Merge branch 'fred' into 'master'
Fred See merge request fredbcode-images/squid!5
This commit is contained in:
Fred
commit
1fc6c8e7fd
@ -14,9 +14,16 @@ stages:
|
||||
- Docker-hub-build-arm
|
||||
- Docker-hub-test-arm
|
||||
- Docker-hub-pushtag-arm
|
||||
- test
|
||||
include:
|
||||
- template: Security/SAST.gitlab-ci.yml
|
||||
|
||||
include:
|
||||
- 'gitlabci/docker-hub.yml'
|
||||
- 'gitlabci/docker-hub-arm.yml'
|
||||
- template: Security/SAST-IaC.latest.gitlab-ci.yml
|
||||
|
||||
|
||||
|
||||
hadolint:
|
||||
image: hadolint/hadolint:latest-debian
|
||||
@ -25,3 +32,5 @@ hadolint:
|
||||
- cd $CI_PROJECT_DIR
|
||||
script:
|
||||
- hadolint --ignore DL3008 Dockerfile
|
||||
|
||||
|
||||
|
||||
19
Dockerfile
19
Dockerfile
@ -8,7 +8,6 @@ RUN echo "deb-src http://deb.debian.org/debian bullseye main contrib" >> /etc/ap
|
||||
&& ./configure \
|
||||
--prefix=/usr \
|
||||
--datadir=/usr/share/squid \
|
||||
--build=x86_64-linux-gnu \
|
||||
--enable-cache-digests \
|
||||
--includedir=/usr/include \
|
||||
--program-prefix= \
|
||||
@ -22,14 +21,13 @@ RUN echo "deb-src http://deb.debian.org/debian bullseye main contrib" >> /etc/ap
|
||||
--enable-icap-support \
|
||||
--enable-async-io \
|
||||
--with-pthreads \
|
||||
--with-winbind \
|
||||
--with-winbind \
|
||||
--bindir=/usr/sbin \
|
||||
--sbindir=/usr/sbin \
|
||||
--with-squid=/usr/lib/squid \
|
||||
--disable-ipv6 \
|
||||
--enable-ltdl-convenience \
|
||||
--enable-http-violations \
|
||||
build_alias="x86_64-linux-gnu" \
|
||||
CFLAGS="-g -O2 -g -Wall -O2" \
|
||||
LDFLAGS= \
|
||||
CPPFLAGS= \
|
||||
@ -46,13 +44,15 @@ RUN echo "deb-src http://deb.debian.org/debian bullseye main contrib" >> /etc/ap
|
||||
--enable-auth-digest="LDAP" \
|
||||
--enable-auth-ntlm \
|
||||
--enable-auth-negotiate \
|
||||
--enable-negotiate-auth-helpers \
|
||||
--with-krb5-config=yes \
|
||||
--enable-negotiate-auth-helpers \
|
||||
--with-krb5-config=yes \
|
||||
--enable-icap-client \
|
||||
--sysconfdir=/etc/squid \
|
||||
--with-filedescriptors=48000 \
|
||||
--enable-delay-pools \
|
||||
--with-large-files \
|
||||
--with-pidfile=/squid/squid.pid \
|
||||
--with-default-user=squid \
|
||||
--enable-removal-policies="lru,heap" \
|
||||
&& make \
|
||||
&& find /tmp/ -type f -name "Makefil*" -delete \
|
||||
@ -99,12 +99,13 @@ RUN adduser --no-create-home --uid 1161 --group --system squid \
|
||||
&& echo "cache_log /var/log/squid/cache.log" >> /etc/squid/squid.conf \
|
||||
&& echo "cache_effective_user squid" >> /etc/squid/squid.conf \
|
||||
# Packages dependencies installation for running and clean again
|
||||
&& apt-get update && apt-get install -y --no-install-recommends ca-certificates net-tools rsync libexpat1 libltdl7 libxml2 openssl ca-certificates libldap-2.4-2 libecap3 libcap2 libdb5.3 libatomic1 dumb-init \
|
||||
&& apt-get update && apt-get install -y --no-install-recommends ca-certificates net-tools rsync libexpat1 libltdl7 libxml2 openssl ca-certificates libldap-2.4-2 libecap3 libcap2 libdb5.3 libatomic1 dumb-init procps inotify-tools \
|
||||
&& apt-get auto-remove -y && apt-get clean autoclean \
|
||||
&& rm -rf /var/lib/apt/lists/* && rm -Rf /tmp/*
|
||||
COPY run.sh /
|
||||
RUN chmod +x /run.sh
|
||||
COPY --chown=1161 squid /squid
|
||||
RUN chmod +x /squid/run.sh /squid/autoreload.sh /squid/sup.sh
|
||||
HEALTHCHECK CMD squidclient mgr:info | grep "HTTP/1.1 200 OK" || exit 1
|
||||
EXPOSE 3128
|
||||
ENTRYPOINT ["dumb-init"]
|
||||
CMD ["bash", "-c", "/run.sh && squid -N -n $HOSTNAME"]
|
||||
USER squid
|
||||
CMD ["bash", "-c", "/squid/run.sh && squid -N -n $HOSTNAME"]
|
||||
|
||||
77
README.md
77
README.md
@ -2,9 +2,84 @@ Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It r
|
||||
|
||||
http://www.squid-cache.org/
|
||||
|
||||
https://gitlab.com/fredbcode-images/squid
|
||||
|
||||
**fredbcode:**
|
||||
|
||||
- https://gitlab.com/fredbcode
|
||||
- https://github.com/fredbcode
|
||||
|
||||
**E2guardian Docker:**
|
||||
|
||||
https://hub.docker.com/r/fredbcode/e2guardian
|
||||
|
||||
**Quick start**
|
||||
|
||||
```
|
||||
docker run --init -d --name="squid" \
|
||||
-v /path/to/yourconfig:/etc/squid \
|
||||
-v /path/to/yourlog:/var/log/squid \
|
||||
-p 3128:3128 \
|
||||
--restart=unless-stopped \
|
||||
fredbcode/squid
|
||||
```
|
||||
Or with docker-compose
|
||||
|
||||
```
|
||||
docker-compose up --scale squid=4 -d
|
||||
```
|
||||
|
||||
**tags**
|
||||
|
||||
- x.x -> latest stable version:**PROD**
|
||||
- build-noprod -> latest build version (for testing purpose only)
|
||||
|
||||
**Ports:**
|
||||
|
||||
- 3128 proxy standalone
|
||||
|
||||
**UID/GUID:**
|
||||
|
||||
For security purpose image runs as a non-root user
|
||||
|
||||
- 1161
|
||||
|
||||
**Persistence**
|
||||
|
||||
For the cache to preserve its state should mount a volume /var/spool/squid as volume
|
||||
|
||||
**Optionals environment variables**
|
||||
|
||||
_If all hosts are down, squid stop_
|
||||
|
||||
