root@OPNsense:/var/log/squid # ps auxwww | grep squidsquid 56643 0.0 0.1 149112 19228 - Is 13:28 0:00.00 /usr/local/sbin/squid -f /usr/local/etc/squid/squid.confsquid 57516 0.0 0.3 292964 52924 - S 13:28 0:00.17 (squid-1) --kid squid-1 -f /usr/local/etc/squid/squid.conf (squid)root 69827 0.0 0.0 12720 2392 1 S+ 13:35 0:00.00 grep squidroot@OPNsense:/var/log/squid # grep pid /usr/local/etc/squid/squid.confroot@OPNsense:/var/log/squid # grep pid /usr/local/etc/squid/squid.conf.squid.conf.documented squid.conf.sampleroot@OPNsense:/var/log/squid # grep pid /usr/local/etc/squid/squid.conf.documented# <pid>'.# TAG: pid_filename# Note: If you change this setting, you need to set squid_pidfile# pid_filename /var/run/squid/squid.pidroot@OPNsense:/var/log/squid # cat /var/run/squid/squid.pid56643root@OPNsense:/var/log/squid # kill -9 56643 57516root@OPNsense:/var/log/squid # ps auxwww | grep squidroot 80421 0.0 0.0 12720 2388 1 S+ 13:36 0:00.00 grep squidroot@OPNsense:/var/log/squid # rm /var/run/squid/squid.pid
root@OPNsense:/var/log/squid # /usr/local/etc/rc.d/squid startSegmentation faultStarting squid.Segmentation fault (core dumped)/usr/local/etc/rc.d/squid: WARNING: failed to start squidroot@OPNsense:/var/log/squid # ps auxwww | grep squidsquid 67739 1.4 0.3 292964 52868 - S 13:36 0:00.14 (squid-1) --kid squid-1 -f /usr/local/etc/squid/squid.conf (squid)squid 66736 0.6 0.1 149112 19228 - Ss 13:36 0:00.00 /usr/local/sbin/squid -f /usr/local/etc/squid/squid.confroot 93375 0.0 0.0 12720 2384 1 S+ 13:36 0:00.00 grep squidroot@OPNsense:/var/log/squid # cat /var/run/squid/squid.pid66736root@OPNsense:/var/log/squid #
root@firewall:/usr/local/etc/squid # squid -k parse2024/02/08 10:36:31| Processing Configuration File: /usr/local/etc/squid/squid.conf (depth 0)2024/02/08 10:36:31| Processing: http_port 10.10.2.1:3128 ssl-bump cert=/var/squid/ssl/ca.pem dynamic_cert_mem_cache_size=10MB generate-host-certificates=on2024/02/08 10:36:31| Processing: http_port 10.30.2.254:3128 ssl-bump cert=/var/squid/ssl/ca.pem dynamic_cert_mem_cache_size=10MB generate-host-certificates=on2024/02/08 10:36:31| Processing: http_port 10.10.50.1:3128 ssl-bump cert=/var/squid/ssl/ca.pem dynamic_cert_mem_cache_size=10MB generate-host-certificates=on2024/02/08 10:36:31| Processing: http_port 10.10.51.1:3128 ssl-bump cert=/var/squid/ssl/ca.pem dynamic_cert_mem_cache_size=10MB generate-host-certificates=on2024/02/08 10:36:31| Processing: sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/ssl_crtd -M 4MB2024/02/08 10:36:31| Processing: sslcrtd_children 52024/02/08 10:36:31| Processing: tls_outgoing_options options=NO_TLSv1 cipher=HIGH:MEDIUM:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS2024/02/08 10:36:31| Processing: acl bump_step1 at_step SslBump12024/02/08 10:36:31| Processing: acl bump_step2 at_step SslBump22024/02/08 10:36:31| Processing: acl bump_step3 at_step SslBump32024/02/08 10:36:31| Processing: acl bump_nobumpsites ssl::server_name "/usr/local/etc/squid/nobumpsites.acl"2024/02/08 10:36:31| WARNING: empty ACL: acl bump_nobumpsites ssl::server_name "/usr/local/etc/squid/nobumpsites.acl"2024/02/08 10:36:31| Processing: ssl_bump peek bump_step1 all2024/02/08 10:36:31| Processing: ssl_bump splice all2024/02/08 10:36:31| Processing: ssl_bump peek bump_step2 all2024/02/08 10:36:31| Processing: ssl_bump splice bump_step3 all2024/02/08 10:36:31| Processing: ssl_bump bump2024/02/08 10:36:31| Processing: sslproxy_cert_error deny all2024/02/08 10:36:31| Processing: acl ftp proto FTP2024/02/08 10:36:31| Processing: http_access allow ftp2024/02/08 10:36:31| Processing: acl localnet src 10.10.2.0/24 # Possible internal network (interfaces v4)2024/02/08 10:36:31| Processing: acl localnet src 10.30.2.254/32 # Possible internal network (aliases)2024/02/08 10:36:31| Processing: acl localnet src 10.10.50.0/24 # Possible internal