glennda Posted September 20, 2010 Posted September 20, 2010 We seem to have a problem with squid or dansguardian whereby if it cannot connect to a page it automatically redirects them to Microsoft office download page - which is rather annoying. At first I thought it was IE doing the redirect but it happens in firefox aswell!! anybody got any ideas why this is happening?
ricki Posted September 20, 2010 Posted September 20, 2010 hi I am guessing here but have a look on the dansguardian.conf and squid.conf see if you can find the the address of the page they get redirected to. The one here get redirected in squid to an error page on the dansguardian box. Richard
glennda Posted September 20, 2010 Author Posted September 20, 2010 Nope tried that already - its not mentioned in any of the conf files - the only way to resolve is to restart squid and dansguardian
ricki Posted September 20, 2010 Posted September 20, 2010 Hi I think mine get redirected to /usr/share/squid/errors/English/ Richard
ricki Posted September 20, 2010 Posted September 20, 2010 Hi Have a look in the error pages as well it could have a bit of htlm in to forward it on. Richard
Duke5A Posted October 11, 2010 Posted October 11, 2010 I'm having the exact same issue here. I setup Squid with Dan's Guardian on Ubuntu 9.04 running in a VM on ESXi so we could log student traffic. Both Dan's Guardian and Squid were installed through apt-get and not compiled from source. For the most part it works beautifully, and I have SARG setup to parse the Squid logs to make it easy for principals to check where there students have been going. It's just that every once and a while, when going through this proxy, you'll get bounced to office.microsoft.com. It doesn't matter what site you're pulling up either, but it ALWAYS redirects to the MS Office site. It seems to be very sporadic. Squid is setup to authenticate to the AD, and log traffic using the student's AD account name. The cache_dir in the squid.conf is pointing to /dev/null, effectively disabling the caching function of Squid. Now I do have a cache_peer setup in the squid.conf, since we get filtering through our ISP. I've isolated where the redirect actually takes place in the access.log file, here it is... 1286815796.809 52 10.6.17.15 TCP_MISS/301 838 GET Breaking News, Weather, Business, Health, Entertainment, Sports, Politics, Travel, Science, Technology, Local, US & World News- msnbc.com tteacher02 DEFAULT_PARENT/cache_peer-proxygoeshere - 1286815796.943 133 10.6.17.15 TCP_MISS/200 35919 GET Office - Microsoft Office tteacher02 DEFAULT_PARENT/cache_peer-proxygoeshere text/html The initial request shows up with a TCP_MISS, which is to be expected since caching has been disabled, but a 301 code is tossed, signaling a permanent move. The very next log entry for any user after this code is always office.microsoft.com. This is driving me nuts. Did you have any luck figuring this out?
tom_newton Posted October 11, 2010 Posted October 11, 2010 Are you both using the same DNS servers perhaps? Could be something in there maybes?
glennda Posted October 11, 2010 Author Posted October 11, 2010 Nope I am still investigating now - Duke5a I have sent you a pm asking a few details about LA etc I have spent ages trying to find this out and cannot work out why it is happening!
tom_newton Posted October 12, 2010 Posted October 12, 2010 Hm. Duke5a's logs look like there *might* be an issue with upstream proxy?
glennda Posted October 12, 2010 Author Posted October 12, 2010 Hm. Duke5a's logs look like there *might* be an issue with upstream proxy? What sort of issue? is it a known issue? We have 2 squid proxy's there never was an issue with the second one until we setup authentication on it - possibly its because the upstream does not require authentication?
Duke5A Posted October 12, 2010 Posted October 12, 2010 What sort of issue? is it a known issue? We have 2 squid proxy's there never was an issue with the second one until we setup authentication on it - possibly its because the upstream does not require authentication? That is interesting... When I setup Squid here I did everything all at once, so I couldn't say if it was authentication, the upstream proxy, or a combination of the two. I'll try creating an ACL in Squid to let office.microsoft.com requests bypass proxy authentication.
Duke5A Posted October 12, 2010 Posted October 12, 2010 Hm. Duke5a's logs look like there *might* be an issue with upstream proxy? Tom, if you're referring to "cache_peer-proxygoeshere," then this isn't a problem. I removed the actual cache_peer address in the log intentionally. I just finished making some quick edits to the squid.conf. This is basically how it looks... acl bypassNTLM dstdomain "/etc/squid/bypassauth-sites.squid" acl NTLMUsers proxy_auth REQUIRED http_access allow all bypassNTLM http_access all all NTLMUsers The bypassauth-sites.squid text file contains .microsoft and .msecnd.net. I then logged on locally to a domain computer and tried to browse the net through the proxy. I got hit up for credentials on every site I tried to visit save for the exceptions I defined in that ACL. So it's working as intended. Now I'll let users have at it for the next couple of days and see if the problem persists.
tom_newton Posted October 13, 2010 Posted October 13, 2010 Ah, duke, yes, that looked to me like you'd perhaps not filled in a placeholder value! Thanks for clearing that up. I've been asking around our DG & squid folks but no joy as yet - this is not something we have seen before it seems.
