URL: https://www.opennet.me/cgi-bin/openforum/vsluhboard.cgi
Форум: vsluhforumID1
Нить номер: 86333
[ Назад ]

Исходное сообщение
"Frox +firefox +IE+squid"

Отправлено Tio , 19-Авг-09 18:13 
Народ! Подскажите, нормально ли то, что указанные в теме броузеры не работют с frox?
У меня и TotalCommander, DowmloadMaster, обычный ftp из программ Windows работают нормально.

А эти 2 броузера ругаются. На команде List зависают:
Wed Aug 19 17:51:27 2009 frox[6650]   C: USER anonymous

Wed Aug 19 17:51:27 2009 frox[6650]   S: 331 Anonymous login ok, send your complete email address as your password.

Wed Aug 19 17:51:27 2009 frox[6650]   C: PASS mozilla@example.com

Wed Aug 19 17:51:28 2009 frox[6650]   S: 230-*************************************************************************

Wed Aug 19 17:51:28 2009 frox[6650]   S:  Welcome to ftp.slackware.com,

Wed Aug 19 17:51:28 2009 frox[6650]   S:  

Wed Aug 19 17:51:28 2009 frox[6650]   S:  You are user 31 of 96.

Wed Aug 19 17:51:28 2009 frox[6650]   S:  

Wed Aug 19 17:51:28 2009 frox[6650]   S:  On This Site:

Wed Aug 19 17:51:28 2009 frox[6650]   S:  /pub/slackware/               Slackware Linux

Wed Aug 19 17:51:28 2009 frox[6650]   S:  

Wed Aug 19 17:51:28 2009 frox[6650]   S:  If you experience any problems e-mail us:  volkerdi@slackware.com

Wed Aug 19 17:51:28 2009 frox[6650]   S:  *************************************************************************

Wed Aug 19 17:51:28 2009 frox[6650]   S:  

Wed Aug 19 17:51:28 2009 frox[6650]   S: 230 Anonymous access granted, restrictions apply.

Wed Aug 19 17:51:28 2009 frox[6650]   C: SYST

Wed Aug 19 17:51:28 2009 frox[6650]   S: 215 UNIX Type: L8

Wed Aug 19 17:51:28 2009 frox[6650]   C: PWD

Wed Aug 19 17:51:29 2009 frox[6650]   S: 257 "/" is current directory.

Wed Aug 19 17:51:29 2009 frox[6650]   C: TYPE I

Wed Aug 19 17:51:29 2009 frox[6650]   S: 200 Type set to I

Wed Aug 19 17:51:29 2009 frox[6650]   Intercepted a PASV command
Wed Aug 19 17:51:29 2009 frox[6650]   C: PASV

Wed Aug 19 17:51:29 2009 frox[6650]   Rewritten 227 reply:
Wed Aug 19 17:51:29 2009 frox[6650]   S: 227 Entering Passive Mode (192,168,2,63,158,172)

Wed Aug 19 17:51:29 2009 frox[6650]   C: CWD /

Wed Aug 19 17:51:29 2009 frox[6650]   S: 250 CWD command successful

Wed Aug 19 17:51:29 2009 frox[6650] Strictpath = "%2f/"
Wed Aug 19 17:51:29 2009 frox[6650]   C: LIST

И ещё: я настроил forx для работы со squid. Судя по store.log - все нормально - объекты попадают в кэш прокси. Но при этом ни одной записи в access.log, хотя я ему уже дал 667.

Куда копать?


Содержание

Сообщения в этом обсуждении
"Frox +firefox +IE+squid"
Отправлено Gerk , 20-Авг-09 01:30 
и конфиги Вы конечно же привели.
Сейчас часок-другой медитации и скажем где в конфигах ошибка )))))))))))))))))

"Frox +firefox +IE+squid"
Отправлено Tio , 20-Авг-09 11:00 
>и конфиги Вы конечно же привели.
>Сейчас часок-другой медитации и скажем где в конфигах ошибка )))))))))))))))))

frox.conf

# Configuration file for frox transparent ftp-proxy.

# Send SIGHUP after editing and it will be reread. This will fail
# completely if we are chrooted and the config file isn't within the
# dir we have chrooted to, or if we have dropped priveleges and no
# longer have permission to read the config file! Some options cannot
# be reread - namely those which require special privelidges (ie.
# BindToDevice, Listen, Port, TransparentData) and the caching stuff.


