> At the top of the config after "http_port 80" add these: > > acl port80 myport 80 > deny_info https://site.company.org port80 > http_access deny port80 > > That will cause squid itself to send a 3xx moved fake 'error' > message to all port 80 requests. The users browser will then > automatically re-connect to port 443 before being asked to login. > > NP: for anyone else trying to copy this: it only works on one > domain name at a time. Needs adjustment for virtual-hosted setups. > > > > > Can I add in an ACL to permit users from certain IP ranges > to access the site with having to authenticate to LDAP? I'm > thinking about sending all users through Squid but I don't > want to force users on our LAN to have to authenticate. > > > > Yes. Just chain the acl names properly. An http_access allow > line before one that requires auth should do it. > Thanks for your help! This is my new config that seems to be working fine: --------------------- http_port 80 defaultsite=mysite.company.org https_port 443 cert=/etc/ssl/certs/company.cert key=/etc/ssl/certs/company.key defaultsite=mysite.company.org #redirects all http traffic to https acl port80 myport 80 deny_info https://mysite.company.org port80 http_access deny port80 cache_peer mysite.company.org parent 443 0 no-query originserver ssl sslflags=DONT_VERIFY_PEER name=myAccel acl our_sites dstdomain mysite.company.org acl all src 0.0.0.0/0.0.0.0 auth_param basic program /usr/lib/squid/ldap_auth -R -b "dc=company,dc=org" -D "cn=squid_user,cn=Users,dc=company,dc=org" -w "password" -f sAMAccountName=%s -h 192.168.1.2 auth_param basic children 2 auth_param basic realm Our Website auth_param basic credentialsttl 2 hours #these networks can access mysite without authenticating acl trusted_nets src 10.2.1.0/24 acl trusted_nets src 192.168.1.0/24 acl ldap_users proxy_auth REQUIRED http_access allow trusted_nets our_sites http_access allow ldap_users our_sites cache_peer_access myAccel allow our_sites cache_peer_access myAccel deny all never_direct allow our_sites --------------------- You mentioned supporting multiple hosts. Is it relatively easy for a squid reverse proxy to provide access to several internal servers (I.e. mysite.company.org, mysite2.company.org, etc)? Andrew
