Autenticação Squid

tiagopaulista
(usa Debian)

Enviado em 21/07/2011 - 18:42h

Boa noite Senhores,

Estou precisando tirar uma duvida, tenho um squid funcionando redondo, mais acabei de achar um problema, quando o pessoal tira o IP do proxy no browser a internet funciona sem bloquear nada, o que esta de errado no squid e o que posso fazer para quando tirarem o IP do browser e internet não funcionar, segue abaixo o squid:

http_port 127.0.0.1:3128 transparent
visible_hostname Interface

cache_mem 15 MB
maximum_object_size_in_memory 1024 KB
maximum_object_size 81920 KB
minimum_object_size 0 KB

cache_swap_low 90
cache_swap_high 95

cache_dir aufs /var/spool/squid 100 16 256
cache_access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log

refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320

ftp_telnet_protocol on

auth_param basic program /usr/lib/squid/pam_auth
auth_param basic children 40
auth_param basic realm Acesso Restrito
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off

read_timeout 2 days
half_closed_clients off
pconn_timeout 360 seconds
shutdown_lifetime 0 seconds

acl all src 0.0.0.0/0.0.0.0
acl localhost src 127.0.0.1/255.255.255.255

auth_param basic program /usr/lib/squid/ncsa_auth /etc/squid/squid_passwd
acl autenticados proxy_auth REQUIRED
http_access allow autenticados

acl USUARIOS proxy_auth REQUIRED
acl USUARIOS_NAO_ORKUT proxy_auth "/etc/squid/rules/users-orkut.rules"
acl USUARIOS_NAO_YOUTUBE proxy_auth "/etc/squid/rules/users-youtube.rules"
acl USUARIOS_NAO_TWITTER proxy_auth "/etc/squid/rules/users-twitter.rules"
acl USUARIOS_NAO_GMAIL proxy_auth "/etc/squid/rules/users-gmail.rules"
acl USUARIOS_NAO_PROMOTE proxy_auth "/etc/squid/rules/users-promote.rules"
acl USUARIOS_NAO_EVOSERVER proxy_auth "/etc/squid/rules/users-evoserver.rules"
acl USUARIOS_NAO_MEEBO proxy_auth "/etc/squid/rules/users-meebo.rules"
acl USUARIOS_NAO_TERRA proxy_auth "/etc/squid/rules/users-terra.rules"
acl ORKUT url_regex orkut
acl GMAIL url_regex gmail
acl PROMOTE url_regex promote
acl EVOSERVER url_regex evoserver
acl YOUTUBE url_regex youtube
acl TWITTER url_regex twitter
acl MEEBO url_regex meebo
acl TERRA url_regex terra.com.br

acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 901 # SWAT
acl purge method PURGE
acl CONNECT method CONNECT

# # HTTPD-ACCELERATOR OPTIONS
# ---------------------------------------
# Comando do IPtables
# iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
#
httpd_accel_port 80
httpd_accel_host virtual

# # TAG: httpd_accel_with_proxy
# --------------------------------------
#
#
httpd_accel_with_proxy on


# TAG: httpd_accel_uses_host_header on|off
#
#
httpd_accel_uses_host_header on

http_access deny USUARIOS_NAO_ORKUT ORKUT
http_access deny USUARIOS_NAO_YOUTUBE YOUTUBE
http_access deny USUARIOS_NAO_GMAIL GMAIL
http_access deny USUARIOS_NAO_PROMOTE PROMOTE
http_access deny USUARIOS_NAO_EVOSERVER EVOSERVER
http_access deny USUARIOS_NAO_TWITTER TWITTER
http_access deny USUARIOS_NAO_MEEBO MEEBO
http_access deny USUARIOS_NAO_TERRA TERRA
http_access allow USUARIOS

http_access allow SSL_ports
http_access allow Safe_ports

http_access allow all
http_access allow manager localhost
http_access deny manager

http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

acl redelocal src 192.168.0.0/24
http_access allow localhost
http_access allow redelocal

http_access deny all

error_directory /usr/share/squid-langpack/pt-br/

Att,

renato_pacheco
(usa Debian)

Enviado em 21/07/2011 - 23:57h

Barre o INPUT e o FORWARD pra porta 80:


# iptables -I INPUT -i ethx -p tcp --dport 80 -j DROP
# iptables -I FORWARD -i ethx -p tcp --dport 80 -j DROP

Sendo ethx sua interface d rede interna.

tiagopaulista
(usa Debian)

Enviado em 22/07/2011 - 06:46h

Vou fazer os teste e depois eu te aviso, valeu.