edumeira2009
(usa Debian)
Enviado em 22/12/2009 - 11:07h
SO: Debian 5
Squid: 2.7 Stable3
Estação com o software Genexus que utiliza a porta 80 HTTP/1.1 => Server Squid => Internet => Server Princiapal.
Se tirar o server Squid o sistema roda normal.
http_port 3128
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
cache_mem 1500 MB
cache_swap_low 90
cache_swap_high 95
maximum_object_size 1000 MB
ipcache_size 1024
ipcache_low 90
ipcache_high 95
fqdncache_size 1024
cache_replacement_policy lru
memory_replacement_policy lru
cache_dir ufs /usr/local/squid/cache 2500 16 100
cache_access_log /usr/local/squid/var/logs/access.log
cache_store_log none
# As linhas abaixo se referem a autenticação de usuários no AD
auth_param basic program /usr/local/squid/libexec/squid_ldap_auth -R -b "dc=integra,dc=local" -D "cn=proxy_user,ou=Internet,dc=integra,dc=local" -w "123456" -f sAMAccountName=%s -h 192.168.0.253
auth_param basic realm Este acesso será registrado Digite sua chave e senha
auth_param basic children 5
auth_param basic credentialsttl 15 minutes
emulate_httpd_log on
mime_table /usr/local/squid/etc/mime.conf
pid_filename /usr/local/squid/var/logs/squid.pid
ftp_user down@meudominio.com.br
ftp_passive on
unlinkd_program /usr/local/squid/libexec/unlinkd
# ACL externa para autenticação nas bases LDAP do PDC
external_acl_type ldap_group %LOGIN /usr/local/squid/libexec/squid_ldap_group -R -b "dc=integra,dc=local" -D "cn=proxy_user,ou=Internet,dc=integra,dc=local" -w "123456" -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=%a,ou=Internet,dc=integra,dc=local))" -h 192.168.0.253
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563 9141
acl Safe_ports port 80 # http
acl Safe_ports port 81
acl Safe_ports port 82
acl Safe_ports port 85
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
# A acl abaixo faz bloqueio de acesso por IP"
acl block_ip src "/usr/local/squid/etc/ips_bloqueados"
# A ACL abaixo efetua bloqueio do MSN
acl dst_msn dstdomain -i "/usr/local/squid/etc/msn_domain"
# A ACL abaixo barra download de arquivos com extensões exe mp3 wma wmv mpg avi asf
acl block_arq urlpath_regex -i .com$ .exe$ .scr$ .mp3$ .mpeg$ .wma$ .wmv$ .mpg$ .avi$ .pif$
acl palavra_download url_regex -i "/usr/local/squid/etc/palavra_download-url"
# As ACLs abaixo relaxam o controle de conteúdo das 12:00 as 13:30
# Inserir os sites a serem liberados das 12 as 13 no arquivo /usr/local/squid/etc/libera_almoco
#acl libera_sites url_regex -i "/usr/local/squid/etc/libera_almoco" #sites de "libera_almoco"
#acl almoco time SMTWHFA 12:00-13:30 #libera acesso das 12 as 13:30 #de segunda a domingo.
# A ACL abaixo libera alguns sites para acesso sem autenticação como bancos, governo e Abrapetite
acl libera_restritos dstdomain -i "/usr/local/squid/etc/sites_liberados" # Libera alguns sites p/user s/acesso
# ACLs de Controle de Conteúdo
#acl dominio_bloqueado dstdomain -i "/usr/local/squid/etc/block_dominio"
acl dominio_bloqueado url_regex -i "/usr/local/squid/etc/block_dominio"
acl dominio_liberado dstdomain -i "/usr/local/squid/etc/libera_dominio"
acl sex url_regex -i "/usr/local/squid/etc/
[*****]"
acl nosex url_regex -i "/usr/local/squid/etc/naoporno"
# ACLs_ACTIVE_DIRECTORY
acl AcessoRestrito external ldap_group AcessoRestrito # Grupo de acesso com restrições
acl AcessoPadrao external ldap_group AcessoPadrao # Acesso a internet padrão
acl AcessoTotal external ldap_group AcessoTotal # Acesso total a internet
acl AcessoDownload external ldap_group AcessoDownload # Libera download de arquivo com extensões bloqueadas.
# A ACL abaixo desbloqueia download para o grupo AcessoPadrao
acl download_url url_regex "/usr/local/squid/etc/libera_download-url"
#teste acl acesso restrito
acl bloqueados url_regex -i "/usr/local/squid/etc/bloqueados"
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny block_ip
http_access allow libera_restritos
http_access deny AcessoRestrito bloqueados
http_access allow AcessoRestrito
http_access allow AcessoTotal
http_access deny dst_msn
http_access allow dominio_liberado
#http_access allow libera_sites almoco
http_access deny dominio_bloqueado
http_access allow AcessoDownload block_arq
http_access allow AcessoDownload palavra_download
http_access allow download_url
http_access deny block_arq
http_access allow nosex
http_access deny sex
http_access allow AcessoPadrao
http_access allow manager localhost
http_access deny manager
http_access deny all
icp_access allow all
cache_effective_user nobody
cache_effective_group nogroup
visible_hostname proxy.integra.local
unique_hostname proxy.integra.local
append_domain .integra.local
acl local-servers dstdomain integra.local
acl local-serverspr dstdomain meusoutrosdominios.org.br
always_direct allow local-servers
always_direct allow local-serverspr
error_directory /usr/local/squid/share/errors/Portuguese
acl hotmail_domains dstdomain .hotmail.msn.com
header_access Accept-Encoding deny hotmail_domains
# As linhas abaixo evitam anunciar hosts e squid na Internet
header_access via deny all
header_access X-Forwarded-For deny all