- supgethosts=https://www.google.com https://www.facebook.com https://www.orange.fr https://www.free.fr
|
||||
|
||||
_If ICAP server is down, squid stop_
|
||||
|
||||
- supicaphost=e2guardian
|
||||
- supicapport=1344
|
||||
|
||||
_If a file is changed/deleted/created squid reload_
|
||||
|
||||
- autoreload=/etc/squid
|
||||
|
||||
**Docker-compose**
|
||||
|
||||
https://gitlab.com/fredbcode/docker-compose
|
||||
|
||||
**Supported architectures:**
|
||||
|
||||
- amd64, armv8
|
||||
|
||||
**Where to file issues:**
|
||||
|
||||
https://gitlab.com/fredbcode-images/squid
|
||||
|
||||
http://www.squid-cache.org/
|
||||
|
||||
Docker images for Squid, latest official version
|
||||
|
||||
Arm Raspberry and X86
|
||||
|
||||
https://hub.docker.com/repository/docker/fredbcode/squid/general
|
||||
https://hub.docker.com/r/fredbcode/squid
|
||||
|
||||
|
||||
62
docker-compose/docker-compose.yml
Normal file
62
docker-compose/docker-compose.yml
Normal file
@ -0,0 +1,62 @@
|
||||
version: "3.3"
|
||||
services:
|
||||
squid:
|
||||
image: fredbcode/squid:latest
|
||||
ports:
|
||||
- 3128-3150:3128
|
||||
environment:
|
||||
- TZ=Europe/Paris
|
||||
# Sup
|
||||
- supgethosts=https://www.google.com https://www.facebook.com https://www.orange.fr https://www.free.fr
|
||||
- supicaphost=e2guardian
|
||||
- supicapport=1344
|
||||
- autoreload=/etc/squid
|
||||
volumes:
|
||||
- ./squid:/etc/squid:ro
|
||||
logging:
|
||||
options:
|
||||
max-size: "100m"
|
||||
max-file: "3"
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- cache:/var/spool/squid
|
||||
labels:
|
||||
# purge memory
|
||||
deck-chores.squidrestart.command: sh -c 'squid -k shutdown'
|
||||
deck-chores.squidrestart.cron: "* * * * * 00 00 00"
|
||||
networks:
|
||||
- webfilter
|
||||
|
||||
e2guardian:
|
||||
image: fredbcode/e2guardian:v5.4
|
||||
environment:
|
||||
- TZ=Europe/Paris
|
||||
healthcheck:
|
||||
disable: true
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- ./e2guardian/:/etc/e2guardian:ro
|
||||
labels:
|
||||
# purge memory
|
||||
deck-chores.e2guardianrestart.command: sh -c '/usr/sbin/e2guardian -q'
|
||||
deck-chores.e2guardianrestart.cron: "* * * * * 00 00 00"
|
||||
networks:
|
||||
- webfilter
|
||||
|
||||
deckchores:
|
||||
image: funkyfuture/deck-chores:1.1.3
|
||||
environment:
|
||||
- TZ=Europe/Paris
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
restart: unless-stopped
|
||||
logging:
|
||||
options:
|
||||
max-size: "100m"
|
||||
max-file: "3"
|
||||
|
||||
networks:
|
||||
webfilter:
|
||||
|
||||
volumes:
|
||||
cache:
|
||||
19
docker-compose/e2guardian/authplugins/dnsauth.conf
Normal file
19
docker-compose/e2guardian/authplugins/dnsauth.conf
Normal file
@ -0,0 +1,19 @@
|
||||
# IP/DNS-based auth plugin
|
||||
#
|
||||
# Obtains user and group from domain entry maintained by separate authentication# program.
|
||||
|
||||
plugname = 'dnsauth'
|
||||
|
||||
# Base DNS domain
|
||||
#basedomain = "my.privatedomain"
|
||||
|
||||
# Authentication URL
|
||||
#authurl = "http://192.168.1.3/auth/login/login.pl?url"
|
||||
|
||||
# Prefix for auth URLs
|
||||
#prefix_auth = "http://192.168.1.3/auth/"
|
||||
|
||||
# Redirect to auth (i.e. log-in)
|
||||
# yes - redirects to authurl to login
|
||||
# no - drops through to next auth plugin
|
||||
redirect_to_auth = "yes"
|
||||
23
docker-compose/e2guardian/authplugins/ident.conf
Executable file
23
docker-compose/e2guardian/authplugins/ident.conf
Executable file
@ -0,0 +1,23 @@
|
||||
# Ident auth plugin
|
||||
# Identifies users via IDENT servers running on client machines
|
||||
|
||||
plugname = 'ident'
|
||||
|
||||
story_function = 'auth_ident'
|
||||
# This defines the storybaord function in pre-auth.story
|
||||
# which determines the filter group used.
|
||||
|
||||
# Default group settings for this plug-in
|
||||
# If these are set group determination will always succeed
|
||||
# and auth plug-in scan will stop
|
||||
# even if the user is not found in group list(s)
|
||||
|
||||
# These settings override the global defaultfiltergroup and
|
||||
# defaulttransparentfiltergroup settings for this plug-in only.
|
||||
|
||||
#defaultfiltergroup = 1
|
||||
# This applies to explict proxy and icap requests
|
||||
|
||||
#defaulttransparentfiltergroup = 2
|
||||
# This appies to transparent requests (http & https)
|
||||
# Note if not defined does NOT default to defaultfiltergroup
|
||||
29
docker-compose/e2guardian/authplugins/ip.conf
Normal file
29
docker-compose/e2guardian/authplugins/ip.conf
Normal file
@ -0,0 +1,29 @@
|
||||
# IP-based auth plugin
|
||||
#
|
||||
# Maps client IPs to filter groups.
|
||||
# If "usexforwardedfor" is enabled, grabs the IP from the X-Forwarded-For
|
||||
# header, if available.
|
||||
|
||||
plugname = 'ip'
|
||||
|
||||
# ipgroups file - is defined in e2guardian.conf from v5.4
|
||||
# List file assigning IP addresses, subnets and ranges to filter groups
|
||||
|
||||
story_function = 'auth_ip'
