molybtek wrote:
Chris Robertson-2 wrote:
molybtek wrote:
We have squid running as an authenticating proxy using squid_ldap_auth.
In the access log, for normal connections, it records the username for
most
log entries.
However, for secure connections, the username field is blank. Are there
any
way to get Squid to record the username for those secure connections as
well?
If you require authentication for CONNECT requests, Squid will populate
the log with the credentials used. Post your ACLs and http_access lines
and we can help figure out where the mistake lies...
Chris
The following are the acls and http_access lines in the squid.conf
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
#Recommended minimum configuration:
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl localnets src 172.23.0.0/16
# SNMP ACLs
acl snmppublic snmp_community squidcommunity
snmp_port 3401
snmp_access allow snmppublic all
# ACL for Microsoft product activation addresses
acl ms_activate dstdomain productactivation.one.microsoft.com
acl ms_activate dstdomain wustat.windows.com
acl ms_activate2 dstdomain .microsoft.com
# Microsoft Updates
acl ms_update dstdomain .windowsupdate.microsoft.com:443
acl ms_update dstdomain .windowsupdate.microsoft.com:80
acl ms_update dstdomain .update.microsoft.com:80
acl ms_update dstdomain .windowsupdate.com:80
acl ms_update dstdomain download.microsoft.com:80
acl ms_update dstdomain ntservicepack.microsoft.com:80
acl ms_update dstdomain wustat.windows.com:80
acl ms_update dstdomain .update.microsoft.com:443
":80" and ":443" are not part of a domain name. The above will not match.
Luckily your ms_activate2 ACL covers all these domains on its own.
# Skype
acl numeric_IPs url_regex ^[0-9]+.[0-9]+.[0-9]+.[0-9]+:443
acl Skype_UA browser ^skype^
acl SSL_ports port 441 442 443 563 10000
acl FTP_ports port 21 # FTP
acl Messengers port 5050 # Yahoo
acl Messengers port 5190 # AOL
acl Messengers port 1863 # MSN
acl Messengers port 5222 # Gtalk
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 441-443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 10000 # Webmin
acl CONNECT method CONNECT
acl require_auth proxy_auth REQUIRED
acl ms_activateVista dstdomain go.microsoft.com
acl ms_activateVista dstdomain sls.microsoft.com
acl ms_activateVista dstdomain sls.microsoft.com:443
acl ms_activateVista dstdomain crl.microsoft.com/pki/crl/products
acl educationsite_allow dstdomain ce6hosting.blackboard.com/webct
same problem again. "/webct" and "/pki/crl/products" and ":443" are not
parts of domains. This may be causing issues for the domain
ce6hosting.blackboard.com
acl educationsite_allow dstdomain 2007.pglms.com
http_access allow ms_activate2
http_access allow ms_activate
http_access allow ms_activateVista
http_access allow ms_update
http_access allow educationsite_allow
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access allow CONNECT Messengers
http_access allow CONNECT Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow require_auth
http_access deny all
Well, since you allow all those updates, and private domain accesses,
and CONNECT requests already before any authentication is asked for you
wont get any auth details for most of those requests (sometimes you will
get the by chance luck).
Here is a simplified set of http_access which do the same thing but add
auth requirements on CONNECT:
acl ms_activate dstdomain wustat.windows.com .windowsupdate.com
acl ms_activate dstdomain .microsoft.com
http_access allow ms_activate
http_access allow educationsite_allow
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports !Messengers
http_access allow require_auth
http_access deny all
PS. If you did want the messengers to get through without auth details
beign logged then add this back in just above the require_auth.
http_access allow CONNECT Messengers
Amos
--
Please be using
Current Stable Squid 2.7.STABLE6 or 3.0.STABLE14
Current Beta Squid 3.1.0.7
