1. Store
  2. Apps
  3. Hardware
  4. Support
  5. Solutions

ClearFoundation

Forums
Welcome, Guest
Dos 6.2b3 *require* an Internet connection?
(1 viewing) 1 Guest
Go to bottomPage: 12
TOPIC: Dos 6.2b3 *require* an Internet connection?
#38395
Re:Dos 6.2b3 *require* an Internet connection? 2 Years, 5 Months ago  
Brian wrote:
Came across this as well. I was in a vm so I just added 2nd NIC, which let me choose Role on original one, then removed 2nd NIC. Stays as external after that. Didn't have to assign role to 2nd nic at all. It's presence lets you change roles.
On actual hardware this could be cumbersome or unfeasible.

Regards,

Georger
georger
Expert Boarder
Posts: 141
graphgraph
User Offline Click here to see the profile of this user
The administrator has disabled public write access.
 
#38397
Re:Dos 6.2b3 *require* an Internet connection? 2 Years, 5 Months ago  
Well that's an ugly GUI bug. We'll see what we can do.
Peter Baldwin
Developer
Posts: 2085
graphgraph
User Offline Click here to see the profile of this user
The administrator has disabled public write access.
 
#38490
Re:Dos 6.2b3 *require* an Internet connection? 2 Years, 5 Months ago  
Just an update. We updated the ISOs, so you should no longer see the "single NIC" issue.
Peter Baldwin
Developer
Posts: 2085
graphgraph
User Offline Click here to see the profile of this user
The administrator has disabled public write access.
 
#38641
Re:Dos 6.2b3 *require* an Internet connection? 2 Years, 5 Months ago  
Hi Peter,
I just downloaded the updated ISO, and I'm happy to report that the "single NIC" issue is resolved!

It doesn't really appeal to me defining the role of the sole NIC on a machine as "External" when clearly that NIC is going to be connected to the LAN, but I concede this is just me being pedantic.

Installation was a breeze and the GUI looks very polished - congratulations!

Now for a question, and a suggestion.

Why don't all groups show up when creating a flexshare?

Allow Squid to cache Windows Update files (and also others) as explained here. Clients get updates MUCH faster, bandwidth is saved and the WAN link becomes more responsive for business apps! My current Debian Squeeze proxy is configured like this:
Code:


visible_hostname proxy.my.lan
cache_mgr myself@my.lan

# My upstream proxy
cache_peer upstreamproxy.my.lan parent 3128 0 no-query no-digest default
hierarchy_stoplist cgi-bin ?

# As per http://wiki.squid-cache.org/SquidFaq/WindowsUpdate
range_offset_limit -1
maximum_object_size 500 MB
quick_abort_min -1

acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl localnet src 10.0.0.0/8 # Change according to your LAN!

acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access deny all

never_direct allow all

http_port 3128

# 200 GB for caching
cache_dir ufs /var/spool/squid3 200000 16 256
coredump_dir /var/spool/squid3

# Cache for at least 30 days and at most 2 years
refresh_pattern ([^.]+.|)(download|(windows|)update|).(microsoft.|)com/.*\.(cab|exe|ms[i|u|f|p]|asf|wm[v|a]|dat|zip|psf) 43200 100% 1036800 reload-into-ims
refresh_pattern ([^.]+.|)windowsupdate.com/.*\.(cab|exe|ms[i|u|f|p]|asf|wm[v|a]|dat|zip|psf) 43200 100% 1036800 reload-into-ims
refresh_pattern ([^.]+.|)adobe.com/.*\.(cab|exe|ms[i|u|f|p]|asf|wm[v|a]|dat|zip) 43200 100% 1036800 reload-into-ims
refresh_pattern ([^.]+.|)java.com/.*\.(cab|exe|ms[i|u|f|p]|asf|wm[v|a]|dat|zip) 43200 100% 1036800 reload-into-ims
refresh_pattern ([^.]+.|)sun.com/.*\.(cab|exe|ms[i|u|f|p]|asf|wm[v|a]|dat|zip) 43200 100% 1036800 reload-into-ims
refresh_pattern ([^.]+.|)symantecliveupdate.com/.*\.(cab|exe|ms[i|u|f|p]|asf|wm[v|a]|dat|zip|m25) 43200 100% 1036800 reload-into-ims
refresh_pattern ([^.]+.|)google.com/.*\.(cab|exe|ms[i|u|f|p]|asf|wm[v|a]|dat|zip) 43200 100% 1036800 reload-into-ims

refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320



Regards,

Georger
georger
Expert Boarder
Posts: 141
graphgraph
User Offline Click here to see the profile of this user
Last Edit: 2012/03/11 18:09 By georger.
The administrator has disabled public write access.
 
#38698
Re:Dos 6.2b3 *require* an Internet connection? 2 Years, 5 Months ago  
Hi georger,

georger wrote:
Why don't all groups show up when creating a flexshare?

There are five types of groups in ClearOS:

1) Built-in groups - there's just one right now: "allusers"
2) User-defined groups
3) Windows groups
4) App groups (e.g. pptpd_plugin is a group that holds all the users permitted to use the PPTP server)
5) System groups (stuff /etc/groups)

Right now, only the first two types are shown in Flexshare, but all five types could be shown instead (well, I'm not 100% sure about system groups, but certainly the first four). Perhaps we should make this a tunable option?

