_HOST': (2) No such file or directory
2013/05/14 23:51:36 kid1| Unable to load default error language files. Reset to backups.
2013/05/14 23:51:36 kid1| '/usr/local/etc/squid/errors/English/ERR_ESI': (2) No such file or directory
2013/05/14 23:51:36 kid1| Unable to load default error language files. Reset to backups.
2013/05/14 23:51:36 kid1| '/usr/local/etc/squid/errors/English/ERR_ICAP_FAILURE': (2) No such file or directory
2013/05/14 23:51:36 kid1| Unable to load default error language files. Reset to backups.
2013/05/14 23:51:36 kid1| '/usr/local/etc/squid/errors/English/ERR_GATEWAY_FAILURE': (2) No such file or directory
2013/05/14 23:51:36 kid1| Unable to load default error language files. Reset to backups.
2013/05/14 23:51:36 kid1| '/usr/local/etc/squid/errors/English/ERR_DIR_LISTING': (2) No such file or directory
2013/05/14 23:51:36 kid1| Unable to load default error language files. Reset to backups.
2013/05/14 23:51:36 kid1| '/usr/local/etc/squid/errors/English/error-details.txt': (2) No such file or directory
2013/05/14 23:51:36 kid1| Unable to load default error language files. Reset to backups.
2013/05/14 23:51:36 kid1| Logfile: opening log /var/squid/logs/access.log
2013/05/14 23:51:36 kid1| WARNING: log parameters now start with a module name. Use 'stdio:/var/squid/logs/access.log'
2013/05/14 23:51:36 kid1| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec
2013/05/14 23:51:36 kid1| Store logging disabled
2013/05/14 23:51:36 kid1| Swap maxSize 0 + 8192 KB, estimated 630 objects
2013/05/14 23:51:36 kid1| Target number of buckets: 31
2013/05/14 23:51:36 kid1| Using 8192 Store buckets
2013/05/14 23:51:36 kid1| Max Mem  size: 8192 KB
2013/05/14 23:51:36 kid1| Max Swap size: 0 KB
2013/05/14 23:51:36 kid1| Using Least Load store dir selection
2013/05/14 23:51:36 kid1| Current Directory is /usr/local/www
2013/05/14 23:51:36 kid1| Loaded Icons.
2013/05/14 23:51:36 kid1| HTCP Disabled.
2013/05/14 23:51:36 kid1| WARNING: no_suid: setuid(0): (1) Operation not permitted
2013/05/14 23:51:36 kid1| sendto FD 19: (1) Operation not permitted
2013/05/14 23:51:36 kid1| ipcCreate: CHILD: hello write test failed

marcelloc · May 15, 2013, 10:13 AM

Tenta esta versão do squid compilada sem ipv6

amd64
http://e-sac.siteseguro.ws/packages/amd64/8/All/squid-3.3.4.tbz

i386
http://e-sac.siteseguro.ws/packages/8/All/squid-3.3.4.tbz

Com relação a linguagem do report, veja quais existem no filesystem, antes de alterar.

thiagomespb · May 15, 2013, 11:25 AM

Marcelo,

Tambem fiz o teste e deu erro, como se instala essa versão sem o ipv6.

marcelloc · May 15, 2013, 12:49 PM

@thiagomespb:

Marcelo,

Tambem fiz o teste e deu erro, como se instala essa versão sem o ipv6.

Instala o squid3-dev de depois na console instala esta versão sem ipv6 com o pkg_add -rf url_para_o_pacote.

Lembre de postar mais detalhes como os que descrevi no post acima.

dbannack · May 15, 2013, 2:31 PM

Ola,

Com a versão sem ipv6 tá funcionando…
Mais como faço p/ funcionar o ssl na 443, não estou conseguindo setar os certificados..
Fica aparecendo a mensagem de erro de certificado no navegador..
Consegue nos passar uma breve explicação para fazer a configuração dos certificados da ssl?

marcelloc · May 15, 2013, 2:33 PM

@dbannack:

Consegue nos passar uma breve explicação para fazer a configuração dos certificados da ssl?

Cria uma ca e um certificado no pfsense(system -> cert manager) no lugar de usar o certificado webconfigurator padrão.

didonsom · May 15, 2013, 6:11 PM

Olá Marcelloc Boa tarde!

Sabe dizer se agora com esse novo pacote do squid o sguidguard exibe a sgerror.php em paginas https?

abraços

Diego