LINUX.ORG.RU
ФорумAdmin

squid self ddos


0

0

Стоит freebsd 6.2, прозрачный squid 2.6.STABLE18 с pf

Конфиг squid: acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl SSL_ports port 443 563 5223 4343 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT acl Snmp_Comunity snmp_community squidsnmp acl My_Net src 192.168.14.0/24 http_access allow manager localhost http_access deny manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access deny to_localhost http_access allow My_Net http_access allow localhost http_access deny all http_reply_access allow all snmp_access allow Snmp_Comunity localhost snmp_access deny all icp_access allow all hierarchy_stoplist cgi-bin ? acl QUERY urlpath_regex cgi-bin \? cache deny QUERY access_log /usr/local/squid/logs/access.log squid refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern . 0 20% 4320 acl apache rep_header Server ^Apache broken_vary_encoding allow apache coredump_dir /usr/local/squid/cache cache_dir ufs /usr/local/squid/cache 5000 16 256 redirect_program /usr/local/bin/squidGuard redirect_children 10 redirector_bypass on error_directory /usr/local/etc/squid/errors/Russian-koi8-r delay_pools 1 delay_class 1 2 delay_access 1 allow My_Net delay_access 1 allow localhost delay_access 1 deny all delay_parameters 1 -1/-1 -1/-1 ie_refresh on snmp_incoming_address 127.0.0.1 http_port 127.0.0.1:3128 transparent http_port 192.168.14.1:3128 transparent visible_hostname proxy.localnet via off forwarded_for off logfile_rotate 0

В если в браузере набрать http://192.168.14.1:3128, то squid начинает ломится сам к себе и подвисает с с ошибкой: "httpAccept: FD 24: accept failure: (23) Too many open files in system" Можно конечно решить проблему следующим: acl to_self dst 192.168.14.1/32 acl squid_ports port 3128 http_access deny to_self squid_ports но нету ли решения покрасивее?

anonymous

Re: squid self ddos

Стоит freebsd 6.2, прозрачный squid 2.6.STABLE18 с pf

Конфиг squid:
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 563 5223 4343
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
acl Snmp_Comunity snmp_community squidsnmp
acl My_Net src 192.168.14.0/24
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny to_localhost
http_access allow My_Net
http_access allow localhost
http_access deny all
http_reply_access allow all
snmp_access allow Snmp_Comunity localhost
snmp_access deny all
icp_access allow all
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
access_log /usr/local/squid/logs/access.log squid
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern .               0       20%     4320
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
coredump_dir /usr/local/squid/cache
cache_dir ufs /usr/local/squid/cache 5000 16 256
redirect_program      /usr/local/bin/squidGuard
redirect_children 10
redirector_bypass on
error_directory /usr/local/etc/squid/errors/Russian-koi8-r
delay_pools 1
delay_class 1 2
delay_access 1 allow My_Net
delay_access 1 allow localhost
delay_access 1 deny all
delay_parameters 1 -1/-1 -1/-1
ie_refresh on
snmp_incoming_address 127.0.0.1
http_port 127.0.0.1:3128 transparent
http_port 192.168.14.1:3128 transparent
visible_hostname proxy.localnet
via off
forwarded_for off
logfile_rotate 0

В если в браузере набрать http://192.168.14.1:3128, то squid начинает ломится сам к себе и подвисает с с ошибкой: 
"httpAccept: FD 24: accept failure: (23) Too many open files in system"
Можно конечно решить проблему следующим:
acl to_self dst 192.168.14.1/32
acl squid_ports port 3128
http_access deny to_self squid_ports
но нету ли решения покрасивее?







anonymous ()
Ответ на: Re: squid self ddos от anonymous

Re: squid self ddos

хм...

http://localhost:3128/

=============================================================================== =====================
ERROR
The requested URL could not be retrieved

While trying to retrieve the URL: /

The following error was encountered:

* Invalid URL

Some aspect of the requested URL is incorrect. Possible problems:

* Missing or incorrect access protocol (should be `http://'' or similar)
* Missing hostname
* Illegal double-escape in the URL-Path
* Illegal character in hostname; underscores are not allowed

Your cache administrator is root.
Generated Sat, 09 Feb 2008 10:55:11 GMT by rhel4es-1.domain.tld (squid/2.5.STABLE6)
=============================================================================== =====================

на IP LAN то же самое

CentOS 4, относительно штатный конфиг

berrywizard ★★★★★ ()
Ответ на: Re: squid self ddos от berrywizard

Re: squid self ddos

На сквиде 2.5 у меня такой проблемы не было. Проблема возникла после установки squid 2.6

anonymous ()
Вы не можете добавлять комментарии в эту тему. Тема перемещена в архив.