|
||||
# This defines the storybaord function in pre-auth.story
|
||||
# which determines the filter group used.
|
||||
|
||||
# Default group settings for this plug-in
|
||||
# If these are set group determination will always succeed
|
||||
# and auth plug-in scan will stop
|
||||
# even if the user is not found in group list(s)
|
||||
|
||||
# These settings override the global defaultfiltergroup and
|
||||
# defaulttransparentfiltergroup settings for this plug-in only.
|
||||
|
||||
#defaultfiltergroup = 1
|
||||
# This applies to explict proxy and icap requests
|
||||
|
||||
#defaulttransparentfiltergroup = 2
|
||||
# This appies to transparent requests (http & https)
|
||||
# Note if not defined does NOT default to defaultfiltergroup
|
||||
24
docker-compose/e2guardian/authplugins/pf-basic.conf
Executable file
24
docker-compose/e2guardian/authplugins/pf-basic.conf
Executable file
@ -0,0 +1,24 @@
|
||||
# Proxy-Basic auth plugin
|
||||
# Identifies usernames in "Proxy-Authorization: Basic" headers;
|
||||
# relies upon the upstream proxy (squid) to perform the actual password check.
|
||||
|
||||
plugname = 'pf-basic'
|
||||
|
||||
story_function = 'auth_pf_basic'
|
||||
# This defines the storybaord function in pre-auth.story
|
||||
# which determines the filter group used.
|
||||
|
||||
# Default group settings for this plug-in
|
||||
# If these are set group determination will always succeed
|
||||
# and auth plug-in scan will stop
|
||||
# even if the user is not found in group list(s)
|
||||
|
||||
# These settings override the global defaultfiltergroup and
|
||||
# defaulttransparentfiltergroup settings for this plug-in only.
|
||||
|
||||
#defaultfiltergroup = 1
|
||||
# This applies to explict proxy requests
|
||||
|
||||
#defaulttransparentfiltergroup = 2
|
||||
# This appies to transparent requests (http & https)
|
||||
# Note if not defined does NOT default to defaultfiltergroup
|
||||
24
docker-compose/e2guardian/authplugins/port.conf
Normal file
24
docker-compose/e2guardian/authplugins/port.conf
Normal file
@ -0,0 +1,24 @@
|
||||
# IP-Port-based auth plugin
|
||||
#
|
||||
# Maps IP Ports to filter groups.
|
||||
|
||||
plugname = 'port'
|
||||
|
||||
story_function = auth_port
|
||||
# This defines the storybaord function in pre-auth.story
|
||||
# which determines the filter group used.
|
||||
|
||||
# Default group settings for this plug-in
|
||||
# If these are set group determination will always succeed
|
||||
# and auth plug-in scan will stop
|
||||
# even if the user is not found in group list(s)
|
||||
|
||||
# These settings override the global defaultfiltergroup and
|
||||
# defaulttransparentfiltergroup settings for this plug-in only.
|
||||
|
||||
#defaultfiltergroup = 1
|
||||
# This applies to explict proxy and icap requests
|
||||
|
||||
#defaulttransparentfiltergroup = 2
|
||||
# This appies to transparent requests (http & https)
|
||||
# Note if not defined does NOT default to defaultfiltergroup
|
||||
24
docker-compose/e2guardian/authplugins/proxy-basic.conf
Executable file
24
docker-compose/e2guardian/authplugins/proxy-basic.conf
Executable file
@ -0,0 +1,24 @@
|
||||
# Proxy-Basic auth plugin
|
||||
# Identifies usernames in "Proxy-Authorization: Basic" headers;
|
||||
# relies upon the upstream proxy (squid) to perform the actual password check.
|
||||
|
||||
plugname = 'proxy-basic'
|
||||
|
||||
story_function = 'auth_proxy_basic'
|
||||
# This defines the storybaord function in pre-auth.story
|
||||
# which determines the filter group used.
|
||||
|
||||
# Default group settings for this plug-in
|
||||
# If these are set group determination will always succeed
|
||||
# and auth plug-in scan will stop
|
||||
# even if the user is not found in group list(s)
|
||||
|
||||
# These settings override the global defaultfiltergroup and
|
||||
# defaulttransparentfiltergroup settings for this plug-in only.
|
||||
|
||||
#defaultfiltergroup = 1
|
||||
# This applies to explict proxy and icap requests
|
||||
|
||||
#defaulttransparentfiltergroup = 2
|
||||
# This appies to transparent requests (http & https)
|
||||
# Note if not defined does NOT default to defaultfiltergroup
|
||||
26
docker-compose/e2guardian/authplugins/proxy-digest.conf
Executable file
26
docker-compose/e2guardian/authplugins/proxy-digest.conf
Executable file
@ -0,0 +1,26 @@
|
||||
# Proxy-Digest auth plugin
|
||||
# Identifies usernames in "Proxy-Authorization: Digest" headers;
|
||||
# relies upon the upstream proxy (squid) to perform the actual password check.
|
||||
|
||||
# Contributed by Darryl Sutherland <darryl@weblink.co.za>
|
||||
|
||||
plugname = 'proxy-digest'
|
||||
|
||||
story_function = auth_proxy_digest
|
||||
# This defines the storybaord function in pre-auth.story
|
||||
# which determines the filter group used.
|
||||
|
||||
# Default group settings for this plug-in
|
||||
# If these are set group determination will always succeed
|
||||
# and auth plug-in scan will stop
|
||||
# even if the user is not found in group list(s)
|
||||
|
||||
# These settings override the global defaultfiltergroup and
|
||||
# defaulttransparentfiltergroup settings for this plug-in only.
|
||||
|
||||
#defaultfiltergroup = 1
|
||||
# This applies to explict proxy and icap requests
|
||||
|
||||
#defaulttransparentfiltergroup = 2
|
||||
# This appies to transparent requests (http & https)
|
||||
# Note if not defined does NOT default to defaultfiltergroup
|
||||
34
docker-compose/e2guardian/authplugins/proxy-header.conf
Normal file
34
docker-compose/e2guardian/authplugins/proxy-header.conf
Normal file
@ -0,0 +1,34 @@
|
||||
# Proxy-header auth plugin
|
||||
# FredB August 2016
|
||||
# Identifies users with header;
|
||||
# relies upon the upstream proxy.
|
||||
# Eg: in groups file
|
||||
# Mozilla/5.0 (Windows NT 6.1; rv:47.0) Gecko/20100101 Firefox/47.0=filter3
|
||||
# here:
|
||||
# header = 'user-agent'
|
||||
# Firefox 47 + windows is added to group3 without any kind of authentification (! not related with your proxy configuration/identification !)
