Hallo I have some problem in this 6 mounths trying to update my desktop systems.
Sorry I cannot tell if is a archive.ubuntu.com server temporary problem or is a problem on my squid-deb-proxy package.

watching /var/log/squid-deb-proxy/access.log and apt upgrade output I see:

from apt output:

Ign:42 xenial-security/main amd64 libudev1 amd64 229-4ubuntu21.1
Ign:41 xenial-security/main amd64 libpam-systemd amd64 229-4ubuntu21.1
Ign:44 xenial-security/main amd64 udev amd64 229-4ubuntu21.1
Ign:43 xenial-security/main i386 libudev1 i386 229-4ubuntu21.1
Ign:46 xenial-security/main amd64 libsystemd0 amd64 229-4ubuntu21.1
Ign:45 xenial-security/main i386 libsystemd0 i386 229-4ubuntu21.1
Ign:48 xenial-security/main amd64 systemd-sysv amd64 229-4ubuntu21.1
Ign:47 xenial-security/main amd64 systemd amd64 229-4ubuntu21.1
Ign:50 xenial-security/universe amd64 chromium-codecs-ffmpeg-extra amd64 64.0.3282.140-0ubuntu0.16.04.1
Ign:49 xenial-proposed/main amd64 libapparmor1 amd64 2.10.95-0ubuntu2.8
Err:52 xenial-proposed/main i386 gcc-5-base i386 5.4.0-6ubuntu1~16.04.9 Connessione terminata
Err:51 xenial-proposed/main amd64 gcc-5-base amd64 5.4.0-6ubuntu1~16.04.9 403 Forbidden

from /var/log/squid-deb-proxy/access.log:

1518428930.420 96 192.168.1.107 TCP_REFRESH_MODIFIED/302 445 GET - HIER_DIRECT/91.189.88.149 text/html
1518428931.389 32 192.168.1.107 TCP_DENIED/403 4233 GET - HIER_NONE/- text/html
1518429050.519 0 192.168.1.107 TCP_DENIED/403 4212 GET - HIER_NONE/- text/html
1518429050.577 57 192.168.1.107 TCP_REFRESH_MODIFIED/302 448 GET - HIER_DIRECT/91.189.88.149 text/html
1518429170.721 68 192.168.1.107 TCP_REFRESH_MODIFIED/302 445 GET - HIER_DIRECT/91.189.88.152 text/html
1518429176.717 33 192.168.1.107 TCP_DENIED/403 4221 GET - HIER_NONE/- text/html
1518429290.819 0 192.168.1.107 TCP_DENIED/403 4212 GET - HIER_NONE/- text/html
1518429290.875 56 192.168.1.107 TCP_REFRESH_MODIFIED/302 454 GET - HIER_DIRECT/91.189.88.152 text/html
1518429410.878 0 192.168.1.107 TCP_DENIED/403 4239 GET - HIER_NONE/- text/html
1518429410.969 91 192.168.1.107 TCP_REFRESH_MODIFIED/302 455 GET - HIER_DIRECT/91.189.88.152 text/html
1518429531.019 0 192.168.1.107 TCP_DENIED/403 4244 GET - HIER_NONE/- text/html

The system hang waiting for data. Is this a well know problem?

My configuration: from /etc/squid-deb-proxy/mirror-dstdomain.acl.d/10-default

.dl.google.com
.ppa.launchpad.net
.downloads-distro.mongodb.org
# tutti questi sono per getdeb
.getdeb.net
.mirror.lagoon.nc
.ftp.heanet.ie
.getdeb.mirror.garr.it
.archive.getdeb.net
.getdeb.megaglest.org
.mirrors.dotsrc.org
.zulu930.server4you.de
.188.138.90.189
.ftp.yzu.edu.tw
# fine getdeb
.apt.puppetlabs.com
.deb.theforeman.org
# postgresql.org
.postgresql.org
#owncloud
.download.owncloud.org
.download.opensuse.org
#tox
.pkg.tox.chat
#variety
.151.99.86.77 