####################################################################
# Network Options                                                  #
####################################################################

# Address to listen on - default is 0.0.0.0 If you are using an OS other
# than Linux and are doing transparent proxying then you will need to set
# this to the IP of a local interface. If using linux you could leave it
# commented out to listen on all local IPs.
#
# Listen firewall.localnet
#Listen 192.168.2.63


# Port to listen on. Must be supplied.
#
Port 2121

# If specified then bind to this device
#
#BindToDevice eth1

# Whether to run from inetd. You should still define Port above, but
# it isn't used for much.
#
# FromInetd yes

# Stop frox from putting itself into the background. Use this if you want
# to run frox from supervise from djb's daemontools
#
# NoDetach

# A hack that should allow you to get away without putting resolver libraries
# into the chroot jail. The default is fine unless for some reason you have
# this hostname in /etc/hosts. If this sort of thing offends you, you may
# comment this out and copy resolver libraries into the chroot jail instead.
# See FAQ section 3.2 for details.
#
ResolvLoadHack wontresolve.doesntexist.abc

# Another ftp proxy to forward on to. Frox will contact this ftp
# proxy, and send it a login name of the form "user@host:port" where
# host and port are the server frox should contact. If you set
# FTPProxyNoPort then frox will send logins of the form user@host
#
# FTPProxy 192.168.2.9:2222
# FTPProxyNoPort yes

# Pick the IP frox should use for outgoing connections. You probably don't
# need this, and it is not well tested.
#
# TcpOutgoingAddr

# Pick the IP that frox should send in PASV replies to the client. Defaults
# to the address frox received the control connection on which you shouldn't
# need to change unless you are doing NAT between frox and your clients, or
# are trying to tunnel connections using frox. See FAQ.
#
# PASVAddress

####################################################################
# General Options                                                  #
####################################################################
# User and group to drop priveliges to. This must be specified - if
# you really want to run as root (not a good idea) you must say so
# specifically, and have compiled with --enable-run-as-root.
#
User nobody
Group nogroup

# This is frox's working directory - it must be specified. Temporary
# files and sockets will be created here. If you are using local
# caching then the cache will be stored in this directory too. It
# should be owned by frox with permissions 700. By default frox will
# also chroot to this dir on startup. To avoid this you must specifically
# set DontChroot to Yes.
#
WorkingDir /usr/local/lib/frox
# DontChroot Yes

# Logging level. 0=No logging. 5=Critical errors only. 10= All errors.
# 15=Errors, other important stuf. 20= Errors, connections, cache
# hits/misses 25=Debug info including text of control session. By
# default frox will log through syslog as facility daemon. If you want
# frox to log to a file instead specify this in LogFile below. You may
# set LogFile to "stderr" if you wish it to log there. XferLogging
# defaults to on, and results in a one line log entry for each file
# transferred irrespective of the log level. You can turn this off
# below.
#
LogLevel 25
LogFile /var/log/frox.log
# XferLogging no

# File to store PID in. Default is not to. If this file is not within
# the Chroot directory then it cannot be deleted on exit, but will
# otherwise work fine.
#
PidFile /var/run/frox.pid


####################################################################
# Ftp Protocol Options                                             #
####################################################################

# Active --> Passive conversion. If set then all outgoing connections
# from the proxy will be passive FTP, regardless of the type of the
# connection coming in. This makes firewalling a lot easier. Defaults
# to no.
#
# APConv yes

# Passive --> Active conversion. If set then all outgoing connections
# from the proxy will be active FTP, regardless of the type of the
# connection coming in. Defaults to no.
# DO NOT USE WITH APConv!
#
# PAConv yes

# Block PORT commands asking data to be sent to ports<1024 and
# prevent incoming control stream connections from port 20 to
# help depend against ftp bounce attacks. Defaults to on.
#
BounceDefend yes

# If true then only accept data connections from the hosts the control
# connections are to. Breaks the rfc, and defaults to off.
#
# SameAddress yes

# Normally frox strips out nonprintable characters from the control
# stream. This makes buffer overflow attacks on clients/servers much more
# difficult. If you download files that contain non english characters
# this may cause you problems (especially for big charsets like Chines).
# In that case turn on this option.
#
AllowNonASCII yes

# Try to transparently proxy the data connections as well. Not
# necessary for most clients, and does increase security risks. N.V.
# You probably do _NOT_ need this option. It increases the complexity
# of what frox has to do, increases the difficulty of setting frox up
# correctly, and increases potential security risks. This has nothing
# to do with whether your clients will be transparently proxied. If
# you still want to use this option then read README.transdata for
# details.
#
# TransparentData yes

# Specify ranges for local ports to use for outgoing connections and
# for sending out in PORT commands. By default these are all between
# 40000 and 50000, but you might want to split them up if you have
# complicated firewalling rules.
#
# ControlPorts 40000-40999
# PassivePorts 41000-41999
# ActivePorts  42000-42999