|
||||
# THIS IS REALLY INSECURE This can be easily compromised by spoofing the Origin header
|
||||
|
||||
# low case
|
||||
header = ''
|
||||
|
||||
plugname = 'proxy-header'
|
||||
|
||||
story_function = auth_proxy_header
|
||||
# This defines the storybaord function in pre-auth.story
|
||||
# which determines the filter group used.
|
||||
|
||||
# Default group settings for this plug-in
|
||||
# If these are set group determination will always succeed
|
||||
# and auth plug-in scan will stop
|
||||
# even if the user is not found in group list(s)
|
||||
|
||||
# These settings override the global defaultfiltergroup and
|
||||
# defaulttransparentfiltergroup settings for this plug-in only.
|
||||
|
||||
#defaultfiltergroup = 1
|
||||
# This applies to explict proxy and icap requests
|
||||
|
||||
#defaulttransparentfiltergroup = 2
|
||||
# This appies to transparent requests (http & https)
|
||||
# Note if not defined does NOT default to defaultfiltergroup
|
||||
24
docker-compose/e2guardian/authplugins/proxy-ntlm.conf
Executable file
24
docker-compose/e2guardian/authplugins/proxy-ntlm.conf
Executable file
@ -0,0 +1,24 @@
|
||||
# Proxy-NTLM auth plugin
|
||||
# Identifies usernames in "Proxy-Authorization: NTLM" headers;
|
||||
# relies on the upstream proxy (squid) to perform the actual password check.
|
||||
|
||||
plugname = 'proxy-ntlm'
|
||||
|
||||
story_function = auth_proxy_ntlm
|
||||
# This defines the storybaord function in pre-auth.story
|
||||
# which determines the filter group used.
|
||||
|
||||
# Default group settings for this plug-in
|
||||
# If these are set group determination will always succeed
|
||||
# and auth plug-in scan will stop
|
||||
# even if the user is not found in group list(s)
|
||||
|
||||
# These settings override the global defaultfiltergroup and
|
||||
# defaulttransparentfiltergroup settings for this plug-in only.
|
||||
|
||||
#defaultfiltergroup = 1
|
||||
# This applies to explict proxy and icap requests
|
||||
|
||||
#defaulttransparentfiltergroup = 2
|
||||
# This appies to transparent requests (http & https)
|
||||
# Note if not defined does NOT default to defaultfiltergroup
|
||||
331
docker-compose/e2guardian/common.story
Normal file
331
docker-compose/e2guardian/common.story
Normal file
@ -0,0 +1,331 @@
|
||||
# Storyboard library file
|
||||
|
||||
# For ease of upgrade DO NOT CHANGE THIS library file
|
||||
# Make your function changes by using user 'hook' functions
|
||||
# or by overriding functions
|
||||
# in the site.story file - for site wide changes.
|
||||
#
|
||||
# and in filtergroup specific story file - see examplef1.story
|
||||
#
|
||||
# This library is built to largely duplicate the logic in V4
|
||||
#
|
||||
# Many e2guardian[f1].conf flags are replaced by overiding
|
||||
# library functions - see site.story and examplef1.story
|
||||
#
|
||||
# Simple functions are defined which control the logic flow and the
|
||||
# lists that are used. See notes/Storyboard for details.
|
||||
#
|
||||
# The entry point in v5 for standard filtering is 'checkrequest'
|
||||
#
|
||||
|
||||
# Entry function called by standard proxy module to check http,
|
||||
# https proxy and transparent http requests
|
||||
# It is also called within a MITM session
|
||||
function(checkrequest)
|
||||
if(true) returnif hook_checkrequest
|
||||
if(viruscheckset) checknoscanlists
|
||||
if(bypassallowset) checknobypasslists
|
||||
if(exceptionset) return true
|
||||
#if(fullurlin,searchterms) setsearchterm
|
||||
if(true) is_search_term
|
||||
ifnot(greyset) returnif localcheckrequest
|
||||
if(connect) return sslrequestcheck
|
||||
ifnot(greyset) returnif exceptioncheck
|
||||
ifnot(greyset) greycheck
|
||||
ifnot(greyset) returnif bannedcheck
|
||||
if(fullurlin, change) setmodurl
|
||||
if(true) returnif embeddedcheck
|
||||
if(headerin,headermods) setmodheader
|
||||
if(fullurlin, addheader) setaddheader
|
||||
if(searchin,override) setexception
|
||||
if(returnset) return setdone
|
||||
if(searchin,banned) return setblock
|
||||
if(fullurlin,redirect) return setredirect
|
||||
if(true) setgrey
|
||||
|
||||
|
||||
# Entry function called by proxy module to check http response
|
||||
# It is also called within a MITM session
|
||||
function(checkresponse)
|
||||
if(true) returnif hook_checkresponse
|
||||
if(exceptionset) return false
|
||||
if(responseheaderin,reponseheadermods) setmodheader
|
||||
if(viruscheckset) checknoscantypes
|
||||
if(urlin,exceptionfile) return false
|
||||
if(true) return checkfiletype
|
||||
|
||||
# Entry function called by THTTPS module to check https request
|
||||
function(thttps-checkrequest)
|
||||
if(true) returnif hook_thttps-checkrequest
|
||||
if(true) thttps_automitm
|
||||
if(true) returnif checktimesblocked
|
||||
if(true) returnif localsslrequestcheck
|
||||
if(true) returnif sslrequestcheck
|
||||
ifnot(hassniset) checksni
|
||||
|
||||
# Entry function called by ICAP module to check reqmod
|
||||
function(icap-checkrequest)
|
||||
if(true) returnif hook_icap-checkrequest
|
||||
#unless blocked or redirect or connect - leave logging for RESPMOD
|
||||
if(connect) return icapsslrequestcheck
|
||||
ifnot(greyset) icap-checkrequest2
|
||||
if(redirectset) return true
|
||||
ifnot(blockset) setnolog
|
||||
|
||||
function(icap-checkrequest2)
|
||||
if(viruscheckset) checknoscanlists
|
||||
if(bypassallowset) checknobypasslists
|
||||
if(exceptionset) return true
|
||||
#if(fullurlin,searchterms) setsearchterm
|
||||
if(true) is_search_term
|
||||
ifnot(greyset) returnif localcheckrequest
|
||||
ifnot(greyset) returnif exceptioncheck
|
||||
ifnot(greyset) greycheck
|
||||
ifnot(greyset) returnif bannedcheck
|
||||
if(fullurlin, change) setmodurl
|
||||
if(true) returnif embeddedcheck
|
||||
if(headerin,headermods) setmodheader
|
||||
if(fullurlin, addheader) setaddheader
|
||||
if(searchin,override) return setgrey
|
||||
if(searchin,banned) return setblock
|
||||
if(true) setgrey
|
||||
|
||||
# Entry function called by ICAP module to check respmod
|
||||
function(icap-checkresponse)
|
||||
if(true) returnif hook_icap-checkresponse
|
||||
if(viruscheckset) checknoscanlists
|
||||
if(true) return checkresponse
|
||||
|
||||
# Checks embeded urls
|
||||
# returns true if blocked, otherwise false
|
||||
function(embeddedcheck)
|
||||
if(embeddedin, localexception) return false
|
||||
if(embeddedin, localgrey) return false
|
||||
if(embeddedin, localbanned) return setblock
|
||||
if(embeddedin, exception) return false
|
||||
if(embeddedin, grey) return false
|
||||
if(embeddedin, banned) return setblock
|
||||
|
||||
# Local checks
|
||||
# returns true if matches local exception or banned
|
||||
function(localcheckrequest)
|
||||
if(true) returnif hook_localcheckrequest
|
||||
if(connect) return localsslrequestcheck
