Hi all, First of all sorry if I'm asking something obvious, I'm a really squid newbie. I've set up a squid proxy on a CentOS 5.1 server, with winbind authenticating in a Windows 2003 ADS. Squid version is 2.6 stable 6. Squid is working nice with a minimun set of rules, but now we want to allow only certain sites to every single user. I've tried some acls mixing infos and examples we founded around, but they do not work, both user tested get same sites blocked or allowed. What we would is every user has its own list of allowed sites, some sites allowed for everyones, and another list of sites allowed for everybody only during lunch break. Thanks! This is our squid.conf (relevant parts): --------------------------------------------------------------- # ACL for ADS authentication acl AuthUser proxy_auth REQUIRED acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl local_lan src 192.168.1.0/255.255.255.0 acl CONNECT method CONNECT acl QUERY urlpath_regex cgi-bin \? # Only allow cachemgr access from localhost http_access allow manager localhost http_access deny manager # Deny requests to unknown ports http_access deny !Safe_ports # Deny CONNECT to other than SSL ports http_access deny CONNECT !SSL_ports acl Java browser Java/1.4 Java/1.5 http_access allow Java # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS # ---------------------------------------------------------------------------- # Allowed sites for everyone, in this file: acl allowedurls dstdomain "/etc/squid/allowedurls" # Avoid cheating using search engines caches: acl blockcache url_regex -i "/etc/squid/blockcache" http_access allow localhost http_access deny blockcache AuthUser http_access allow allowedurls AuthUser acl lunchbreak time D 13:00-14:00 acl lunchbreaksites dstdomain "/etc/squid/lunchbreaksites" http_access allow lunchbreak lunchbreaksites # User by user ACL: acl administrator proxy_auth REQUIRED acl assistenza proxy_auth REQUIRED acl Microsoft dstdomain .microsoft.com .microsoft.it http_access deny Microsoft administrator http_access deny administrator http_access allow Microsoft assistenza http_access deny assistenza # Final rules: http_access deny all http_reply_access allow all acl FTP proto FTP always_direct allow FTP #-------------------------------------------------------- # note 33,2 lets you see which acl allowed or denied debug_options ALL,1 33,2
<<attachment: smime.p7s>>
