Re: Binding Squid to reserved port (was: mac_portacl)

Nikolay Pavlov <quetzal@xxxxxxxxxxxx> wrote:

I am trying to implement reverse proxy using squid with mac_portacl,
but i have problem while binding squid to port 80.
Am i missed something?

Here is my mac_portacl variables:

# sysctl security.mac.portacl.
security.mac.portacl.enabled: 1
security.mac.portacl.suser_exempt: 1
security.mac.portacl.autoport_exempt: 1
security.mac.portacl.port_high: 1023
security.mac.portacl.rules: uid:100:tcp:80

And squid user info:

# grep squid /etc/passwd
squid:*:100:100:squid caching-proxy pseudo
user:/usr/local/squid:/usr/sbin/nologin

Also here is cache.log:

2006/10/20 09:55:59| Starting Squid Cache version 2.5.STABLE14 for
i386-portbld-freebsd6.1...
2006/10/20 09:55:59| Process ID 6584
2006/10/20 09:55:59| With 11072 file descriptors available
2006/10/20 09:55:59| DNS Socket created at 0.0.0.0, port 59879, FD 5
2006/10/20 09:55:59| Adding nameserver 206.53.60.10 from
/etc/resolv.conf
2006/10/20 09:55:59| User-Agent logging is disabled.
2006/10/20 09:55:59| Unlinkd pipe opened on FD 10
2006/10/20 09:55:59| Swap maxSize 102400000 KB, estimated 7876923
objects
2006/10/20 09:55:59| Target number of buckets: 393846
2006/10/20 09:55:59| Using 524288 Store buckets
2006/10/20 09:55:59| Max Mem size: 1048576 KB
2006/10/20 09:55:59| Max Swap size: 102400000 KB
2006/10/20 09:55:59| Rebuilding storage in /cache (DIRTY)
2006/10/20 09:55:59| Using Least Load store dir selection
2006/10/20 09:55:59| Set Current Directory to /usr/local/squid/cache
2006/10/20 09:55:59| Loaded Icons.
2006/10/20 09:55:59| commBind: Cannot bind socket FD 12 to *:80: (13)
Permission denied
FATAL: Cannot open HTTP Port
Squid Cache (Version 2.5.STABLE14): Terminated abnormally.
CPU Usage: 0.035 seconds = 0.000 user + 0.035 sys
Maximum Resident Size: 9528 KB
Page faults with physical i/o: 0

I assume you aren't starting Squid with root privileges?

If you aren't, you'll have to lower:
net.inet.ip.portrange.reservedhigh if you want
it to bind to port 80.

I don't use mac_portacl, but from the name I assume
security.mac.portacl.port_high does something similar.

Port redirection with your packet filter of choice
would be another option.

Followup-To: freebsd-questions@xxxxxxxxxxx set.

Fabian
--
http://www.fabiankeil.de/

Attachment: signature.asc
Description: PGP signature

Relevant Pages

  • transparent Squid + pf
    ... I am trying Transparent Squid with FreeBSD 6.2. ... rdr on $ext_if proto tcp from any to any port 80 -> ... packets going out through $ext_if with source ...
    (freebsd-questions)
  • FreeBSD Ports Security Advisory FreeBSD-SA-02:12.squid
    ... The Squid Internet Object Cache is a web proxy/cache. ... The FreeBSD port does not normally include this code, ... correction date, ...
    (FreeBSD-Security)
  • Re: My customers are going back to NT if I cant get this fixed!!!
    ... I allow some domains to just pass through without using the squid, ... acl specific-site dstdomain .specific-site.com ... > its authentication information over port 4000. ... Everything I'm reading tells me that this communication ...
    (comp.os.linux.security)
  • Re: OT: Geekness - avoiding proxies
    ... I believe Squid is part of the Cygwin install base (but ... In the PuTTY config look at the left-hand pane - and select the Tunnels ... Add a local port and set the destination to be ...
    (uk.rec.motorcycles)
  • Re: Binding Squid to reserved port (was: mac_portacl)
    ... but i have problem while binding squid to port 80. ... And squid user info: ... FATAL: Cannot open HTTP Port ... "The highest port number mac_portacl will enforce rules for." ...
    (FreeBSD-Security)