|
||||
if(true) checktimesblocked
|
||||
if(returnset) return setblock
|
||||
ifnot(greyset) returnif localexceptioncheck
|
||||
ifnot(greyset) localgreycheck
|
||||
ifnot(greyset) returnif localbannedcheck
|
||||
if(searchin,localbanned) return setblock
|
||||
|
||||
|
||||
# Local SSL checks
|
||||
# returns true if matches local exception
|
||||
function(localsslrequestcheck)
|
||||
if(true) returnif hook_localsslrequestcheck
|
||||
if(true) returnif sslchecktimesblocked
|
||||
if(sitein, localexception) return setexception
|
||||
if(sitein, localgreyssl) returnif sslcheckmitm
|
||||
if(sitein, localbanned) true
|
||||
ifnot(returnset) return false
|
||||
if(true) returnif sslcheckmitm
|
||||
if(true) return setblock
|
||||
|
||||
# SSL site replace (used instead of dns kulge)
|
||||
# returns true on match and successful replacement
|
||||
function(sslreplace)
|
||||
if(fullurlin,sslreplace) return setconnectsite
|
||||
if(true) return false
|
||||
|
||||
function(sslchecktimesblocked)
|
||||
if(true) checktimesblocked
|
||||
ifnot(returnset) return false
|
||||
if(true) returnif sslcheckmitm
|
||||
if(true) return setblock
|
||||
|
||||
# Local grey check
|
||||
# returns true on match
|
||||
function(localgreycheck)
|
||||
if(urlin, localgrey) return setgrey
|
||||
|
||||
# Local banned check
|
||||
# returns true on match
|
||||
function(localbannedcheck)
|
||||
if(urlin, localbanned) return setblock
|
||||
|
||||
# Local exception check
|
||||
# returns true on match
|
||||
function(localexceptioncheck)
|
||||
if(urlin, localexception) return setexception
|
||||
|
||||
# Exception check
|
||||
# returns true on match
|
||||
function(exceptioncheck)
|
||||
if(urlin, exception) return setexception
|
||||
if(refererin,refererexception) return setexception
|
||||
if(headerin, exceptionheader) return setexception
|
||||
if(useragentin, exceptionuseragent) return setexception
|
||||
ifnot(urlin,embededreferer) return false
|
||||
if(embeddedin,refererexception) return setexception
|
||||
|
||||
# SSL Exception check
|
||||
# returns true on match
|
||||
function(sslexceptioncheck)
|
||||
if(sitein, exception) return setexception
|
||||
if(headerin, exceptionheader) return setexception
|
||||
if(useragentin, exceptionuseragent) return setexception
|
||||
if(true) return false
|
||||
|
||||
# Greylist check
|
||||
# returns true on match
|
||||
function(greycheck)
|
||||
if(urlin, grey) return setgrey
|
||||
|
||||
# Banned list check
|
||||
# returns true on match
|
||||
function(bannedcheck)
|
||||
if(true) returnif checkblanketblock
|
||||
if(urlin, banned) return setblock
|
||||
ifnot(urlin,exceptionfile) returnif checkurlextension
|
||||
if(useragentin, banneduseragent) return setblock
|
||||
if(headerin, bannedheader) return setblock
|
||||
|
||||
# Checks url for banned extensions
|
||||
# returns true on match
|
||||
function(checkurlextension)
|
||||
if(urlin,bannedextension) return setblock
|
||||
|
||||
# Local SSL list(s) check
|
||||
# returns true on match
|
||||
function(localsslcheckrequest)
|
||||
if(true) returnif hook_localsslcheckrequest
|
||||
if(sitein, localexception) return setexception
|
||||
#if(sitein, localbanned) return setblock
|
||||
|
||||
# Check whether to go MITM
|
||||
# returns true if yes, false if no
|
||||
function(sslcheckmitm)
|
||||
# use next line to have general MITM
|
||||
if(true) return sslcheckmitmgeneral
|
||||
# use next line instead of last to limit MITM to greylist
|
||||
#if(true) return sslcheckmitmgreyonly
|
||||
|
||||
# Always go MITM
|
||||
# returns true if yes, false if no
|
||||
function(sslcheckmitmgeneral)
|
||||
if(true) setgomitm
|
||||
ifnot(returnset) return false
|
||||
if(sitein, nocheckcert) setnocheckcert
|
||||
if(true) sslreplace
|
||||
if(true) return true
|
||||
|
||||
# Only go MITM when in greyssl list
|
||||
# returns true if yes, false if no
|
||||
function(sslcheckmitmgreyonly)
|
||||
if(sitein, greyssl) setgomitm
|
||||
ifnot(returnset) return false
|
||||
if(sitein, nocheckcert) setnocheckcert
|
||||
if(true) sslreplace
|
||||
if(true) return true
|
||||
|
||||
# SSL request check
|
||||
# returns true if exception or gomitm
|
||||
function(sslrequestcheck)
|
||||
if(true) returnif hook_sslrequestcheck
|
||||
if(true) returnif sslexceptioncheck
|
||||
if(true) returnif sslcheckmitm
|
||||
if(sitein, banned) return setblock
|
||||
if(true) sslreplace
|
||||
ifnot(returnset) returnif sslcheckblanketblock
|
||||
if(true) setgrey
|
||||
|
||||
function(checknoscanlists)
|
||||
if(urlin,exceptionvirus) unsetviruscheck
|
||||
|
||||
function(checknoscantypes)
|
||||
if(mimein,exceptionvirus) return unsetviruscheck
|
||||
if(extensionin,exceptionvirus) return unsetviruscheck
|
||||
|
||||
function(checknobypasslists)
|
||||
if(urlin,bannedbypass) return unsetbypassallow
|
||||
|
||||
# ICAP SSL request check
|
||||
# returns true if exception
|
||||
function(icapsslrequestcheck)
|
||||
if(true) returnif hook_icapsslrequestcheck
|
||||
if(true) returnif icapsquidbump
|
||||
if(true) returnif sslexceptioncheck
|
||||
# Squid ignores sslreplace and throws error so comment out for now
|
||||
#t configif(true) sslreplace
|
||||
if(sitein, banned) return setblock
|
||||
|
||||
# Blanket block
|
||||
# returns true if to block
|
||||
# Placeholder function - overide in fn.story
|
||||
function(checkblanketblock)
|
||||
|
||||
# SSL Blanket block
|
||||
# returns true if to block
|
||||
# Placeholder function - overide in fn.story
|
||||
function(sslcheckblanketblock)
|
||||
|
||||
# ICAP Squid bump
|
||||
# override in site.story to return true if bump is being deployed on squid
|
||||
function(icapsquidbump)
|
||||
|
||||
# File type blocking
|
||||
# returns true if blocking
|
||||
# Default uses banned lists and allows all others
|
||||
# Overide in site.story or fn.story if only types in exception file type lists
|
||||
# are to be allowed
|
||||
function(checkfiletype)
|
||||
if(mimein, bannedmime) return setblock
|
||||
if(extensionin, bannedextension) return setblock
|
||||
|
||||
# SNI checking - determines default action when no SNI or TSL is present on a
|
||||
# THTTPS connection
|
||||
# Default blocks all requests with TLS or SNI absent that are not ip site exceptions
|
||||
function(checksni)
|
||||
ifnot(tls,,511) return setblock
|
||||
ifnot(hassniset,,512) return setblock
|
||||
|
||||
# automitm on transparent https
|
||||
# default enables on transparent https - to allow block/status pages to browsers
|
||||
# override this is fn.story if this causes problems with apps
|
||||
function(thttps_automitm)
|
||||
if(true) setautomitm
|
||||
|
||||
# Timed global block
|
||||
# returns true if to block
|
||||
# Placeholder function - overide in fn.story
|
||||
function(checktimesblocked)
