Re: [squid-users] SECURITY ALERT: Squid Cache: Version 3.2.0.13

 On Tue, 29 Nov 2011 22:48:39 +0100, David Touzeau wrote:
> Dear
>
> I'm trying to make Squid Cache: Version 3.2.0.13-20111127-r11436 on
> transparent mode
>
> But squid refuse to access to some websites
> for example google.* is ok
>
> but microsoft is impossible.
>
> How to fix this issue ?

 Track down the client software which is producing the requests.

>
> On event :
>

 ... missing log line...

> Nov 29 22:18:57 squid2 squid[11257]: SECURITY ALERT: By user agent:
> Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0;
> InfoPath.2; MS-RTC LM 8; .NET CLR 2.0.50727; .NET CLR
> 3.0.4506.2152; .NET CLR 3.5.30729)
> Nov 29 22:18:57 squid2 squid[11257]: SECURITY ALERT: on URL:
> http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

 ... missing log line...

> Nov 29 22:18:59 squid2 squid[11257]: SECURITY ALERT: By user agent:
> Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0;
> InfoPath.2; MS-RTC LM 8; .NET CLR 2.0.50727; .NET CLR
> 3.0.4506.2152; .NET CLR 3.5.30729)
> Nov 29 22:18:59 squid2 squid[11257]: SECURITY ALERT: on URL:
> http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

 Which brings us back to the question of where the key log line has
 disappeared to.

 The log line which says "Host header forgery from $C ($A does not match
 $B)"

 What those $ values are is important to how to fix it. $C is the
 connection details needed to isolate the machine to investigate. $A and
 $B the details which it is getting wrong.

 Amos
Received on Tue Nov 29 2011 - 22:14:45 MST