Duke5A Posted October 14, 2010 Posted October 14, 2010 I'm pretty sure my ACL to allow office.microsoft.com to bypass AD authorization fix worked. After a full day of the redirect problem not showing up, I changed the proxy GPO and funneled the rest of the student body through the Squid box for today, and still no issues even with a two-fold increase in web traffic through Squid. This is just a band-aid though, there is still an underlying problem. Glennda, if you decide to go ahead and give it a try, let me know what the outcome is. Thanks everyone.
tom_newton Posted October 14, 2010 Posted October 14, 2010 Interesting. I'm glad you've found a fix (believe me, there's a LONG list of sites to put in "do not auth for" - so much s/w hates NTLM!). Glennda: guardian/auth/settings - the do-not-auth-for box is where it's at.
glennda Posted October 14, 2010 Author Posted October 14, 2010 Glennda: guardian/auth/settings - the do-not-auth-for box is where it's at. I don't have smoothwall just squid and dansguardian! so not sure where your trying to direct me Also my sisters an Ict Teacher at another school and she has mentioned that they where having the problem aswell - I have emailed her network manager to ask if they use squid/dansguardian or smoothwall - will see what they say
tom_newton Posted October 14, 2010 Posted October 14, 2010 Ack.. it was another chap with the same issue in smoothie...cbsc..
glennda Posted October 14, 2010 Author Posted October 14, 2010 @Tom - no problem! On the other had i am unsure why giving unauthenticated access to office.microsoft.com works - its not as if the requests are for this website they can be for any website - also it can't be an IE problem as it also happens in firefox or chome!
glennda Posted October 15, 2010 Author Posted October 15, 2010 Also my sisters an Ict Teacher at another school and she has mentioned that they where having the problem aswell - I have emailed her network manager to ask if they use squid/dansguardian or smoothwall - will see what they say They have just confirmed they use squid aswell and forward to the same parent proxy as us
glennda Posted October 21, 2010 Author Posted October 21, 2010 Put in the ACL the other day but it seems as though something on the website comes from another domain name (not .microsoft.com or .msecnd.net) as the webpage loads but its still asking for credentials for the proxy and we are still being redirected to this website. Toby
tom_newton Posted October 21, 2010 Posted October 21, 2010 This doesn't seem to be an ntlm issue - as we have found someone with an ident setup suffering. So, we can rule that out. We're still trying to replicate it in the lab.
Duke5A Posted October 25, 2010 Posted October 25, 2010 Early last week I had a complaint from the high school stating that the problem had cropped back up (what was odd is that the frequency of occurrences went way down). So, I tried out my last idea and it seems to have held through four full school days. I left the NTLM bypass tweak in place (knew I would be adding sites to the list for other various problems), and added another to bypass the upstream proxy for those two domains. Config looks something like this.... acl bypassNTLM dstdomain "/etc/squid/bypassauth-sites.squid" acl BypassCache_peer dstdomain "/etc/squid/bypasscache_peer-sites.squid" acl NTLMUsers proxy_auth REQUIRED http_access allow all bypassNTLM http_access allow all NTLMUsers cache_peer YOURCACHEPEER.com parent 8080 0 no-query proxy-only always_direct allow BypassCache_peer never_direct allow all The "bypassauth-sites.squid" and "bypasscache_peer-sites.squid" files contain... .microsoft.com .msecnd.net I've been constantly calling the media paras at each build asking they had seen this issue repeat itself since I implemented this last change and all have said they haven't. I'm not declaring victory or anything, but this band-aid seems to be holding. Good luck and keep us posted.
Duke5A Posted November 5, 2010 Posted November 5, 2010 @Glenda: Any new developments? We haven't had any recurrences since my last post, but I'm still wondering what the underlying problem is.
glennda Posted November 6, 2010 Author Posted November 6, 2010 I think I missed you last post - will give it a try next week
glennda Posted November 6, 2010 Author Posted November 6, 2010 I have just added this in and have asked teachers to report back next week if this has worked. Tom are you any nearing to finding out why this is happening? Toby
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now