|
||||
|
||||
# Entry function to check if to log
|
||||
# returns true if log entry is to be made
|
||||
# This can be overriden in site.story (or fn.story) to log all for testing.
|
||||
function(checklogging)
|
||||
if(urlin,nolog) setnolog
|
||||
if(returnset) return false
|
||||
if(true) return true
|
||||
|
||||
function(is_search_term)
|
||||
if(urlin,searchtermexceptions) return false
|
||||
if(fullurlin,searchterms) setsearchterm
|
||||
if(returnset) return true
|
||||
|
||||
# Placeholder functions for user hooks
|
||||
# Allow user code to be actioned at the start of key functions
|
||||
# If hook function returns false (default) processing continues
|
||||
# in parent function
|
||||
# if hook function returns true parent function exits with true
|
||||
#
|
||||
function(hook_checkrequest)
|
||||
function(hook_checkresponse)
|
||||
function(hook_thttps-checkrequest)
|
||||
function(hook_icap-checkrequest)
|
||||
function(hook_icap-checkresponse)
|
||||
function(hook_localcheckrequest)
|
||||
function(hook_localsslrequestcheck)
|
||||
function(hook_localsslcheckrequest)
|
||||
function(hook_sslrequestcheck)
|
||||
function(hook_icapsslrequestcheck)
|
||||
12
docker-compose/e2guardian/contentscanners/avastdscan.conf
Normal file
12
docker-compose/e2guardian/contentscanners/avastdscan.conf
Normal file
@ -0,0 +1,12 @@
|
||||
plugname = 'avastdscan'
|
||||
|
||||
# edit this to match the location of your AvastD UNIX domain socket
|
||||
#avastdudsfile = '/var/run/avast4/local.sock'
|
||||
|
||||
# edit this to block unscannable files (e.g. encrypted archives)
|
||||
#archivewarn = off
|
||||
|
||||
#Specify the version of avast protocol. It Must be 'avast4' or 'avast2014'
|
||||
#default is avast4 for compatibility
|
||||
avastprotocol = 'avast4'
|
||||
|
||||
13
docker-compose/e2guardian/contentscanners/clamdscan.conf
Normal file
13
docker-compose/e2guardian/contentscanners/clamdscan.conf
Normal file
@ -0,0 +1,13 @@
|
||||
plugname = 'clamdscan'
|
||||
|
||||
# edit this to match the location of your ClamD UNIX domain socket
|
||||
#clamdudsfile = '/var/run/clamav/clamd.sock'
|
||||
|
||||
# If this string is set, the text it contains shall be removed from the
|
||||
# beginning of filenames when passing them to ClamD.
|
||||
# Use it to - for example - support a ClamD running inside a chroot jail:
|
||||
# if DG's filecachedir is set to "/var/clamdchroot/downloads/" and pathprefix
|
||||
# is set to "/var/clamdchroot", then file names given to ClamD will be of the
|
||||
# form "/downloads/tf*" instead of "/var/clamdchroot/downloads/tf*".
|
||||
#pathprefix = '/var/clamdchroot'
|
||||
|
||||
@ -0,0 +1,45 @@
|
||||
plugname = 'commandlinescan'
|
||||
|
||||
# Program to run & initial arguments - filename for scanning will be appended
|
||||
#progname = /path/to/scanner
|
||||
|
||||
# At least one of the following three options must be defined!
|
||||
# They are checked in the following order, with the first match determining
|
||||
# the scan result:
|
||||
# virusregexp - regular expression for extracting virus names from
|
||||
# the scanner's output
|
||||
# cleancodes - program return code(s), as a comma-separated list, for
|
||||
# uninfected files
|
||||
# infectedcodes - program return code(s), as a comma-separated list, for
|
||||
# infected files
|
||||
|
||||
#virusregexp = (someregexp)
|
||||
|
||||
# Which submatch of the above contains the virus name? (0 = all matched text)
|
||||
#submatch = 1
|
||||
|
||||
# cleancodes = 0
|
||||
# infectedcodes = 1,2,3
|
||||
|
||||
# Default result when none of the other options triggers a match
|
||||
# Valid values are "infected" and "clean"
|
||||
#defaultresult = infected
|
||||
|
||||
|
||||
|
||||
#
|
||||
# Example configuration for clamdscan
|
||||
#
|
||||
|
||||
## Path to binary
|
||||
#progname = '/usr/bin/clamdscan'
|
||||
|
||||
## Program returns 0 for clean files (for an easy out)
|
||||
#cleancodes = 0
|
||||
|
||||
## Regular expression for virus names
|
||||
#virusregexp = : ([ -/a-zA-Z0-9\.]+) FOUND
|
||||
#submatch = 1
|
||||
|
||||
## Default scan result when the above don't match
|
||||
#defaultresult = infected
|
||||
8
docker-compose/e2guardian/contentscanners/icapscan.conf
Normal file
8
docker-compose/e2guardian/contentscanners/icapscan.conf
Normal file
@ -0,0 +1,8 @@
|
||||
plugname = 'icapscan'
|
||||
|
||||
# ICAP URL
|
||||
# Use hostname rather than IP address
|
||||
# Always specify the port
|
||||
#
|
||||
icapurl = 'icap://icapserver:1344/avscan'
|
||||
|
||||
13
docker-compose/e2guardian/contentscanners/kavdscan.conf
Normal file
13
docker-compose/e2guardian/contentscanners/kavdscan.conf
Normal file
@ -0,0 +1,13 @@
|
||||
plugname = 'kavdscan'
|
||||
|
||||
# edit this to match the location of your KAVD UNIX domain socket
|
||||
#kavdudsfile = '/var/run/aveserver'
