squid ferrando msn

Pessoal bom dia!

Após inumeros testes e sem sucesso resolvi pedir ajuda!

De uns tempos para cá o msn começou a dar problemas para se logar atraves do squid.
não houve alteração no squid.

Acontece o seguinte:

O msn pára de se autenticar e depois que eu tiro o proxy ele se autentica.... ai volto o proxy e o msn funciona durante uns dias e se autentica normalmente.. ai depois o volta o mesmo probblema.

Se alguem puder me dar um help agradeço!

Abs

Kra, d uma olhada no seu arquivo d log do squid (/var/log/squid/access.log) e veja se há alguma anomalia a respeito.

cara obtive isso:

1278016681.653 1441 10.2.4.95 TCP_MISS/200 504 GET http://login.live.com/ppcrlcheck.srf master DIRECT/65.54.165.137 text/html
1278016700.605 18927 10.2.4.95 TCP_MISS/200 25573 CONNECT login.live.com:443 master DIRECT/65.54.186.19 -
1278016702.233 0 10.2.4.95 TCP_DENIED/407 1800 CONNECT local-bay.contacts.msn.com:443 - NONE/- text/html
1278016702.235 0 10.2.4.95 TCP_DENIED/407 1806 CONNECT byrdr.omega.contacts.msn.com:443 - NONE/- text/html
1278016702.309 0 10.2.4.95 TCP_DENIED/407 1878 POST http://www.sqm.microsoft.com/sqm/messenger/sqmserver.dll - NONE/- text/html
1278016787.398 0 10.2.4.53 TCP_DENIED/407 1818 POST http://pnrws.skype.com/api/v1.0/pnr? - NONE/- text/html
1278016817.400 0 10.2.4.53 TCP_DENIED/407 1818 POST http://pnrws.skype.com/api/v1.0/pnr? - NONE/- text/html

Note essas 3 linhas:

1278016702.233 0 10.2.4.95 TCP_DENIED/407 1800 CONNECT local-bay.contacts.msn.com:443 - NONE/- text/html
1278016702.235 0 10.2.4.95 TCP_DENIED/407 1806 CONNECT byrdr.omega.contacts.msn.com:443 - NONE/- text/html
1278016702.309 0 10.2.4.95 TCP_DENIED/407 1878 POST http://www.sqm.microsoft.com/sqm/messenger/sqmserver.dll - NONE/- text/html

Nas suas regras, vc tá bloqueando alguns links do msn. Reveja lá e remova esses bloqueios. Note q ele chega a conectar, mas não consegue captar os contatos.

putz cara, não achei nenhum bloqueio desse tipo no meu squid.conf.....

tem ideia de onde possa estar esse bloqueio?

Pra ele estar negando, só vendo o seu squid.conf pra saber.

Olha o danado ae

http_port 3128

cache_mem 8 MB
cache_mgr alexandre.britto@pro-sinalizacao.com.br
cache_dir ufs /usr/local/squid/var/cache 100 16 256
maximum_object_size 2048 KB
#emulate_httpd_log on
visible_hostname Proxy
error_directory /usr/local/squid/share/errors/Portuguese

cache_effective_user squid
cache_effective_group squid

hierarchy_stoplist cgi-bin ?

acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
auth_param basic program /usr/local/squid/libexec/ncsa_auth /usr/local/squid/etc/passwd
auth_param basic children 5
auth_param basic realm Pro-Sinalizacao: Acesso Monitorado
auth_param basic credentialsttl 2 hours

refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320

acl authentication proxy_auth REQUIRED
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255

#############USERS FREE#################################
acl freeusers proxy_auth master

#Acesso livre para usuarios em freeusers
http_access allow freeusers
########################################################

acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 1863 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

##############SITES LIBERADOS###########################
acl noproxy dstdomain .correio. .correios. .msn. rad.msn.com/ADSAdClient31.dll? .messenger. .live.
http_access allow noproxy
########################################################
#Liberando por horário
#acl almoco time MTWHF 12:00-14:00

#################Restricao por grupo###################
#Block para grupo
acl blocktogroup url_regex -i "/usr/local/squid/etc/blockgroup"
http_access deny blocktogroup

#
#TI
acl auth_ti proxy_auth alexandre.britto felipe.lepore maria.fonseca gabriel.frozoni
acl sites_ti url_regex -i "/usr/local/squid/etc/sites_ti.txt"
http_access allow auth_ti sites_ti

#Administrativo
#acl auth_administrativo proxy_auth italo
#acl sites_administrativo url_regex -i "/usr/local/squid/etc/sites_administrativo.txt"
#http_access allow auth_administrativo sites_administrativo


#####################################################

#################Negando tudo##########################
acl restrito url_regex -i "/usr/local/squid/etc/restrito"
http_access deny restrito
#######################################################

######################CONTROLE DE BANDA###############################
acl download url_regex -i .mpeg .mpg .mp3 .wmv
acl diretoria proxy_auth teste
acl usuarios proxy_auth teste
delay_pools 2 # teremos dois controles de banda
delay_class 1 2 # primeiro controle
delay_parameters 1 -1/-1 -1/-1 # sem limites para delay pool 1
delay_access 1 allow diretoria
delay_class 2 2 # segundo controle
delay_parameters 2 3000/3000 3000/3000 #limita a banda a +/- 64Kbits
delay_access 2 allow usuarios
#######################################################################

#Bloqueando blacklist spyware
acl spyware url_regex "/usr/local/squid/etc/blacklistspy.txt"
http_access deny spyware

http_access deny download
http_access allow authentication
http_access allow manager localhost
http_access deny manager
http_access allow !Safe_ports
http_access allow CONNECT !SSL_ports
http_access deny all
icp_access allow all

Olhe dentro desses arquivos blocktogroup e restrito e veja se há algum bloqueio relacionado ao msn.

Dentro do blockgroup:
http://tc.batepapo.uol.com.br
http://chat.terra.com.br
.fotoblog.uol.com.br
http://batepapo.bol.com.br

Dentro do restrito:
.xvideos.
.stupidvideos.
.blogspot.
.blog.
.blogger.
.yesfilmes.
.sexo.
.sexy.
.playboy.
.private.
.gay.
.sex.
.voxcards.
.src.

E essa blacklistspy.txt? Tem alguma coisa?

tem um monte de coisa... mas eu comentei ele no squid.conf e restartei e nada tb.

Na linha dos sites liberados, vc já tentou colocar o site da microsoft? Tente ae...