Re: SYN floods?

Jon Drukman wrote:

> i just got two more complaints that squid is sending a flood of ident
> requests (port 113) to people visiting our site. i definitely rebuilt
> squid with --disable-ident-lookups. how can this be happening?

No idea, unless you forgot to run make clean after changing configure
options.

Also, if your Squid is configured correctly (i.e. no complaints about
missing "all" acl on startup") then it should not perform any ident
lookups unless squid.conf is configured to allow them. The default for
ident_lookup_access is "ident_lookup_access deny all" which denies Squid
to perform ident lookups on all requests.

> looks like i'm going to have to go through the code and manually remove all
> the identd stuff. :(

You probably only have to add
acl all src 0.0.0.0/0
at the top of your squid.conf.

As told before.

Or make a clean build of Squid if you have changed the configure
options.

--
Henrik Nordstrom
Spare time Squid hacker