Allow Squid to cache Windows Update files (and also others) as explained here.

Some Windows Update tweaks were added to squid.conf, but it looks like more could be done. Is it working for you?
Peter Baldwin
Developer
Posts: 2085
graphgraph
User Offline Click here to see the profile of this user
The administrator has disabled public write access.
 
#38700
Re:Dos 6.2b3 *require* an Internet connection? 2 Years, 5 Months ago  
Hi Peter,

Peter Baldwin wrote:
Hi georger,

There are five types of groups in ClearOS:

1) Built-in groups - there's just one right now: "allusers"
2) User-defined groups
3) Windows groups
4) App groups (e.g. pptpd_plugin is a group that holds all the users permitted to use the PPTP server)
5) System groups (stuff /etc/groups)

Right now, only the first two types are shown in Flexshare, but all five types could be shown instead (well, I'm not 100% sure about system groups, but certainly the first four). Perhaps we should make this a tunable option?

I have a use case where I create a Samba (flex)share that is owned by the Domain Admins group with RW permissions. If the Domain Admins group isn't available, I can't pull it off, at least not as easily as I can do in 5.2 SP1.
I create the (flex)share, say appsrw, and then I add (hack) an include to /etc/samba/hack.conf in /etc/samba/smb.conf which defines a new appsro share. /etc/samba/hack.conf looks like this:
Code:


[appsro]
        path = /var/flexshare/shares/appsrw
        comment = Apps - read only
        browseable = Yes
        guest ok = No
        directory mask = 775
        create mask = 664
        valid users = @"%D\domain_users", @"%D\domain_admins"
        veto files = /.flexshare*/


This way, I can have a (flex)share which is RO for regular users, and RW for admin users (namely winadmin) - useful when I have to deploy a new version of a C/S app.
Some Windows Update tweaks were added to squid.conf, but it looks like more could be done. Is it working for you?
I just reviewed /etc/squid/squid.conf in 6.2b3 and I believe it is fine (I'm not running it in production, just on a VM at home), but the way it's configured now it just means that all clients have access to Windows Update and some (not all) of the files downloaded from WU will be cached - my config goes further.

First, maximum_object_size at just 10 MB means Squid won't cache large update files, like .NET updates. I crank it all the way up to 500 MB so that Windows and Office updates, including Service Packs, will be cached.

Second, the custom refresh_pattern (see here and here) lines tell Squid to keep Windows Update files for longer, so that they will always (mostly) be prompty available. When installing a new Windows machine, or simply updating one that was just (re)deployed, this makes a big difference, chiefly when the WAN link is slow. Antivirus updates also benefit from this - Symantec update files are HUGE. Same goes for files from other vendors.

Keep the great work! Regards,

Georger
georger
Expert Boarder
Posts: 141
graphgraph
User Offline Click here to see the profile of this user
The administrator has disabled public write access.
 
#38762
Re:Dos 6.2b3 *require* an Internet connection? 2 Years, 5 Months ago  
Thanks! I changed the default object size to 500 MB, that's sane given today's gear (even SSDs). As for the refresh patterns, it's a bit late in the beta to make that change. I have added the issue in the tracker:

tracker.clearfoundation.com/view.php?id=485

It's one of those things that's easy to implement (coding-wise), so it's really just a matter of making sure it works. This should probably be an option in the GUI (on/off) which gets tuned as Microsoft and others make changes. In other words, squid.conf will look like:

# ClearOS updates tuning start
refresh_pattern...
# ClearOS updates tuning end

For the 99% who don't touch squid.conf, that block of configuration might change on an upgrade (e.g. Windows 8 additions). For the 1%, there's always the option to disable the automagic.
Peter Baldwin
Developer
Posts: 2085
graphgraph
User Offline Click here to see the profile of this user
The administrator has disabled public write access.
 
#38767
Re:Dos 6.2b3 *require* an Internet connection? 2 Years, 5 Months ago  
Hi Peter,
Peter Baldwin wrote:
Thanks! I changed the default object size to 500 MB, that's sane given today's gear (even SSDs). As for the refresh patterns, it's a bit late in the beta to make that change. I have added the issue in the tracker:

tracker.clearfoundation.com/view.php?id=485

It's one of those things that's easy to implement (coding-wise), so it's really just a matter of making sure it works. This should probably be an option in the GUI (on/off) which gets tuned as Microsoft and others make changes. In other words, squid.conf will look like:

# ClearOS updates tuning start
refresh_pattern...
# ClearOS updates tuning end

For the 99% who don't touch squid.conf, that block of configuration might change on an upgrade (e.g. Windows 8 additions). For the 1%, there's always the option to disable the automagic.

Nice! I'd just like to point out that the Squid wiki [1] advises that not only maximum_object_size should be changed, but also range_offset_limit and quick_abort_min as well.

[1] Squid wiki

Regards,

Georger
georger
Expert Boarder
Posts: 141
graphgraph
User Offline Click here to see the profile of this user
The administrator has disabled public write access.
 
Go to topPage: 12
  get the latest posts directly to your desktop