On Fri, 4 Feb 2005, Oliver Hookins wrote:
and then later on:
acl password proxy_auth REQUIRED
Have you also defined the required http_access rule using the password acl?
On my 2.5STABLE3 box I didn't explicitly have a http_access rule referring to the proxy_auth. I had one referring to the squid_ldap_group helper ACL though, and that seemed to work. Anyway here's the list of acl's and http_access lines so maybe you can see what I'm doing wrong on the 2.5STABLE7:
acl password proxy_auth REQUIRED
#Recommended minimum configuration: acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl SSL_ports port 443 563 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 563 # https, snews acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT acl our_network src 192.168.0.0/255.255.252.0
################################################## acl SURFING src 192.168.0.2 acl SURFING src 192.168.0.3 acl SURFING src 192.168.0.5 acl SURFING src 192.168.0.6 acl SURFING src 192.168.0.7 acl SURFING src 192.168.0.42 acl SURFING src 192.168.0.4 acl SURFING src 192.168.0.65 acl SURFING src 192.168.0.66 acl SURFING src 192.168.0.67 acl SURFING src 192.168.0.70 acl SURFING src 192.168.0.73 acl SURFING src 192.168.0.79 acl SURFING src 192.168.0.85 acl SURFING src 192.168.0.87 acl SURFING src 192.168.0.89 acl SURFING src 192.168.0.100 acl SURFING src 192.168.0.101 acl SURFING src 192.168.0.105 acl SURFING src 192.168.0.106 acl SURFING src 192.168.0.111 acl SURFING src 192.168.0.115 acl SURFING src 192.168.0.116 acl SURFING src 192.168.0.119 acl SURFING src 192.168.0.122 acl SURFING src 192.168.0.126 acl SURFING src 192.168.0.128 acl SURFING src 192.168.0.129 acl SURFING src 192.168.0.141 acl SURFING src 192.168.0.145 acl SURFING src 192.168.0.148 acl SURFING src 192.168.0.149 acl SURFING src 192.168.0.108 acl SURFING src 192.168.0.107 acl SURFING src 192.168.0.112 acl SURFING src 192.168.0.103 acl SURFING src 192.168.0.182 acl SURFING src 192.168.0.113 acl SURFING src 192.168.0.117 acl SURFING src 192.168.0.157 acl SURFING src 192.168.0.161 acl SURFING src 192.168.0.162 acl SURFING src 192.168.0.183 acl SURFING src 192.168.0.200 acl SURFING src 192.168.0.214 acl SURFING src 192.168.0.124 acl SURFING src 192.168.0.249 acl SURFING src 192.168.0.248 acl SURFING src 192.168.0.153
################################################## # General Sites acl allowedsites dstdomain .whitepages.com.au acl allowedsites dstdomain .whereis.com.au acl allowedsites dstdomain .gov.au acl allowedsites dstdomain .edu.au # IT Sites acl allowedsites dstdomain .symantec.com acl allowedsites dstdomain .symantec.com.au acl allowedsites dstdomain .canon.com acl allowedsites dstdomain .canon.com.au acl allowedsites dstdomain .microsoft.com acl allowedsites dstdomain .windowsupdate.com acl allowedsites dstdomain .akamai.net acl allowedsites dstdomain .symantecliveupdate.com acl allowedsites dstdomain .adobe.com acl allowedsites dstdomain .practicallynetworked.com acl allowedsites dstdomain .ntfaq.com acl allowedsites dstdomain .fixmypcasap.com acl allowedsites dstdomain .drivers.com acl allowedsites dstdomain .netgear.com acl allowedsites dstdomain .driverguide.com acl allowedsites dstdomain .papwalker.com acl allowedsites dstdomain .pap.homeftp.net acl allowedsites dstdomain .bmsltd.co.uk acl allowedsites dstdomain .sysinternals.com acl allowedsites dstdomain .mvps.org acl allowedsites dstdomain .sun.com acl allowedsites dstdomain .hillstouch.com # Account Sites acl allowedsites dstdomain .myob.com.au acl allowedsites dstdomain .ioof.com.au acl allowedsites dstdomain .superchoice.com.au acl allowedsites dstdomain .super.com
acl AuthGroup external ldap_group gOpenProxy
#Recommended minimum configuration: # # Only allow cachemgr access from localhost http_access allow manager localhost http_access deny manager # Deny requests to unknown ports http_access deny !Safe_ports # Deny CONNECT to other than SSL ports http_access deny CONNECT !SSL_ports # # We strongly recommend the following be uncommented to protect innocent # web applications running on the proxy server who think the only # one who can access services on "localhost" is a local user #http_access deny to_localhost # # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS # http_access allow allowedsites http_access allow localhost http_access allow SURFING # http_access allow AuthGroup #
http_access deny all
------------------
Thanks heaps, Oliver
