exore's questions

I want squid to listen to ports 3128 and 3129. I want auth on 3129 and no auth on 3128. For now I have this config

# auth_param not shown but working

http_port 3128
http_port 3129
acl input_3128 myportname 3128
acl input_3129 myportname 3129
acl authenticated proxy_auth REQUIRED

http_access allow authenticated input_3129
http_access deny input_3129
http_access allow input_3128
http_access deny all

Unfortunately this does not work at all. Squid always require authentication.

example request:

curl -v --proxy http://myproxy.example.com:3128 http://debian.org/

Squid response:

* processing: http://debian.org/
10.1.2.3:3128...
* Connected to myproxy.example.com (10.1.2.3) port 3128
> GET http://debian.org/ HTTP/1.1
> Host: debian.org
> User-Agent: curl/8.2.1
> Accept: */*
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 407 Proxy Authentication Required
< Server: squid/5.9
< Mime-Version: 1.0
< Date: Wed, 23 Oct 2024 10:15:01 GMT
< Content-Type: text/html;charset=utf-8
< Content-Length: 3511
< X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0
< Vary: Accept-Language
< Content-Language: en
< Proxy-Authenticate: Basic realm="Squid proxy-caching web server"
< X-Cache: MISS from myproxy
< X-Cache-Lookup: NONE from myproxy:3129
< Via: 1.1 myproxy (squid/5.9)
< Connection: keep-alive
<

Question

How to make squid require authentication only on port 3129 ?

I successfully use xfs project (or directory) quota. However I just discovered that I am unable to remove quota information once I don't need it anymore. For example, I had 3 projects with project id 1, 2, 3. I removed the directory of the project with id 2, and now xfs_quota continues to tell me that there is is a project with id 2, and it has quota. The reported used space is 0, which is correct since the directory was removed. This is not a real problem. Whenever I reuse project id 2 I will set new quota, but I'd still like to remove this useless information from the filesystem.

/etc/projects

1:/web/perso/usera
3:/web/perso/userc

/etc/projid

usera:1
userc:3

And here is what xfs_quota reports.

root@server # xfs_quota -xc "report -a -p -h" 
Project quota on /web (/dev/vdb1)
                        Blocks              
Project ID   Used   Soft   Hard Warn/Grace   
---------- --------------------------------- 
#0         588.3M      0      0  00 [------]
usera        5.5M    14G    14G  00 [------]
#2              0   980M     1G  00 [------]
userc      574.6M    14G    14G  00 [------]

How can I tell xfs that it does not need anymore to keep track of project id 2 ?

I use and need php_fpm7.0 on debian 9 (stretch) apache 2.4.25. DocumentRoot is /var/www/html and works well. Php enabled, scripts executed etc... Now I also want to serve the same arborescence as a filesystem via apache dav_fs module.

To do this :

1. /var/www/webdav is a symlink to /var/www/html so I can name the same directory with 2 different names in apache config file, and so create 2 distinct configurations based on access name
2. I access webdav with /webdav URL. Inside apache config, /webdav is an alias that points to /var/www/webdav. Now I only need to setup the <Directory /var/www/webdav> section and everything should be good.

So far, it almost works : I can get and put files, create directories, rename files etc... with webdav, but PHP files continue to be executed when I GET them via the webdav alias. So if I want to edit a .php file, I indeed get the result of the script in my editor, which is useless.

My setting so far :

<VirtualHost *:80>
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    <Directory /var/www/html>
        AllowOverride All
        require all granted
        Options Indexes FollowSymLinks MultiViews
    </Directory>

    Alias /webdav /var/www/webdav
    <Directory /var/www/webdav>
        SetHandler none
        Options -ExecCGI -FollowSymLinks -Includes -Indexes -MultiViews
        AddType text/plain php php3 php4 php5 php7 php8 pht phptml phps
        AllowOverride None
        DAV On
        <ifmodule mod_dir.c>
            DirectoryIndex disabled
        </ifmodule>
        <ifmodule mod_rewrite.c>
            RewriteEngine Off
        </ifmodule>
        <Files ~ "^\.ht"> # need to be able to edit .htaccess files.
            require all granted
        </Files>
    </Directory>
</VirtualHost>

What is the correct way to prevent php execution in /var/www/webdav directory ?

Edit and Solution

Since Debian uses SetHandler "proxy:unix:/run/php/php7.0-fpm.sock|fcgi://localhost" /etc/apache2/conf-available/php7.0-fpm.conf, I have to use SetHandler none. But in the <Directory> section, this is too late. it must be used in <Location>, this is interpreted early enough. I also included ProxyPass ! as @exussum suggests (should be placed in <Location> ?). It is useles in this precise case, but proxy is certainly unwanted here anyway.

Also note that I had to put the authentication/authorization in <Directory>. It worked in <Location>, but only the CLI cadaver client could access the webdav collection. When authentication/authorization is in <Directory>, the nautilus filemanager could access the files.

<VirtualHost *:80>
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    <Directory /var/www/html>
        AllowOverride All
        require all granted
        Options Indexes FollowSymLinks MultiViews
    </Directory>

    Alias /webdav /var/www/webdav
    <Location /webdav>
        <IfModule mod_proxy.c>
            ProxyPass !
        </IfModule>
        SetHandler none
        AddType text/plain php php3 php4 php5 php7 php8 pht phptml phps
    </Location>
    <Directory /var/www/webdav>
        AuthName "Restricted Area"
        AuthType Basic
        AuthUserFile    "/etc/apache2/user-password"
        require valid-user
        Options -ExecCGI -FollowSymLinks -Includes -Indexes -MultiViews
        AllowOverride None
        DAV On
        <ifmodule mod_dir.c>
            DirectoryIndex disabled
        </ifmodule>
        <ifmodule mod_rewrite.c>
            RewriteEngine Off
        </ifmodule>
        <Files ~ "^\.ht"> # need to be able to edit .htaccess files.
            require all granted
        </Files>
    </Directory>
</VirtualHost>