Search squid archive

Re: blocking binary download

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



I'm quite stupid,

I was already correcting this, when I saw your answer.

the working rule is the following :

acl contenttypes rep_mime_type video audio application/octet-stream \
                 application/x-msdownload application/exe \
		 application/x-exe \
                 application/dos-exe vms/exe application/x-winexe \
                 application/msdos-windows application/x-msdos-program \
                 binary

http_reply_access deny contenttypes

changes : reP_mime_type instead of reQ_mime_type in the acl
and http_reply_acces instead of request_header_access rule.



Adrian Chadd a écrit :
req_mime_type won't help you if its what I remember it being ,a
-request- mime type.

You need to block on the -reply- mime type.


adrian

2009/7/8 Erwann PENCREACH <erwann.pencreach@xxxxxxxxxxxxxx>:
Hi all,

I'm trying to write rules that will block binary downloads

what I've writen :

acl contenttype1 req_mime_type video audio application/octet-stream \
                application/x-msdownload application/exe \
                application/x-exe \
                application/dos-exe vms/exe application/x-winexe \
                application/msdos-windows application/x-msdos-program \
                binary

request_header_access Content-Type deny contenttype1


I checked it with nvidia drivers download, but this rule doesn't work.


$ sudo tcpflow -vvv -c -i bond0 src X.X.X.X
[...]
tcpflow[32412]: 010.012.011.010.03809-010.012.003.001.03128: new flow
010.012.011.010.03809-010.012.003.001.03128: GET
http://us.download.nvidia.com/Windows/186.18/186.18_desktop_winxp_32bit_english_whql.exe
HTTP/1.1
Host: us.download.nvidia.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.0.10; .NET
CLR 2.0.50727; ffco7) Gecko/2009042316 Firefox/3.0.10
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
Referer:
http://www.nvidia.com/content/DriverDownload/download_confirmation.asp?kw=&url=http://us.download.nvidia.com/Windows/186.18/186.18_desktop_winxp_32bit_english_whql.exe
Cookie: s_cc=true; s_nr=1247055367647; s_sq=%5B%5BB%5D%5D;
s_vi=[CS]v1|4A548C4E0000425B-A3A081300001672[CE]


this is the last tcpflow block I obtain, just before the download box pops
up at screen (asking me if I want to run or download the binary)


I'm using squid 3 + squidGuard, Is there anyway to make it work properly ?

My predecessor wrote rules based on url_regex to do that job on the former
proxy , but this filtering is too large (no url containing exe at any place
is granted)

thank's for your help (and be tolerant with my poor english level)

--
Ce courrier électronique a été vérifié et est exempt de virus connus à ce
jour.
Contactez votre administrateur pour plus de renseignement.
postmaster@xxxxxxxxxxxxxx

--
Ce courrier électronique a été vérifié et est exempt de virus connus à ce jour.
Contactez votre administrateur pour plus de renseignement.
postmaster@xxxxxxxxxxxxxx


--
Ce courrier ÿlectronique a ÿtÿ vÿrifiÿ et est exempt de virus connus ÿ ce jour.
Contactez votre administrateur pour plus de renseignement.
postmaster@xxxxxxxxxxxxxx

begin:vcard
fn:Erwann Pencreach
n:Pencreach;Erwann
org:Centre Hospitalier de Chaumont;Service Informatique
adr;dom:;;2 rue Jeanne D'arc;Chaumont;;52000
email;internet:erwann.pencreach@xxxxxxxxxxxxxx
title:Technicien Informatique
tel;work:0325357321
tel;fax:0325030674
x-mozilla-html:FALSE
version:2.1
end:vcard


[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux