Bonjour,
J’aimerai mettre en place un proxy sur le raspberry, à l’aide de Squid et de SquidGuard.
Configuration SQUID :
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
acl Local src 192.168.1.0/24
acl ads dstdom_regex -i "/etc/squid/squid.adservers.regex"
acl my_adblock url_regex -i "/etc/squid/myadblock.adservers.regex"
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localhost
http_access allow Local
http_access deny all
http_port 3128
forwarded_for off
coredump_dir /var/spool/squid
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
url_rewrite_program /usr/bin/squidGuard -c /etc/squidguard/squidGuard.conf
url_rewrite_children 32
cache_dir ufs /cache 400 16 256
Tout est censé fonctionner donc. Seulement, voiçi le contenu du status de service :
● squid.service - LSB: Squid HTTP Proxy version 3.x
Loaded: loaded (/etc/init.d/squid; generated; vendor preset: enabled)
Active: active (running) since Sun 2018-10-14 20:03:26 CEST; 7s ago
Docs: man:systemd-sysv-generator(8)
Process: 1701 ExecStop=/etc/init.d/squid stop (code=exited, status=0/SUCCESS)
Process: 602 ExecReload=/etc/init.d/squid reload (code=exited, status=0/SUCCESS)
Process: 1783 ExecStart=/etc/init.d/squid start (code=exited, status=0/SUCCESS)
Main PID: 1824 (squid)
CGroup: /system.slice/squid.service
├─1822 /usr/sbin/squid -YC -f /etc/squid/squid.conf
├─1824 (squid-1) -YC -f /etc/squid/squid.conf
├─1825 (logfile-daemon) /var/log/squid/access.log
├─1826 (unlinkd)
└─1827 (pinger)
Oct 14 20:03:20 pirate systemd[1]: Starting LSB: Squid HTTP Proxy version 3.x...
Oct 14 20:03:25 pirate squid[1822]: Squid Parent: will start 1 kids
Oct 14 20:03:25 pirate squid[1783]: Starting Squid HTTP Proxy: squid.
Oct 14 20:03:25 pirate systemd[1]: squid.service: PID file /var/run/squid.pid not readable (yet?) after start: No such file or director
Oct 14 20:03:25 pirate squid[1822]: Squid Parent: (squid-1) process 1824 started
Oct 14 20:03:26 pirate systemd[1]: squid.service: Supervising process 1824 which is not our child. We'll most likely not notice when it
Oct 14 20:03:26 pirate systemd[1]: Started LSB: Squid HTTP Proxy version 3.x.
Le fichier PID n’est pas lisible (donc problème de droit), ce qui induit les processus suivant :
root 1822 0.0 5.1 66120 23072 ? Ss 20:03 0:00 /usr/sbin/squid -YC -f /etc/squid/squid.conf
proxy 1824 0.7 9.0 96832 40328 ? S 20:03 0:00 (squid-1) -YC -f /etc/squid/squid.conf
proxy 1825 0.0 0.5 3832 2276 ? S 20:03 0:00 (logfile-daemon) /var/log/squid/access.log
Le premier processus est lancé par root, ce qui fait que par exemple, le processus 1824 est incapable d’acceder au fichier PID (qui n’est pas de son droit) car les droits sont root:proxy, et je pense que c’est ça qui pose problème. De ce fait, j’ai l’impression que Squidguard ne se lance pas.
Qu’en pensez vous et comment réparer tout ça ?