squid won't start

qwertyjjj · 08-07-2009, 01:09 PM

I get the failed error when trying to start squid - any ideas?

Code:

[root@localhost ~]# service squid start
init_cache_dir /var/spool/squid... Starting squid: .       [  OK  ]
[root@localhost ~]# chkconfig squid on
[root@localhost ~]# /etc/init.d/squid start
Starting squid:                                            [FAILED]
[root@localhost ~]# vi /etc/squid/squid.conf
[root@localhost ~]# /etc/init.d/squid start
Starting squid:                                            [FAILED]

EricTRA · 08-07-2009, 01:19 PM

Hi,

Can you check your log files and post any eventual error? Log files are the very first place to check. Without more information nobody could give an answer to this question because we don't know your setup, system, etc...

Kind regards,

Eric

qwertyjjj · 08-07-2009, 01:21 PM

Quote:

Originally Posted by EricTRA

Hi,

Can you check your log files and post any eventual error? Log files are the very first place to check. Without more information nobody could give an answer to this question because we don't know your setup, system, etc...

Kind regards,

Eric

Hi - how do I do that?
It seems the service starts with service squid start but just not with that conf line...

kirukan · 08-07-2009, 01:23 PM

Quote:

[root@localhost ~]# service squid start
init_cache_dir /var/spool/squid... Starting squid: . [ OK ]
[root@localhost ~]# chkconfig squid on
[root@localhost ~]# /etc/init.d/squid start
Starting squid: [FAILED]
[root@localhost ~]# vi /etc/squid/squid.conf
[root@localhost ~]# /etc/init.d/squid start
Starting squid: [FAILED]

The first line you have started squid and it stated OK, then why do you start again and again? however check process whether squid start or not(ps ax | grep squid) and check relevant logs

qwertyjjj · 08-07-2009, 01:25 PM

Quote:

Originally Posted by kirukan

The first line you have started squid and it stated OK, then why do you start again and again? however check process whether squid start or not(ps ax | grep squid) and check relevant logs

doesn't the /etc/init.d/squid start do something different like ensure it is using the conf file?

kirukan · 08-07-2009, 01:29 PM

Quote:

service squid start
/etc/init.d/squid start
/etc/rc.d/init.d/squid start

All these are doing same thing, actually the startup script has saved under the above mentioned path

EricTRA · 08-07-2009, 01:29 PM

Check in the startup script what conf file gets called. Depends of what script you are using of course but there should be a line similar this:

Code:

# check if the squid conf file is present
  [ -f /etc/squid/squid.conf ] || exit 0

or at least a reference to 'a' conf file that gets called on starting.

Your startup script should be in /etc/init.d/ if I'm not mistaking (differs on some distros).

Kind regards,

Eric

qwertyjjj · 08-07-2009, 01:38 PM

Right...so it seems to be started.
I have set up ncsa auth but when I use the proxy IP through my browser nothing happens.
I can ping the server - any ideas what to check?

EricTRA · 08-07-2009, 01:47 PM

Quote:

Originally Posted by qwertyjjj

Right...so it seems to be started.
I have set up ncsa auth but when I use the proxy IP through my browser nothing happens.
I can ping the server - any ideas what to check?

Depends on what you want to happen, how you want it to work, how and what is configured, ...

I don't know your squid.conf so have no idea whatsoever how you configured squid and to do what.

The ncsa authentication helper depends on proxy_auth type acl so there should be at least one configured.

The easiest way is to post your squid.conf (after changing any personal information like ip addresses, servernames etc, and substituting them like server1.domain.com.

That way we'll have something to go on.

I hope this incoherent blubber is making sense?

Kind regards,

Eric

qwertyjjj · 08-07-2009, 01:59 PM

I don't seem to be able to copy all the squid.conf but I haven't changed much from the default.
I added these lines:

Quote:

1) Create the password file. The name of the password file should be /etc/squid/squid_passwd, and you need to make sure that it's universally readable.