|
||||
|
||||
# If this string is set, the text it contains shall be removed from the
|
||||
# beginning of filenames when passing them to KAVD.
|
||||
# Use it to - for example - support a KAVD running inside a chroot jail:
|
||||
# if DG's filecachedir is set to "/var/kavdchroot/downloads/" and pathprefix
|
||||
# is set to "/var/kavdchroot", then file names given to KAVD will be of the
|
||||
# form "/downloads/tf*" instead of "/var/kavdchroot/downloads/tf*".
|
||||
#pathprefix = '/var/kavdchroot'
|
||||
|
||||
17
docker-compose/e2guardian/downloadmanagers/default.conf
Normal file
17
docker-compose/e2guardian/downloadmanagers/default.conf
Normal file
@ -0,0 +1,17 @@
|
||||
# The default download manager.
|
||||
# This is the safest option for unknown user-agents and content types, and
|
||||
# hence a good one to include last.
|
||||
|
||||
# Which plugin should be loaded?
|
||||
plugname = 'default'
|
||||
|
||||
# Regular expression for matching user agents
|
||||
# When not defined, matches all agents.
|
||||
#useragentregexp = '.*'
|
||||
|
||||
# Lists of mime types and extensions to manage
|
||||
# When not defined, matches everything.
|
||||
# These can be enabled separately; when both enabled,
|
||||
# a request may match either list.
|
||||
#managedmimetypelist = ''
|
||||
#managedextensionlist = ''
|
||||
1348
docker-compose/e2guardian/e2guardian.conf
Normal file
1348
docker-compose/e2guardian/e2guardian.conf
Normal file
File diff suppressed because it is too large
Load Diff
882
docker-compose/e2guardian/e2guardianf1.conf
Normal file
882
docker-compose/e2guardian/e2guardianf1.conf
Normal file
@ -0,0 +1,882 @@
|
||||
# e2guardian filter group config file for version 5.4.4
|
||||
|
||||
# This file is re-read on gentle restart and any changes actioned
|
||||
|
||||
### Filtergroup config is now split into sections as follows
|
||||
###
|
||||
### QUICK_START - Items to check to get you started
|
||||
### MITM - SSL MITM settings
|
||||
### URL_FILTERING - URL filtering settings
|
||||
### URL_MAIN_LISTS - URL/SITE lists - for downloaded lists(?)
|
||||
### URL_LOCAL_LISTS - URL/SITE lists - local
|
||||
### FILE_TYPES - Lists that control download filetype access
|
||||
### TIMES - Time based lists
|
||||
### APPS - Lists to control apps/browsers
|
||||
### REFERER - Lists to allow exceptions based on referer site/url
|
||||
### URL_MOD - Lists to modify url and ssl site target
|
||||
### REDIRECT - Redirection list
|
||||
### LOG_ONLY - Categorise and log but do not filter lists
|
||||
### POST - Post filtering - not implimented yet in v5
|
||||
### PHRASES - Content phrase settings and lists
|
||||
### SEARCH - Search term filtering settings and lists
|
||||
### AV_SCANNERS - AV scanner settings and lists
|
||||
### HEADER - HTTP Header handling
|
||||
### BLOCK_PAGE - Block Page formats and handling
|
||||
### BYPASS - Bypass settings and lists
|
||||
### EMAILER - Emailer settings (experimental)
|
||||
### OBSOLETE - Obsolete settings
|
||||
### INFO - Info on new features etc
|
||||
###
|
||||
|
||||
|
||||
### QUICK_START section
|
||||
###
|
||||
### e2guardian will work using examplef1.story
|
||||
### and the example.group sub-directory of the lists directory
|
||||
### without you making any changes to this file.
|
||||
###
|
||||
### The items you are likely to need to change in production are
|
||||
### in this section.
|
||||
###
|
||||
### To set up for production:-
|
||||
###
|
||||
### In config directory:-
|
||||
### Copy examplef1.story to group1.story
|
||||
### In list directory:-
|
||||
### Create a group1 directory
|
||||
### Copy the lists in lists/example.group into this directory
|
||||
### and edit them to your requirements
|
||||
### Comment out .define.., and storyboard = lines below.
|
||||
###
|
||||
### To add group two:-
|
||||
###
|
||||
### Copy this file to e2guardianf2.conf
|
||||
### and repeat above steps, but for group2.story, lists/group2 directory etc
|
||||
###
|
||||
### Repeat for any further groups
|
||||
###
|
||||
### Remember to adjust the 'filtergroups' setting in e2guardian.conf
|
||||
### to the number of groups you now have.
|
||||
|
||||
#groupname = 'my_name_for_group'
|
||||
#
|
||||
# Filter group name
|
||||
# Used to fill in the -FILTERGROUP -placeholder in the HTML template file, and to
|
||||
# name the group in the access logs
|
||||
# Default 'group1' where 1 is the group number
|
||||
|
||||
storyboard = '/etc/e2guardian/examplef1.story' # comment out for production
|
||||
#
|
||||
# Storyboard logic for this group
|
||||
#
|
||||
# defaults to '/etc/e2guardian/group1.story' where 1 is the group number
|
||||
|
||||
.Define LISTDIR </etc/e2guardian/lists/example.group> # comment out for production