# SSL/AUTH support. Frox must have been linked to the openssl libraries.
# This is currently experimental, and only tested against vsftpd
#
# UseSSL yes
# DataSSL no

####################################################################
# Caching Options                                                  #
####################################################################

# Caching options. There should be at most one CacheModule line, and
# Cache lines to give the options for that caching module. CacheModule
# is HTTP (rewrites ftp requests as HTTP and sends them to a HTTP
# proxy like squid), or local (cache files locally). The relevant
# module needs to have been compiled in at compile time. See FAQ for
# details. If there are no CacheModule lines then no caching will be
# done. "CacheModule None" explicitly requests no caching, and is
# useful to turn off caching within a subsection (below).
#
# CacheModule local
# CacheSize 400
#
CacheModule http
HTTPProxy 127.0.0.1:3128
MinCacheSize 5
# ForceHTTP no  # Set to yes to force http file retreiving even if
#               # file is not cacheable
#
# StrictCaching no  # Read FAQ for details.
# CacheOnFQDN yes   # Read FAQ for details.
#
# CacheAll no   # Set to yes to cache non anonymous ftp downloads

# Virus scanning -- see FAQ
#
# VirusScanner '"/usr/bin/viruscan" "--option" "%s"'
# VSOK 0
# VSProgressMsgs 30


squid.conf:

##################################### ACL ######################################
#You can disable allowing only Q packets here, but I recommend to pass only them //Eugen
acl manager proto cache_object
acl root_host src 192.168.2.199
acl localhost src 127.0.0.1/255.255.255.255
acl bad_sites url_regex -i "/etc/squid/bw.regex"
acl good_sites url_regex -i "/etc/squid/gw.regex"

# для получения информации от squid

http_access allow manager localhost
http_access deny manager


# наши подсети

acl Q src 192.168.2.0/24
acl W    src 192.168.3.0/24

# для удаления объектов из кэша вручную

acl PURGE method PURGE
http_access allow PURGE localhost
http_access deny PURGE


# для наших собстсвенных боевых серверов заперщаем кэширование по диапазонам ip

acl Nocacheips dst "/etc/squid/nocacheips.regex"
cache deny Nocacheips

# для ftp

acl ftp proto FTP
http_access allow ftp

# Основное разграничение доступа

http_access deny bad_sites
http_access allow good_sites
http_access allow Q
http_access allow W
http_access deny all

#acl to_localhost dst 127.0.0.0/8
#acl SSL_ports port 443 9443 9080 563 15100 11001 11002
#acl Safe_ports port 80        # http
#acl Safe_ports port 21        # ftp
#acl Safe_ports port 443 9443 9080 563 11001 11002 # https
#acl Safe_ports port 70        # gopher
#acl Safe_ports port 210        # wais
#acl Safe_ports port 1025-65535    # unregistered ports
#acl Safe_ports port 280        # http-mgmt
#acl Safe_ports port 488        # gss-http
#acl Safe_ports port 591        # filemaker
#acl Safe_ports port 777        # multiling http
#acl CONNECT method CONNECT

#acl Q proxy_auth REQUIRED

############# CACHE #############
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
cache allow all

cache_mem 60 MB

####DNS


##################################

############# PATHS #################################
cache_dir ufs /usr/local/squid/var/cache 7000 16 256
access_log /var/log/squid/logs/access.log squid
####################################################

############# SPECIAL PARAMETERS ################
#refresh_pattern ^ftp:        1440    20%    10080
#refresh_pattern ^gopher:    1440    0%    1440
#refresh_pattern .        0    20%    4320

refresh_pattern \.bz2$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern \.exe$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern \.gif$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern \.gz$           43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern \.ico$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern \.jpg$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern \.mid$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern \.mp3$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern \.pdf$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern \.swf$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern \.tar$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern \.tgz$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern \.zip$          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern http://ad\.       &n... 100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern http://ads\.       &... 43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern http://adv\.       &... 43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern http://click\.       ... 43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern http://count\.       ... 43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern http://counter\.      &nb... 43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern http://engine\.      &nbs... 100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern http://img\.readme\.ru    &nbs... 43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern http://userpic\.livejournal\.com   43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern \.ru/bf-analyze                    43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern \.ru/bf-si                         43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern /advs/                             43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern /banners/                          43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern /cgi-bin/iframe/                   43200   100%    43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern ^ftp:         &n... 1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern .               0       80%     14400

#request_body_max_size 0

#negative_ttl 1 minutes
#range_offset_limit 0 KB
#peer_connect_timeout 20 seconds
#read_timeout 5 minutes
#request_timeout 60 seconds
#half_closed_clients off


acl apache rep_header Server ^Apache
#broken_vary_encoding allow apache

cache_effective_user squid
cache_effective_group squid
log_access allow all

                        

