Re: [squid-users] Automatic redirection on igoogle.fr

On 17/09/10 21:49, Babelo Gmvsdm wrote:
>
> The problem is back, Is this you wanted amos?
>
> HTTP/1.1 302 Moved Temporarily
> Date: Fri, 17 Sep 2010 09:44:04 GMT
> Server: Apache mod_fcgid/2.3.5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
> X-Powered-By: PHP/5.2.14
> Location: http://newwave.orge.pl/?q=
> Content-Length: 0
> Content-Type: text/html
> X-Cache: MISS from Web-Filter
> X-Cache-Lookup: MISS from Web-Filter:3128
> Via: 1.1 Web-Filter (squid)
> Proxy-Connection: keep-alive
>
> Cheers
>
> Herc.
>

Part of it, Google certainly do not run Apache so the redirect is coming
from an infected source.

The "MISS from Web-Filter" indicates that 302 redirect is not being
stored by the squid calling itself "Web-Filter" thankfully. This is why
it was not resolved by clearing the cache.

A double-check for myself: "Web-Filter" is your squid?

The request the client makes to get that back will give clues where the
problem infection is and how squid is getting it.

You can protect the clients while investigating by adding this to your
squid.conf at or near the top of the http_access lines:
   acl newwave dstdomain newwave.orge.pl
   http_access deny newwave

Amos

-- 
Please be using
   Current Stable Squid 2.7.STABLE9 or 3.1.8
   Beta testers wanted for 3.2.0.2