Squid não restringe alguns streams

1. Squid não restringe alguns streams

aioriaman
(usa BackTrack)

Enviado em 19/07/2017 - 16:31h

Boa tarde galera, depois de alguns anos, estou de volta. rs
Pessoal, meu problema é o seguinte, tenho um proxy squid3 rodando em Debian 8.3. Estou com dificuldades para bloquear stream de vídeo e áudio, fiz as regras para restringir o conteúdo e funciona em alguns sites (youtube por exemplo), mas não em outros (como o [*****]). Posto abaixo o conteúdo do meu squid.conf, do arquivo Mime_Type e das extensões bloqueadas.

Squid.conf

##> Enderecos e Portas

http_port 3128

http_port 3180 intercept

https_port 3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid3/certificado/ppt.pem



##> Adm

shutdown_lifetime 3 seconds

cache_mgr Administrador

cache_effective_user proxy

httpd_suppress_version_string on



##> Cache e Memoria

cache_mem 1024 MB

maximum_object_size_in_memory 10240 KB

memory_replacement_policy lru

cache_replacement_policy lru

maximum_object_size 100 MB

cache_dir ufs /var/spool/squid3 102400 16 256

coredump_dir /var/spool/squid3

store_dir_select_algorithm least-load

max_stale 1 week



##> Logs

access_log daemon:/var/log/squid3/access.log

logfile_daemon /usr/lib/squid3/log_file_daemon

cache_log /var/log/squid3/cache.log



##> Gerenciamento de pacotes

quick_abort_min 16 KB

quick_abort_max 16 KB

quick_abort_pct 95

negative_ttl 0 seconds

positive_dns_ttl 6 hours

negative_dns_ttl 1 minutes

client_request_buffer_max_size 512 KB



##> Performance

refresh_pattern ^gopher: 1440 0% 1440

refresh_pattern -i \.(gif|png|jpg|jpeg|ico)$ 10080 90% 43200 override-expire ignore-no-store ignore-private

refresh_pattern -i \.(iso|avi|wav|mp3|mp4|mpeg|swf|flv|x-flv)$ 43200 90% 432000 override-expire ignore-no-store ignore-private

refresh_pattern -i \.(deb|rpm|exe|zip|tar|tgz|ram|rar|bin|ppt|doc|tiff)$ 10080 90% 43200 override-expire ignore-no-store ignore-private

refresh_pattern -i \.index.(html|htm)$ 0 40% 10080

refresh_pattern -i \.(html|htm|css|js)$ 1440 40% 40320

refresh_pattern . 0 20% 4320



#Videos

refresh_pattern -i youtube.com/.* 10080 90% 43200

refresh_pattern (/cgi-bin/|\?) 0 0% 0



##> Diretivas para SSL

sslcrtd_program /usr/lib/squid3/ssl_crtd -s /etc/squid3/certificado/ssl_db -M 4MB

sslcrtd_children 32 startup=5 idle=1

sslcrtvalidator_children 32 startup=5 idle=1 concurrency=1

dead_peer_timeout 10 seconds

forward_max_tries 10



##> ACLs Iniciais

acl SSL_ports port 443

acl Safe_ports port 443 80

acl CONNECT method CONNECT



##> ACLs Personalizadas

acl localnet src 10.27.220.0/24

acl CPD src "/etc/squid3/list/IP_CPD"

acl SiteSeguroLiberado dstdomain "/etc/squid3/list/sitessl"

#acl SiteNaoSeguroLiberado dstdomain "/etc/squid3/list/sitehttp"

acl SiteBloqueado dstdomain "/etc/squid3/list/sitebloq"

acl PalavraBloqueada url_regex -i "/etc/squid3/list/palavras"

acl streaming rep_mime_type -i "/etc/squid3/list/blockmime"

acl streaming2 urlpath_regex -i "/etc/squid3/list/teste"

acl downloads urlpath_regex -i "/etc/squid3/list/downloads"



#acl Musica url_regex -i .mp3$ .wma$ .wav$ .ogg$ .mp4$

#acl Virus url_regex -i .inf$ .vbs$ .irc$ .src$ .bat$ .cmd$ .reg$ .exe$

#acl Video url_regex -i .avi$ .rmvb$ .flv$ .mpeg$ .3gp$ .4gp$ .3g2$ .mkv$



##> Acessos Iniciais

http_access deny !Safe_ports

http_access deny CONNECT !SSL_ports

http_access allow localhost manager

http_access deny manager



##> Acessos Personalizados



http_access allow localhost

#http_access allow SiteSeguroLiberado

#http_access allow SiteNaoSeguroLiberado

http_access allow CPD

http_access deny downloads

http_access deny SiteBloqueado

http_access deny PalavraBloqueada

http_reply_access deny streaming

http_access deny streaming2

http_access allow localnet

http_access deny all



##> Acessos SSL

sslproxy_flags DONT_VERIFY_PEER

sslproxy_cert_error deny !SiteSeguroLiberado

always_direct deny !SiteSeguroLiberado

ssl_bump none localhost

ssl_bump none SiteSeguroLiberado CPD

ssl_bump server-first all

Mime Type

application/vnd.audiograph

application/vnd.ms.wms-hdr.asfv1

application/x-fcs

application/x-mms-framed

audio/32kadpcm

audio/3gpp

audio/amr

audio/amr-wb

audio/annodex

audio/basic

audio/flac

audio/g.722.1

audio/l16

audio/mid

audio/midi

audio/mp4a-latm

audio/mpa-robust

audio/mpeg

audio/mpegurl

audio/ogg

audio/parityfec

audio/prs.sid

audio/telephone-event

audio/tone

audio/vnd.cisco.nse

audio/vnd.cns.anp1

audio/vnd.cns.inf1

audio/vnd.digital-winds

audio/vnd.everad.plj

audio/vnd.lucent.voice

audio/vnd.nortel.vbk

audio/vnd.nuera.ecelp4800

audio/vnd.nuera.ecelp7470

audio/vnd.nuera.ecelp9600

audio/vnd.octel.sbc

audio/vnd.qcelp

audio/vnd.rhetorex.32kadpcm

audio/vnd.vmx.cvsd

audio/x-aiff

audio/x-gsm

audio/x-mpegurl

audio/x-ms-wax

audio/x-ms-wma

audio/x-pn-realaudio

audio/x-pn-realaudio-plugin

audio/x-realaudio

audio/x-scpls

audio/x-sd2

audio/x-wav

application/x-videolan

video/3gpp

video/annodex

video/dl

video/dv

video/fli

video/flv

video/gl

video/mp4

video/mp4v-es

video/mpeg

video/ogg

video/parityfec

video/pointer

video/quicktime

video/vnd.fvt

video/vnd.motorola.video

video/vnd.motorola.videop

video/vnd.mpegurl

video/vnd.mts

video/vnd.nokia.interleaved-multimedia

video/vnd.vivo

video/x-flv

video/x-la-asf

video/x-matroska

video/x-mng

video/x-ms-asf

video/x-ms-asx

video/x-msvideo

video/x-ms-wm

video/x-ms-wmv

video/x-ms-wmx

video/x-ms-wvx

video/x-sgi-movie

application/octet-stream

application/x-shockwave-flash

Downloads

#Programas

\.exe($|\?|\&)

\.msi($|\?|\&)

\.bat($|\?|\&)

\.msu($|\?|\&)



#Imagens

\.pif($|\?|\&)

\.bin($|\?|\&)

\.cue($|\?|\&)

\.iso($|\?|\&)

\.jpg($|\?|\&)

\.jpeg($|\?|\&)

\.png($|\?|\&)

\.tif($|\?|\&)

\.gif($|\?|\&)



#Musicas e videos

\.mp3($|\?|\&)

\.mpg($|\?|\&)

\.wma($|\?|\&)

\.divx($|\?|\&)

\.scr($|\?|\&)

\.flv($|\?|\&)

\.mp4($|\?|\&)

\.avi($|\?|\&)

\.wmv($|\?|\&)

\.rmvb($|\?|\&)

\.mkv($|\?|\&)

\.mov($|\?|\&)





#Compactados

\.tar.gz($|\?|\&)

\.tgz($|\?|\&)

\.tar($|\?|\&)

\.tar.bz2($|\?|\&)

\.tbz($|\?|\&)

\.rar($|\?|\&)

\.zip($|\?|\&)

\.zip?($|\?|\&)

\.aac($|\?|\&)

\.ogg($|\?|\&)

\.deb($|\?|\&)

\.torrent($|\?|\&)