#If there are problems with DNS, just launch squid: /usr/local/squid/sbin/squid -D as root //Eugen

#tcp_outgoing_address 10.34.105.30 Q
#tcp_outgoing_address 10.34.105.30 W
http_port 3128 transparent

#reload_into_ims on
visible_hostname squid


####################################################################
# Access control                                                   #
####################################################################

# Allow non-transparent proxying support. The user can connect
# directly to frox, and give his username as user@host:port or
# user@host. Defaults to no. NTPAddress gives the address to which
# incoming connections must be addressed if the client is to be offered
# non-transparent proxying. For most people using this it will be the same
# as the Listen address above. If not given then all connections will be
# offered non transparent proxying. If you are not using transparent
# proxying at all then you should leave NTPAddress commented out.
#
DoNTP yes
NTPAddress 192.168.2.63:2121


# Number of seconds of no activity before closing session
# Defaults to 300
#
# Timeout 300

#Maximum number of processes to fork.
#
# MaxForks 0 # For debugging -- only one connection may be served.
MaxForks 10

# Maximum number of connections from a single host (IP address).
MaxForksPerHost 4

# Maximum number of bytes/second to be transferred over the data
# connection for each client. MaxTransferRate limits downloads and
# MaxUploadRate uploads. CacheDlRate is the rate for downloads of files
# that are cached locally - if not set these files will be downloaded at
# full speed.
#
# MaxTransferRate 4096
# CacheDlRate 8192
# MaxUploadRate 4096

# Access control lists:
# The format is: "ACL Allow|Deny SRC - DST [PORTS]"

# SRC and DST may be in the form x.x.x.x, x.x.x.x/yy, x.x.x.x/y.y.y.y,
# a dns name, or * to match everything.
#
# PORTS is a list of ports. If specified then the rule will only match
# if the destination port of the connection is in this list. This is
# likely only relevant if you are allowing non-transparent proxying of
# ftp connections (ie. DoNTP is enabled above). Specifying * is equivalent
# to not specifying anything - all ports will be matched
#
# Any connection that matches no rules will be denied. Since there are
# no rules by default you'll need to add something to let any
# connections happen at all (look at the last example if you are
# feeling lazy/not bothered by security).
#
# # Examples:
# # Allow local network to ftp to port 21 only, and block host ftp.evil
# ACL Deny * - ftp.evil            
# ACL Allow 192.168.0.0/255.255.0.0 - * 21
#
# # Allow local network to ftp anywhere except certain dodgy ports. Network
# # admin's machine can ftp anywhere.
# ACL Allow admin.localnet - *
# ACL Deny * - * 1-20,22-1024,6000-6007,7100
# ACL Allow 192.168.0.0/16 - * *
#
# # You don't really believe in this security stuff, and just want
# # everything to work.
ACL Allow * - *

# Command control program: A bit like the idea of a squid redirector.
# By default the old interface is used so as not to break existing
# installations. The new interface is much more powerful, and is
# reccommended for new scripts -- set UseOldCCP to false to use it.
# See the FAQ for details.
#
# CCProgram /usr/local/lib/frox/bin/ccp
# UseOldCCP no


####################################################################
# Subsections                                                      #
####################################################################
# Matching rules the same as ACLS. Only some options can be specified
# in a subsection (currently the yes/no options, timeout, and caching
# options).
#
# SubSection * - ftp.dodgy.server
#  StrictCaching yes
# EndSection
#
# SubSection * - 10.0.0.0/24 # A low latency high bandwidth connection
#  MinCacheSize 4096
# EndSection
#
# Subsection * - ftp.localnetwork
# # To disable caching if it has been turned on in a parent section
#  CacheModule None
# EndSection

в фаерволле редирект делаю так (пока только на свою тачку):

iptables -t nat -A PREROUTING  -p tcp -s 192.168.2.138  --dport 21 -j REDIRECT --to-port 2121


"Frox +firefox +IE+squid"
Отправлено Tio , 20-Авг-09 15:02 
>и конфиги Вы конечно же привели.
>Сейчас часок-другой медитации и скажем где в конфигах ошибка )))))))))))))))))

Народ! Ну неужели никто не пользовался frox?


"Frox +firefox +IE+squid"
Отправлено Саша , 07-Апр-11 11:16 
>>и конфиги Вы конечно же привели.
>>Сейчас часок-другой медитации и скажем где в конфигах ошибка )))))))))))))))))
> Народ! Ну неужели никто не пользовался frox?

Видимо никто настроить не смог нормально, у самого такая же проблема