[root@bigboy tmp]# touch /etc/squid/squid_passwd
[root@bigboy tmp]# chmod o+r /etc/squid/squid_passwd

2) Use the htpasswd program to add users to the password file. You can add users at anytime without having to restart Squid. In this case, you add a username called www:

[root@bigboy tmp]# htpasswd /etc/squid/squid_passwd www
New password:
Re-type new password:
Adding password for user www
[root@bigboy tmp]#

3) Find your ncsa_auth file using the locate command.

[root@bigboy tmp]# locate ncsa_auth
/usr/lib/squid/ncsa_auth
[root@bigboy tmp]#

4) Edit squid.conf; specifically, you need to define the authentication program in squid.conf, which is in this case ncsa_auth. Next, create an ACL named ncsa_users with the REQUIRED keyword that forces Squid to use the NCSA auth_param method you defined previously. Finally, create an http_access entry that allows traffic that matches the ncsa_users ACL entry. Here's a simple user authentication example; the order of the statements is important:

#
# Add this to the auth_param section of squid.conf
#
auth_param basic program /usr/lib/squid/ncsa_auth /etc/squid/squid_passwd

#
# Add this to the bottom of the ACL section of squid.conf
#
acl ncsa_users proxy_auth REQUIRED

#
# Add this at the top of the http_access section of squid.conf
#
http_access allow ncsa_users

and I also opened the iptables port

Quote:

:RH-Firewall-1-INPUT - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
-A INPUT -p udp -m udp --dport 69 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 69 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 110 -m state --state NEW -j ACCEPT
-A INPUT -p udp -m udp --dport 123 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3306 -m state --state NEW -j ACCEPT
-A INPUT -p udp -m udp --dport 3306 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5555 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8002 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 9001 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 3128 -j ACCEPT
-A INPUT -j DROP
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
COMMIT

Trying to get a response on port 3128 through my browser. It should at least prompt me for a password but it just says no response.

qwertyjjj · 08-07-2009, 02:03 PM

aha
it was the iptables line, I took out the duplicated RHFirewall part

EricTRA · 08-07-2009, 02:15 PM

Great troubleshooting work!

Did you just edit the original squid.conf file which is around 4000 lines in order to activate what you need? Remember that Squid processes the entire file and mistakes are easily made when your file is that big.

Better idea is to move the original to another name (mv squid.conf squid.ori), create a new one (touch squid.conf) and just put the lines that are applicable to you in it. That way it's a lot easier to read and you'll still have the original file as a reference.

Am I to understand you got everything up and running now? If so, great job.

Kind regards,

Eric

qwertyjjj · 08-07-2009, 02:30 PM

Quote:

Originally Posted by EricTRA

Great troubleshooting work!

Did you just edit the original squid.conf file which is around 4000 lines in order to activate what you need? Remember that Squid processes the entire file and mistakes are easily made when your file is that big.

Better idea is to move the original to another name (mv squid.conf squid.ori), create a new one (touch squid.conf) and just put the lines that are applicable to you in it. That way it's a lot easier to read and you'll still have the original file as a reference.

Am I to understand you got everything up and running now? If so, great job.

Kind regards,

Eric

Well, I have http up and running on port 3128.
Now I need to forward port 80 to 3128 and set up SSL but I'll leave that for another day.
Could I also do cp /etc/squid/squid.conf /etc/squid.squid.ori
and then delete lines in the current one?

EricTRA · 08-07-2009, 02:35 PM

Since you already made the changes that's of course a better option.

Have you compiled squid with --enable-ssl? If not then you woun't be able to use https.

Kind regards,

Eric

qwertyjjj · 08-07-2009, 02:37 PM

Quote:

Originally Posted by EricTRA

Since you already made the changes that's of course a better option.

Have you compiled squid with --enable-ssl? If not then you woun't be able to use https.

Kind regards,

Eric

So, I can't just turn it on in the conf file?
would it be yum install squid --option