Search squid archive

Re: ACL configuration

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello Amos !

Thank for your replay, i solve the problem.
It was necessary to remove 2 lines permissive all authorized users
All work fine, thanks

Вы писали 19 апреля 2010 г., 18:01:00:
> Никоноров Григорий wrote:
>> Hello, Amos
>> 
>> I install the latest version of squid3 from backports (unfortunately
>> i cant find my problem in squid3 bugs ...)
>> dpkg --list |grep squid3
>> ii  squid3                              3.0.STABLE19-1~bpo50+1   A full featured Web Proxy cache (HTTP proxy)
>> ii  squid3-common                       3.0.STABLE19-1~bpo50+1   A full featured Web Proxy cache (HTTP proxy) - common files
>> 
>> I also delete two lines about QUERY...
>> acl QUERY urlpath_regex cgi-bin \?
>> no_cache deny QUERY
>> 
>> ...and modified my refresh_patters accordingly your advice
>> refresh_pattern \.doc$          0       20%     4320
>> refresh_pattern \.zip$          0       20%     4320
>> refresh_pattern \.exe$          0       20%     4320
>> refresh_pattern \.rar$          0       20%     4320
>> refresh_pattern ^ftp:           1440    20%     10080
>> refresh_pattern ^gopher:        1440    0%      1440
>> refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
>> refresh_pattern .               0       20%     4320
>> 
>> I upload my squid.conf for "easy to read" purpose in pastebay.com
>> http://pastebay.com/94291 (no virus guys...only my squid.conf :)
>> 
>> p.s. regex replacement on dstdomain not helped
>> 
>> You wrote 19 апреля 2010 г., 13:47:21:
>>> Никоноров Григорий wrote:
>>>> Hi,
>>>>
>>>> After  the upgrade from 2.7 to 3.0.STABLE8-3 + lenny3 squid stop block
>>>> prohibited sites. 
>> 
>>> IMO grab the official backport package from 
>>> http://www.backports.org/debian/pool/main/s/squid3/ if you can.
>> 
>>>> My Squid3 conf:
>>>> acl ADMIN proxy_auth "/etc/squid3/users/users.admin"
>>>> acl bad_site url_regex -i  "/etc/squid3/bad_site.acl"
>>>>
>>>> bad_site.acl:
>>>> vkontakte\.ru
>>>> odnoklassniki\.ru
>>>> pagewash\.com
>>>> vk\.com
>> 
>>> Hmm. Regardless of your squid version those are far better off being 
>>> configured as a "dstdomain" ACL type. Regex is Slooooowww.
>> 
>>>    acl bad_site dstdomain "/etc/squid3/bad_site.acl"
>> 
>>>   bad_site.acl:
>>>    .vkontakte.ru
>>>    .odnoklassniki.ru
>>>    .pagewash.com
>>>    .vk.com
>> 
>>>> http_access allow manager localhost
>>>> http_access deny manager
>>>> http_access deny !Safe_ports
>>>> http_access allow ADMIN !bad_site
>>>> acl QUERY urlpath_regex cgi-bin \?
>>>> no_cache deny QUERY
>> 
>>> The above two lines about QUERY are no longer very useful.
>> 
>>> Remove them and make sure your *final* two refresh_patterns lines match
>>> the new defaults for squid-3.x:
>> 
>>>    refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
>>>    refresh_pattern .  0 20% 4320
>> 
>> 
>>>> http_access deny all
>>>>
>>>>
>>>> 192.168.164.111 - user from group ADMIN
>>>>
>>>> Access log:
>>>> 1271418317.455    103 192.168.164.111 TCP_MISS/302 494 GET http://vkontakte.ru/id000000 user DIRECT/93.186.231.220 text/html
>>>> 1271418317.536     71 192.168.164.111 TCP_MISS/200 3767 GET http://vkontakte.ru/login.php? user DIRECT/93.186.231.220 text/html
>>>> 1271418317.665      5 192.168.164.111 TCP_MISS/304 347 GET http://vkontakte.ru/images/xhead2.gif user DIRECT/93.186.231.220 -
>>>> 1271418317.669      9 192.168.164.111 TCP_MISS/304 347 GET http://vkontakte.ru/images/header_yellow.gif user DIRECT/93.186.231.222 -
>>>> 1271418317.674     15 192.168.164.111 TCP_MISS/304 347 GET http://vkontakte.ru/images/header_divider.gif user DIRECT/93.186.231.221 -
>>>> 1271418317.690     35 192.168.164.111 TCP_MISS/304 483 GET http://www.tns-counter.ru/V13a***R>*vkontakte_ru/ru/CP1251/tmsec=vkontakte_total/ user DIRECT/217.73.200.219 -
>>>> 1271418317.714     55 192.168.164.111 TCP_MISS/200 386 GET http://counter.yadro.ru/hit? user DIRECT/88.212.196.77 image/gif
>>>> 1271418321.434     82 192.168.164.111 TCP_MISS/200 5360 GET http://vk.com/ user DIRECT/93.186.231.221 text/html
>>>> 1271418321.476    124 192.168.164.111 TCP_MISS/200 719 GET http://sitecheck2.opera.com/? user DIRECT/91.203.99.45 text/xml
>>>> 1271418322.588     34 192.168.164.111 TCP_MISS/304 483 GET http://www.tns-counter.ru/V13a***R>*vkontakte_ru/ru/CP1251/tmsec=vkontakte_total/ user DIRECT/217.73.200.220 -
>>>> 1271418322.608     54 192.168.164.111 TCP_MISS/200 386 GET http://counter.yadro.ru/hit? user DIRECT/88.212.196.101 image/gif
>>>> 1271418324.221   1670 192.168.164.111 TCP_MISS/200 6368 CONNECT certs.opera.com:443 user DIRECT/91.203.99.57 -
>>>> 1271418324.358     69 192.168.164.111 TCP_MISS/200 738 GET http://login.vk.com/? user DIRECT/93.186.229.129 text/html
>>>> 1271418324.433     56 192.168.164.111 TCP_MISS/200 617 POST http://vk.com/login.php? user DIRECT/93.186.231.222 text/html
>>>>
>> 
>> 
>>> I can't see any reason why those requests might go through. Is there any
>>> additional http_access configuration anywhere?
>> 
>>> If not, try with the backports package and see if it goes away.
>> 
>>> Amos
>> 

> Wading through that config I find the very first http_access:

>   acl ncsa_users proxy_auth REQUIRED
>   http_access allow ncsa_users

> ... any user with a valid login has unlimited access through your server.

>   The http_access rules following that line apply only to non-logged in
> users.


> Amos



-- 
С уважением,
Никоноров Григорий
Системный администратор
ЗАО "Комита"
icq 419950912
Тел. 295
 


[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux