Thanks Chad I'll follow this instructions Gonzalo >>> "Chad Naugle" <Chad.Naugle@xxxxxxxxxxx> 31-01-2011 >>> You need to move all of your "deny" lines *before* your "allow" lines, otherwise you will get the popup. FYI, if you plan on using eDirectory 8.8 based IP->User, I wrote a C-based program for that, which is bundled with Squid 3.2-BETA, instead of using a perl script. You can probably just build 3.2.X without installing it and copy the executable to /usr/sbin, and use that for the blind auth. >>> "Gonzalo Morera" <gmorera@xxxxxxxxxx> 1/31/2011 11:16 AM >>> Hi all After solving the squid_ldap_group issue, i'm still facing a little one with users that are transparently authenticate thru a pl script against edirectory. I've got this line: external_acl_type IPUser ttl=7200 %SRC /etc/squid/squid_edir_iplookup.pl (IPUser method) squid_edir_iplookup.pl is for users that have the novell client installed. Thru this script, they network address is found and authenticate without being prompted. This works fine as long as they do not hit a forbidden page. And here is my problem. When they hit a forbidden page, instead to get the 403 forbidden, they prompt for authentication. If then enter a username/password (they share passwords :-( ) with rights, they can go to the page. So my goal is that when this users are hitting a forbidden page, the forbidden page comes and not the auth page. I can not find out how to do so or if the order of the rules are wrong Here is my squid.conf. Let me know if anything else is needed: ===snip==== #Recommended minimum configuration: acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl SSL_ports port 443 563 acl Safe_ports port 80# http acl Safe_ports port 21# ftp acl Safe_ports port 443 563# https, snews acl Safe_ports port 70# gopher acl Safe_ports port 210# wais acl Safe_ports port 1025-65535# unregistered ports acl Safe_ports port 280# http-mgmt acl Safe_ports port 488# gss-http acl Safe_ports port 591# filemaker acl Safe_ports port 777# multiling http acl CONNECT method CONNECT #Mis reglas #acl redlocal src 192.168.0.0/255.255.255.0 #acl redsynergy proxy_auth REQUIRED #acl redsynergy proxy_auth REQUIRED redlocal # # Hosts that are not required to authenticate acl Auth_Not_Required src "/etc/squid/auth_not_required.txt" # Domains accessible to all PC's #acl Open_Domains dstdomain "/etc/squid/open_domains.txt" acl Open_Domains url_regex -i "/etc/squid/open_domains.txt" # Hosts & domains that are denied to restricted users #acl Banned_Hosts dst "/etc/squid/banned_hosts.txt" #acl Banned_Domains dstdomain "/etc/squid/banned_domains.txt" acl Banned_URLs url_regex -i "/etc/squid/banned_urls.txt" #acl Banned_Extensions url_regex "/etc/squid/banned_extensions.txt" # Seemless automatic access based on IP address # Access through the "IP User" external helper acl Full_Access external IPUser internet_nr acl Restricted_Access external IPUser internet_r # Access to users prompted with username/password dialogue # Full access acl lab_Full external ldap_group internet_nr # Restricted access acl lab_Restricted external ldap_group internet_r # TAG: http_access #Allowing or Denying access based on defined access lists # #Access to the HTTP port: #http_access allow|deny [!]aclname ... # #NOTE on default values: # #If there are no "access" lines present, the default is to deny #the request. # #If none of the "access" lines cause a match, the default is the #opposite of the last line in the list. If the last line was #deny, the default is allow. Conversely, if the last line #is allow, the default will be deny. For these reasons, it is a #good idea to have an "deny all" or "allow all" entry at the end #of your access lists to avoid potential confusion. # #Default: # http_access deny all # #Recommended minimum configuration: # # Only allow cachemgr access from localhost http_access allow manager localhost http_access deny manager # Deny requests to unknown ports http_access deny !Safe_ports # Deny CONNECT to other than SSL ports http_access deny CONNECT !SSL_ports # # We strongly recommend the following be uncommented to protect innocent # web applications running on the proxy server who think the only # one who can access services on "localhost" is a local user #http_access deny to_localhost # # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS # # Domains free to all users without needing to authenticate. http_access allow Open_Domains # IP addresses of hosts that don?t need to authenticate (usually automation hosts #performing automated downloads and without a Novell client. http_access allow Auth_Not_Required # Let users with full Internet access discovered by the IPUser method go anywhere. http_access allow Full_Access # Let users with restricted Internet access discovered by the IPUser method go #anywhere except for the ban list http_access allow Restricted_Access !Banned_URLs # If the IPUser method fails then we need to revert to username/password #authentication # Let users with full access who entered username/password go anywhere http_access allow lab_Full # Ban list again #http_access deny Banned_Hosts #http_access deny Banned_Domains http_access deny Banned_URLs #http_access deny Banned_Extensions # Let users with restricted access who entered username/password go anywhere (that # hasn?t been already excluded in the ban list). http_access allow lab_Restricted # # Example rule allowing access from your local networks. Adapt # to list your (internal) IP networks from where browsing should # be allowed #acl our_networks src 192.168.1.0/24 192.168.2.0/24 #http_access allow our_networks http_access allow localhost # And finally deny all other access to this proxy http_access deny all # TAG: http_reply_access # Allow replies to client requests. This is complementary to http_access. # # http_reply_access allow|deny [!] aclname ... # # NOTE: if there are no access lines present, the default is to allow #all replies # # If none of the access lines cause a match the opposite of the # last line will apply. Thus it is good practice to end the rules # with an "allow all" or "deny all" entry. # #Default: # http_reply_access allow all # #Recommended minimum configuration: # # Insert your own rules here. # # # and finally allow by default http_reply_access allow all Thanks a lot Gonzalo Travel Impressions made the following annotations ------------------------------------------------------------- "This message and any attachments are solely for the intended recipient and may contain confidential or privileged information. If you are not the intended recipient, any disclosure, copying, use, or distribution of the information included in this message and any attachments is prohibited. If you have received this communication in error, please notify us by reply e-mail and immediately and permanently delete this message and any attachments. Thank you."