network (interfaces v4)2024/02/08 10:36:31| Processing: acl localnet src 10.10.51.0/24 # Possible internal network (interfaces v4)2024/02/08 10:36:31| Processing: acl localnet src fc00::/7 # RFC 4193 local private network range2024/02/08 10:36:31| Processing: acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines2024/02/08 10:36:31| Processing: acl whiteList url_regex windowsupdate\.com2024/02/08 10:36:31| Processing: acl whiteList url_regex \.windowsupdate\.com2024/02/08 10:36:31| Processing: acl whiteList url_regex mp\.microsoft\.com2024/02/08 10:36:31| Processing: acl whiteList url_regex \.mp\.microsoft\.com2024/02/08 10:36:31| Processing: acl whiteList url_regex metaservices\.microsoft\.com2024/02/08 10:36:31| Processing: acl whiteList url_regex \.metaservices\.microsoft\.com2024/02/08 10:36:31| Processing: acl remoteblacklist_UT1 dstdomain "/usr/local/etc/squid/acl/UT1"2024/02/08 10:36:31| Processing: acl SSL_ports port 443 # https2024/02/08 10:36:31| Processing: acl Safe_ports port 80 # http2024/02/08 10:36:31| Processing: acl Safe_ports port 21 # ftp2024/02/08 10:36:31| Processing: acl Safe_ports port 443 # https2024/02/08 10:36:31| Processing: acl Safe_ports port 70 # gopher2024/02/08 10:36:31| Processing: acl Safe_ports port 210 # wais2024/02/08 10:36:31| Processing: acl Safe_ports port 1025-65535 # unregistered ports2024/02/08 10:36:31| Processing: acl Safe_ports port 280 # http-mgmt2024/02/08 10:36:31| Processing: acl Safe_ports port 488 # gss-http2024/02/08 10:36:31| Processing: acl Safe_ports port 591 # filemaker2024/02/08 10:36:31| Processing: acl Safe_ports port 777 # multiling http2024/02/08 10:36:31| Processing: acl CONNECT method CONNECT2024/02/08 10:36:31| Processing: icap_enable off2024/02/08 10:36:31| Processing: include /usr/local/etc/squid/pre-auth/*.conf2024/02/08 10:36:31| Processing Configuration File: /usr/local/etc/squid/pre-auth/40-snmp.conf (depth 1)2024/02/08 10:36:31| Processing Configuration File: /usr/local/etc/squid/pre-auth/dummy.conf (depth 1)2024/02/08 10:36:31| Processing Configuration File: /usr/local/etc/squid/pre-auth/parentproxy.conf (depth 1)2024/02/08 10:36:31| Processing: cache_peer 10.10.253.10 parent 3128 0 no-query default2024/02/08 10:36:31| Processing: acl ExcludePPDomains dstdomain .lan .wlan .purner.eu2024/02/08 10:36:31| Processing: acl ExcludePPIPs dst 10.10.2.0/24 10.10.10.0/24 10.10.20.0/24 10.10.30.0/24 10.10.31.0/24 10.10.40.0/24 10.10.50.0/24 10.10.51.0/24 10.10.60.0/24 10.10.61.0/24 10.10.70.0/24 10.10.71.0/24 10.10.200.0/24 10.10.201.0/24 10.10.254.0/24 172.30.30.0/24 10.2.0.1 10.96.0.1 10.98.0.1 172.30.100.0/24 10.10.253.0/242024/02/08 10:36:31| Processing: cache_peer_access 10.10.253.10 deny ExcludePPDomains2024/02/08 10:36:31| Processing: cache_peer_access 10.10.253.10 deny ExcludePPIPs2024/02/08 10:36:31| Processing: cache_peer_access 10.10.253.10 allow all2024/02/08 10:36:31| Processing: never_direct deny ExcludePPDomains2024/02/08 10:36:31| Processing: never_direct deny ExcludePPIPs2024/02/08 10:36:31| Processing: never_direct allow all2024/02/08 10:36:31| Processing: http_access allow whiteList2024/02/08 10:36:31| Processing: http_access deny remoteblacklist_UT12024/02/08 10:36:31| Processing: http_access deny !Safe_ports2024/02/08 10:36:31| Processing: http_access deny CONNECT !SSL_ports2024/02/08 10:36:31| Processing: http_access allow localhost manager2024/02/08 10:36:31| Processing: http_access deny manager2024/02/08 10:36:31| Processing: http_access deny to_localhost2024/02/08 10:36:31| Processing: include /usr/local/etc/squid/auth/*.conf2024/02/08 10:36:31| Processing Configuration File: /usr/local/etc/squid/auth/dummy.conf (depth 1)2024/02/08 10:36:31| Processing: http_access allow localnet2024/02/08 10:36:31| Processing: http_access allow localhost2024/02/08 10:36:31| Processing: http_access deny all2024/02/08 10:36:31| Processing: include /usr/local/etc/squid/post-auth/*.conf2024/02/08 10:36:31| Processing Configuration File: /usr/local/etc/squid/post-auth/dummy.conf (depth 1)2024/02/08 10:36:31| Processing: cache_mem 256 MB2024/02/08 10:36:31| Processing: coredump_dir /var/squid/cache2024/02/08 10:36:31| Processing: refresh_pattern ^ftp: 1440 20% 100802024/02/08 10:36:31| Processing: refresh_pattern ^gopher: 1440 0% 14402024/02/08 10:36:31| Processing: refresh_pattern -i (/cgi-bin/|\?) 0 0% 02024/02/08 10:36:31| Processing: refresh_pattern . 0 20% 43202024/02/08 10:36:31| Processing: access_log stdio:/var/log/squid/access.log squid2024/02/08 10:36:31| Processing: cache_store_log none2024/02/08 10:36:31| Processing: httpd_suppress_version_string on2024/02/08 10:36:31| Processing: uri_whitespace strip2024/02/08 10:36:31| Processing: forwarded_for on2024/02/08 10:36:31| Processing: logfile_rotate 02024/02/08 10:36:31| Processing: cache_mgr proxy@purner.eu2024/02/08 10:36:31| Processing: error_directory /usr/local/etc/squid/errors/local2024/02/08 10:36:31| Requiring client certificates.2024/02/08 10:36:31| Loaded signing certificate: /C=AT/ST=AT/L=AT/O=AT/emailAddress=/CN=opnsense-vpn-ca2024/02/08 10:36:31| Not requiring any client certificates2024/02/08 10:36:31| Loaded signing certificate: /C=AT/ST=AT/L=AT/O=AT/emailAddress=/CN=opnsense-vpn-ca2024/02/08 10:36:31| Not requiring any client certificates2024/02/08 10:36:31| Loaded signing certificate: /C=AT/ST=AT/L=AT/O=AT/emailAddress=/CN=opnsense-vpn-ca2024/02/08 10:36:31| Not requiring any client certificates2024/02/08 10:36:31| Loaded signing certificate: /C=AT/ST=AT/L=AT/O=AT/emailAddress=/CN=opnsense-vpn-ca2024/02/08 10:36:31| Not requiring any client certificatesSegmentation fault (core dumped)
root@firewall:/usr/local/etc/squid # netstat -an | grep 3128 | wc -l 4
root@firewall:/usr/local/etc/squid # pkg info | grep squidos-squid-1.0 Squid is a caching proxy for the websquid-6.6 HTTP Caching Proxysquid-langpack-7.0.0.20230225 Language-specific error documents for Squid web cache
root@OPNsense:/usr/local/etc/squid # cat squid.conf## Automatic generated configuration for Squid.# Do not edit this file manually.## Setup regular listeners configurationhttp_port 10.20.245.10:3129acl ftp proto FTPhttp_access allow ftp# Setup ftp proxy# Rules allowing access from your local networks.# Generated list of (internal) IP networks from where browsing# should be allowed. (Allow interface subnets).# Default allow for local-link and private networksacl localnet src fc00::/7 # RFC 4193 local private network rangeacl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines# ACL - Allow localhost for PURGE cache if enabled# ACL lists# ACL - Allow Subnets - User defined (subnets)acl subnets src 10.120.56.0/22acl subnets src 10.120.60.0/22acl subnets src 10.20.48.0/20acl subnets src 10.120.49.0/24acl subnets src 10.120.50.0/24acl subnets src 10.120.51.0/24acl subnets src 10.120.52.0/24acl subnets src 10.121.48.0/22acl subnets src 10.20.245.8/29acl subnets src 10.20.112.200/32acl subnets src 10.120.48.0/24# ACL - Remote fetched Blacklist (remoteblacklist)# ACL - Block browser/user-agent - User defined (browser)# ACL - SSL ports, default are configured in config.xml# Configured SSL ports (if defaults are not listed, then they have been removed from the configuration!):acl SSL_ports port 82 # unknownacl SSL_ports port 8080 # unknownacl SSL_ports port 443 # httpsacl SSL_ports port 5228-5230 # unknown# Default Safe ports are now defined in config.xml# Configured Safe ports (if defaults are not listed, then they have been removed from the configuration!):# ACL - Safe_portsacl Safe_ports port 82 # unknownacl Safe_ports port 8080 # unknownacl Safe_ports port 80 # httpacl Safe_ports port 443 # httpsacl Safe_ports port 5228-5230 # unknownacl CONNECT method CONNECT# ICAP SETTINGS# disable