I have just upgraded from Jessie to Stretch a proxy server with a perfectly working Squid configuration.

The upgrade asked me if I wanted to copy squid.conf from the old /etc/squid3 directory to the new /etc/squid directory, and I allowed it.

Now all accesses are simply refused and logged as TCP_DENIEDin the access log file.

My squid.conf file is below.

What to do?

hierarchy_stoplist cgi-bin ?

acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY

cache_replacement_policy heap LFUDA
minimum_object_size 0 KB
# maximum_object_size_in_memory 8 KB
cache_dir aufs /home/squid 4000 16 256
access_log syslog:local5.info squid
cache_access_log none 
cache_log /dev/null
cache_store_log none 
pid_filename /var/run/squid3.pid

debug_options ALL,1

ftp_user proxy@xxxx.xx
# ftp_list_width 32
ftp_passive on
dns_retransmit_interval 5 seconds

acl connections maxconn 200 
http_access deny connections
negative_ttl 300 seconds

# acl manager proto cache_object # Commented out on upgrade to 3.4

acl SSL_ports port 443 563
acl Safe_ports port 80      # http
acl Safe_ports port 21      # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70      # gopher
acl Safe_ports port 210     # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280     # http-mgmt
acl Safe_ports port 488     # gss-http
acl Safe_ports port 591     # filemaker
acl Safe_ports port 777     # multiling http

acl localwww    dstdomain xxxxx
acl baddomains  dstdomain .xxxx .xxxx
#acl badhost src x.x.x.x/32
acl baddest dst x.x.x.x/24 x.x.x.x/32
acl srvnets src x.x.x.x/24 
acl pcs         src x.x.x.x/32 

acl local_machines dst
cache deny local_machines

always_direct allow all

http_access deny manager
# Deny requests to unknown ports
http_access deny !Safe_ports
# Deny CONNECT to other than SSL ports
http_access deny CONNECT !SSL_ports

http_access deny baddest
http_access deny baddomains
http_access allow srvnets
http_access allow pcs
http_access deny all

icp_access deny all

miss_access deny baddest
miss_access deny baddomains
miss_access allow srvnets
miss_access allow pcs
miss_access deny all

cache_mgr alerta@xxx.xx

cache_effective_user proxy
cache_effective_group proxy

visible_hostname xxx.xxx.xx 

memory_pools on
forwarded_for on

client_db on

buffered_logs on

allow_underscore on
offline_mode off
uri_whitespace encode

half_closed_clients off

strip_query_terms off

cache_swap_high 70

shutdown_lifetime 2 seconds
refresh_all_ims on 
#client_db off
max_filedescriptors 16384

In squid v3.5 the hierarchy_stoplist and client_db configuration directives are obsolete.

Commented them out, restarted the service and squid started working properly.

From squid mailing list

As part of the Squid configuration cleanup project hierarchy_stoplist has appeared as a directive which is almost but not quite obsolete. Points against it:
1) it only affects configurations with cache_peer.

2) The default settings published with earlier Squid versions are obsolete since around 3.1 version.

If you are only using "hierarchy_stoplist cgi-bin \?" you can remove it completely from any Squid-3 config file.

3) The following hierarchy_stoplist A B C is almost exactly equivalent to: acl Foo url_regex A B C always_direct allow Foo With the exception that never_direct is applied before hierarchy_stoplist but not before always_direct.

In absence of any objections this will be scheduled for deprecation within the squid-3.4 release cycle.


I had the same trouble after an upgrade. In my case, the error was that it couldn't get lock on the squid.pid on /var/run, although it could creat it. Well, to short a long story, as a hail mary and really unorthodox method to solve it, I removed systemD. That's NOT a recommendation, although. I got the how to remove it here (http://without-systemd.org/wiki/index.php/How_to_remove_systemd_from_a_Debian_jessie/sid_installation). The crazy thing is that it worked :)

  • systemd is not allowed in my Debian Linux farm; at home OS/X, FreeBSD and OpenBSD. – Rui F Ribeiro Jul 7 '17 at 13:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.