from /etc/squid-deb-proxy/squid-deb-proxy.conf

acl allowed_networks src "/etc/squid-deb-proxy/autogenerated/allowed-networks-src.acl"
# this file contains the archive mirrors by default,
# if you use a different mirror, add it there
acl to_archive_mirrors dstdomain "/etc/squid-deb-proxy/autogenerated/mirror-dstdomain.acl"
# this contains the package blacklist
acl blockedpkgs urlpath_regex "/etc/squid-deb-proxy/autogenerated/pkg-blacklist-regexp.acl"
# default to a different port than stock squid
http_port 8000
# -------------------------------------------------
# settings below probably do not need customization
# user visible name
visible_hostname squid-deb-proxy
# we need a big cache, some debs are huge
# maximum_object_size 512 MB
# leonardo
maximum_object_size 2048 MB
# use a different dir than stock squid and default to 40G
# cache_dir aufs /var/cache/squid-deb-proxy 40000 16 256
# leonardo
cache_dir aufs /var/cache/squid-deb-proxy 100000 16 256
# use different logs
cache_access_log /var/log/squid-deb-proxy/access.log
cache_log /var/log/squid-deb-proxy/cache.log
cache_store_log /var/log/squid-deb-proxy/store.log
# tweaks to speed things up
cache_mem 200 MB
maximum_object_size_in_memory 10240 KB
# pid
pid_filename /var/run/squid-deb-proxy.pid
# refresh pattern for debs and udebs
refresh_pattern deb$ 129600 100% 129600
refresh_pattern udeb$ 129600 100% 129600
refresh_pattern tar.gz$ 129600 100% 129600
refresh_pattern tar.xz$ 129600 100% 129600
refresh_pattern tar.bz2$ 129600 100% 129600
# always refresh Packages and Release files
refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
refresh_pattern \/Release(|\.gpg)$ 0 0% 0 refresh-ims
refresh_pattern \/InRelease$ 0 0% 0 refresh-ims
refresh_pattern \/(Translation-.*)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
# handle meta-release and changelogs.ubuntu.com special
# (fine to have this on debian too)
refresh_pattern changelogs.ubuntu.com\/.* 0 1% 1
# only allow connects to ports for http, https
acl Safe_ports port 80
acl Safe_ports port 443 563
# only allow ports we trust
http_access deny !Safe_ports
# do not allow to download from the pkg blacklist
http_access deny blockedpkgs
# allow access only to official archive mirrors
# uncomment the third and fouth line to permit any unlisted domain
http_access deny !to_archive_mirrors
#http_access allow !to_archive_mirrors
# don't cache domains not listed in the mirrors file
# uncomment the third and fourth line to cache any unlisted domains
cache deny !to_archive_mirrors
#cache allow !to_archive_mirrors
# allow access from our network and localhost
http_access allow allowed_networks
# And finally deny all other access to this proxy
http_access deny all
# we don't want to clash with the squid netdb state file
netdb_filename stdio:/var/log/squid-deb-proxy/netdb.state

from squid-deb-proxy/allowed-networks-src.acl:

# private networks
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
192.168.1.0/16
127.0.0.1
# IPv6 private addresses
fe80::/64
::1/128
# additional non-private networks can be added to the directory:
# /etc/squid-deb-proxy/allowed-networks-src.acl.d

from /etc/squid-deb-proxy/allowed-networks-src.acl.d/10-default

188.138.90.189/17

I do not know what to do.

3 Answers

The relevant parts seem to be related to IP 151.99.86.73

Err:51 xenial-proposed/main amd64 gcc-5-base amd64 5.4.0-6ubuntu1~16.04.9 403 Forbidden

1518428931.389 32 192.168.1.107 TCP_DENIED/403 4233 GET - HIER_NONE/- text/html
1518429050.519 0 192.168.1.107 TCP_DENIED/403 4212 GET - HIER_NONE/- text/html
1518429176.717 33 192.168.1.107 TCP_DENIED/403 4221 GET - HIER_NONE/- text/html
1518429290.819 0 192.168.1.107 TCP_DENIED/403 4212 GET - HIER_NONE/- text/html
1518429410.878 0 192.168.1.107 TCP_DENIED/403 4239 GET - HIER_NONE/- text/html
1518429531.019 0 192.168.1.107 TCP_DENIED/403 4244 GET - HIER_NONE/- text/html

These requests are denied, because the destination (151.99.86.73) is not listed as an allowed domain. Adding this IP to /etc/squid-deb-proxy/mirror-dstdomain.acl.d/10-default should fix it. Add a line containing

151.99.86.73

and you're done.

2

on /etc/squid-deb-proxy/mirror-dstdomain.acl I have delete the point '.' in front of domain.

like this .archive.ubuntu.com become -> archive.ubuntu.com

the first test go well.

I try for some time until I can see if the error come back again.

1

The problem is solved but the reason is a mystery.

On my /etc/squid-deb-proxy/mirror-dstdomain.acl.d/10-default I have to add some ip:

• 151.99.86.73
• 151.99.86.75
• 151.99.86.77
• 151.99.86.79

Mostly are necessary because some download at archive.ubuntu.com resolve to 151.99.86.x/data/<exanumber>/

so when a new error reporting 151.99.86.x appears, I add a new ip to the acl file.

I like to understand why isn't use a domain address unless 151.99.86.x and I like to understand if there is a better solution than add one IP at time when the problem rise.

regards, Leonardo

1

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy