shutdown_lifetime 5 seconds # # Recommended minimum configuration: # auth_param basic program /usr/lib/squid/basic_db_auth --debug -dsn "DBI:mysql:host=192.168.220.135;port=3306;database=squidconf" --user SquidConfReader --password SquidConfReader --plaintext --persist --table users --usercol username --passwdcol password --cond y=1 auth_param basic children 5 auth_param basic realm Web-Proxy auth_param basic credentialsttl 1 minute auth_param basic casesensitive off acl blockpage_dom dstdomain www.ngtech.co.il acl db-auth proxy_auth REQUIRED ## Total blacklist external_acl_type total_block_checker concurrency=10 children-max=60 children-startup=20 children-idle=20 ttl=300 %SRC %DST %METHOD %un /usr/bin/socat - UNIX-CONNECT:/tmp/total-block acl total_block_checker_helper external total_block_checker deny_info 302:https://www.ngtech.co.il/blockPage/?url=%u total_block_checker_helper ## Campus Wide testing blacklist external_acl_type campus_testing_blacklist_checker concurrency=10 children-max=60 children-startup=20 children-idle=20 ttl=300 %SRC %DST %METHOD %un /usr/bin/socat - UNIX-CONNECT:/tmp/campus-testing-blacklist acl campus_testing_blacklist_checker_helper external campus_testing_blacklist_checker deny_info 302:https://www.ngtech.co.il/blockPage/?url=%u campus_testing_blacklist_checker_helper ## Campus Wide testing whitelist external_acl_type campus_testing_whitelist_checker concurrency=10 children-max=60 children-startup=20 children-idle=20 ttl=300 %SRC %DST %METHOD %un /usr/bin/socat - UNIX-CONNECT:/tmp/campus-testing-whitelist acl campus_testing_whitelist_checker_helper external campus_testing_whitelist_checker ## User blacklist external_acl_type user_blacklist_checker concurrency=10 children-max=60 children-startup=20 children-idle=20 ttl=300 %SRC %DST %METHOD %un /usr/bin/socat - UNIX-CONNECT:/tmp/users-blacklist acl user_blacklist_checker_helper external user_blacklist_checker deny_info 302:https://www.ngtech.co.il/blockPage/?url=%u user_blacklist_checker_helper ## User whitelist external_acl_type user_whitelist_checker concurrency=10 children-max=60 children-startup=20 children-idle=20 ttl=300 %SRC %DST %METHOD %un /usr/bin/socat - UNIX-CONNECT:/tmp/users-whitelist acl user_whitelist_checker_helper external user_whitelist_checker ## Campus Wide blacklist external_acl_type campus_blacklist_checker concurrency=10 children-max=60 children-startup=20 children-idle=20 ttl=300 %SRC %DST %METHOD %un /usr/bin/socat - UNIX-CONNECT:/tmp/campus-blacklist acl campus_blacklist_checker_helper external campus_blacklist_checker deny_info 302:https://www.ngtech.co.il/blockPage/?url=%u campus_blacklist_checker_helper ## Campus Wide whitelist external_acl_type campus_whitelist_checker concurrency=10 children-max=60 children-startup=20 children-idle=20 ttl=300 %SRC %DST %METHOD %un /usr/bin/socat - UNIX-CONNECT:/tmp/campus-whitelist acl campus_whitelist_checker_helper external campus_whitelist_checker # Example rule allowing access from your local networks. # Adapt to list your (internal) IP networks from where browsing # should be allowed acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN) acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN) acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN) acl localnet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN) acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN) acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http # # Recommended minimum Access Permission configuration: # # Deny requests to certain unsafe ports #http_access deny !localnet http_access allow blockpage_dom http_access deny !db-auth http_access deny !Safe_ports # Deny CONNECT to other than secure SSL ports http_access deny CONNECT !SSL_ports # Only allow cachemgr access from localhost http_access allow localhost manager http_access deny manager http_access deny to_localhost http_access deny to_linklocal # # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS # http_access deny total_block_checker_helper http_access deny campus_testing_blacklist_checker_helper http_access allow campus_testing_whitelist_checker_helper http_access deny user_blacklist_checker_helper http_access allow user_whitelist_checker_helper http_access deny campus_blacklist_checker_helper http_access allow campus_whitelist_checker_helper #http_access allow db-auth # For example, to allow access from your local networks, you may uncomment the # following rule (and/or add rules that match your definition of "local"): #http_access allow localnet http_access allow all # And finally deny all other access to this proxy http_access deny all # Squid normally listens to port 3128 http_port 3128 # Uncomment and adjust the following to add a disk cache directory. #cache_dir ufs /var/spool/squid 100 16 256 # Leave coredumps in the first cache dir coredump_dir /var/spool/squid # # Add any of your own refresh_pattern entries above these. # refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320