icapicap_enable off# Pre-auth pluginsinclude /usr/local/etc/squid/pre-auth/*.conf# Authentication Settings# Google Suite Filter# YouTube Filterrequest_header_add YouTube-Restrict moderate# Deny requests to certain unsafe portshttp_access deny !Safe_ports# Deny CONNECT to other than secure SSL portshttp_access deny CONNECT !SSL_ports# Only allow cachemgr access from localhosthttp_access allow localhost managerhttp_access deny manager# We strongly recommend the following be uncommented to protect innocent# web applications running on the proxy server who think the only# one who can access services on "localhost" is a local userhttp_access deny to_localhost# Auth pluginsinclude /usr/local/etc/squid/auth/*.conf## Access Permission configuration:## Deny request from unauthorized clients## ACL - localnet - default these include ranges from selected interfaces (Allow local subnets)http_access allow localnet# ACL - localhosthttp_access allow localhost# ACL list (Allow) subnetshttp_access allow subnets# Deny all other access to this proxyhttp_access deny all# Post-auth pluginsinclude /usr/local/etc/squid/post-auth/*.conf# Caching settingscache_mem 4096 MBmaximum_object_size 32 MBcache_replacement_policy heap LFUDAmaximum_object_size_in_memory 2048 KB# Leave coredumps in the first cache dircoredump_dir /var/squid/cache## Add any of your own refresh_pattern entries above these.#refresh_pattern ^ftp: 1440 20% 10080refresh_pattern ^gopher: 1440 0% 1440refresh_pattern -i (/cgi-bin/|\?) 0 0% 0refresh_pattern . 0 20% 4320# Squid Optionspinger_enable offaccess_log stdio:/var/log/squid/access.log squid# Disable cache store logcache_store_log nonedns_nameservers 172.16.48.247# Suppress http version string (default=off)httpd_suppress_version_string on# URI handling with Whitespaces (default=strip)uri_whitespace strip# X-Forwarded header handling (default=on)forwarded_for on# Disable squid logfile rotate to use system defaultslogfile_rotate 0# Define visible hostnamevisible_hostname proxy.at.bldg.name# Set error directory languageerror_directory /usr/local/etc/squid/errors/local
# cat auth/local.confshutdown_lifetime 0 secondsacl to_ipv6 dst ipv6acl from_ipv6 src ipv6http_access deny to_ipv6http_access deny from_ipv6positive_dns_ttl 5 minutesclient_db offmemory_pools offpinger_enable offread_timeout 5 minute # default 15write_timeout 5 minutes # default 15max_filedescriptors 204800digest_generation offipcache_size 4096workers 1accept_filter httpreadyaccept_filter datareadycollapsed_forwarding onhalf_closed_clients offpipeline_prefetch 6 # default 0## timeoutsforward_timeout 1 minute # default 4connect_timeout 1 minute # default 1request_timeout 1 minute # default 5client_lifetime 2 hours # default 24# quick_abort_min 0 KB# quick_abort_max 0 KB# we recommend first tuning the read_timeout,# request_timeout, persistent_request_timeout and quick_abort values.happy_eyeballs_connect_timeout 30 # default 250pconn_lifetime 60 seconds # default 0
# kldstat | grep 'http\|data' 4 1 0xffffffff823ea000 2828 accf_data.ko 6 1 0xffffffff823f2000 2e38 accf_http.ko cat /boot/loader.conf.localcc_htcp_load="YES"accf_http_load="YES"accf_data_load="YES"accf_dns_load="YES"machdep.hyperthreading_intr_allowed=1# net.inet.tcp.tso=0kern.ipc.nmbclusters=2048000kern.ipc.nmbjumbop=524288
find / -name \*.core | xargs ls -al-rw------- 1 root squid 16470016 Feb 7 13:26 /usr/local/etc/squid/squid.core-rw------- 1 root wheel 704512 Nov 9 23:04 /usr/local/opnsense/service/php.core-rw------- 1 root wheel 176029696 Nov 29 09:01 /usr/local/opnsense/service/python3.9.core-rw------- 1 root wheel 11051008 Oct 25 23:12 /usr/local/www/pfctl.core-rw------- 1 root wheel 33144832 Jul 31 2023 /var/db/syslog-ng.core-rwxr-x--- 1 squid squid 639852544 Feb 7 13:25 /var/squid/cache/squid.core-rwxr-x--- 1 squid squid 16470016 Feb 7 13:36 /var/squid/squid.core