|
||||
# The directory path for list files for this group
|
||||
# This path replaces __LISTDIR__ wherever it occurs below or in included files.
|
||||
# See INFO section for full details
|
||||
# defaults (initialized) as </etc/e2guardian/lists/group1> where 1 is the group number
|
||||
|
||||
#naughtynesslimit = 60
|
||||
#
|
||||
# Naughtiness limit
|
||||
# This the limit over which the page will be blocked. Each weighted phrase is given
|
||||
# a value either positive or negative and the values added up. Phrases to do with
|
||||
# good subjects will have negative values, and bad subjects will have positive
|
||||
# values. See the weightedphraselist file for examples.
|
||||
# As a guide:
|
||||
# 60 is for young children, 100 for old children, 160 for young adults.
|
||||
# default 60
|
||||
|
||||
###
|
||||
### END of QUICK_START section
|
||||
|
||||
|
||||
### MITM section
|
||||
###
|
||||
|
||||
# NOTE to enable SSL MITM
|
||||
# enablessl must be defined as 'on' in e2guardian.conf
|
||||
|
||||
#sslmitm = on
|
||||
#
|
||||
#SSL man in the middle
|
||||
# Forge ssl certificates for all non-exception sites, decrypt the data then re encrypt it
|
||||
# using a different private key. Used to filter ssl sites
|
||||
#default off
|
||||
|
||||
# mitmcheckcert = on
|
||||
#
|
||||
# Enable MITM site certificate checking
|
||||
# ignored if sslmitm is off
|
||||
# default (recommended) is 'on'
|
||||
|
||||
#Do not check ssl certificates for sites listed
|
||||
# Can be used to allow sites with self-signed or invalid certificates
|
||||
# or to reduced CPU load by not checking certs on heavily used sites (e.g. Google, Bing)
|
||||
# Use with caution!
|
||||
# Ignored if mitmcheckcert is 'off'
|
||||
#
|
||||
sitelist = 'name=nocheckcert,path=__LISTDIR__/nocheckcertsitelist'
|
||||
ipsitelist = 'name=nocheckcert,path=__LISTDIR__/nocheckcertsiteiplist'
|
||||
#
|
||||
|
||||
# automitm = on
|
||||
#
|
||||
# Auto switch to MITM with upstream connection error or to deliver block page
|
||||
# ignored if sslmitm is off
|
||||
# To revert to v4 type behavour switch this off
|
||||
# Default is 'on'
|
||||
|
||||
# greyssl lists only used in onlymitmsslgrey mode to define sites that
|
||||
# will be MITM
|
||||
|
||||
sitelist = 'name=greyssl,path=__LISTDIR__/greysslsitelist'
|
||||
ipsitelist = 'name=greyssl,path=__LISTDIR__/greysslsiteiplist'
|
||||
|
||||
sitelist = 'name=localgreyssl,path=__LISTDIR__/localgreysslsitelist'
|
||||
#ipsitelist = 'name=localgreyssl,path=__LISTDIR__/localgreysslsiteiplist'
|
||||
|
||||
###
|
||||
### END of MITM section
|
||||
|
||||
|
||||
### URL_FILTERING section
|
||||
###
|
||||
|
||||
#deepurlanalysis = off
|
||||
# Enable Deep URL Analysis
|
||||
# When enabled, E2 looks for URLs within URLs, checking against the bannedsitelist and
|
||||
# bannedurllist. This can be used, for example, to block images originating from banned
|
||||
# sites from appearing in Google Images search results, as the original URLs are
|
||||
# embedded in the thumbnail GET requests.
|
||||
# (on|off) default = off
|
||||
|
||||
###
|
||||
### END of URL_FILTERING section
|
||||
|
||||
|
||||
### URL_MAINLISTS section
|
||||
###
|
||||
### Most of the site/ipsite/url lists in this section are used for
|
||||
### switching on/off standard list categories
|
||||
###
|
||||
### It is best to use the LOCAL lists for your own lists of sites/urls
|
||||
### As these override the main ones.
|
||||
|
||||
## For info on the format of list definitions see notes/V5_list_definition
|
||||
|
||||
## Order of checking is broadly as follows:-
|
||||
##
|
||||
## 1. If in Local Exception lists - allow with no further checking
|
||||
## 2. If in Local Grey lists - retrieve page and content-check
|
||||
## 3. If in Local Banned lists - block with no further checking
|
||||
## 4. If in Main Exception lists - allow with no further checking
|
||||
## 5. If in Main Grey lists - retrieve page and content-check
|
||||
## 6. If in Main Banned lists (or blanket blocked) - block with no further checking
|
||||
## 7. If gets here - retrieve page and content-check
|
||||
## 8. Check blocked/exception file/mime types.
|
||||
## 9. Content-check page
|
||||
|
||||
## Exception lists
|
||||
|
||||
sitelist = 'name=exception,messageno=602,path=__LISTDIR__/exceptionsitelist'
|
||||
ipsitelist = 'name=exception,messageno=602,path=__LISTDIR__/exceptionsiteiplist'
|
||||
urllist = 'name=exception,messageno=603,path=__LISTDIR__/exceptionurllist'
|
||||
|
||||
regexpboollist = 'name=exception,messageno=609,path=__LISTDIR__/exceptionregexpurllist'
|
||||
|
||||
## Grey (i.e. content check) lists
|
||||
|
||||
sitelist = 'name=grey,path=__LISTDIR__/greysitelist'
|
||||
ipsitelist = 'name=grey,path=__LISTDIR__/greysiteiplist'
|
||||
urllist = 'name=grey,path=__LISTDIR__/greyurllist'
|
||||
|
||||
## Banned sites/urls
|
||||
|
||||
sitelist = 'name=banned,messageno=500,path=__LISTDIR__/bannedsitelist'
|
||||
ipsitelist = 'name=banned,messageno=510,path=__LISTDIR__/bannedsiteiplist'
|
||||
urllist = 'name=banned,messageno=501,path=__LISTDIR__/bannedurllist'
|
||||
|
||||
regexpboollist = 'name=banned,messageno=503,path=__LISTDIR__/bannedregexpurllist'
|
||||
|
||||
# 'bannedssl' lists are not currently used
|
||||
#sitelist = 'name=bannedssl,messageno=520,path=__LISTDIR__/bannedsslsitelist'
|
||||
#ipsitelist = 'name=bannedssl,messageno=520,path=__LISTDIR__/bannedsslsiteiplist'
|
||||
|
||||
###
|
||||
### END of URL_MAINLISTS section
|
||||
|
||||
|
||||
### URL_LOCAL_LISTS section
|
||||
###
|
||||
### if you do not want to use local lists
|
||||
### then comment out (or remove) all the list entries in this section and
|
||||
### make adjustments to site.story
|
||||
###
|
||||
|
||||
|
||||
## Local Exception lists
|
||||
|
||||
sitelist = 'name=localexception,messageno=662,path=__LISTDIR__/localexceptionsitelist'
|
||||
ipsitelist = 'name=localexception,messageno=662,path=__LISTDIR__/localexceptionsiteiplist'
|
||||
urllist = 'name=localexception,messageno=663,path=__LISTDIR__/localexceptionurllist'
|
||||
|
||||
## Local Grey lists
|
||||
|
||||
sitelist = 'name=localgrey,path=__LISTDIR__/localgreysitelist'
|
||||
ipsitelist = 'name=localgrey,path=__LISTDIR__/localgreysiteiplist'
|
||||
urllist = 'name=localgrey,path=__LISTDIR__/localgreyurllist'
|
||||
|
||||
## Local Banned lists
|
||||
|
||||
sitelist = 'name=localbanned,messageno=560,path=__LISTDIR__/localbannedsitelist'
|
||||
ipsitelist = 'name=localbanned,messageno=560,path=__LISTDIR__/localbannedsiteiplist'
|
||||
urllist = 'name=localbanned,messageno=561,path=__LISTDIR__/localbannedurllist'
|
||||
|
||||
## Bannedssl lists are not currently used
|
||||
#sitelist = 'name=localbannedssl,messageno=580,path=__LISTDIR__/localbannedsslsitelist'
|
||||
#ipsitelist = 'name=localbannedssl,messageno=580,path=__LISTDIR__/localbannedsslsiteiplist'
|
||||
|
||||
###
|
||||
### END of URL_LOCAL_LISTS section
|
||||
|
||||
### FILE_TYPES section
|
||||
###
|
||||
|
||||
# Uncomment the two lines below if want to ONLY allow extentions/mime types in these lists
|
||||
# You will also need to uncomment the checkfiletype function in site.story to enable this
|
||||
#fileextlist = 'name=exceptionextension,path=__LISTDIR__/exceptionextensionlist'
|
||||
#mimelist = 'name=exceptionmime,path=__LISTDIR__/exceptionmimetypelist'
|
||||
|
||||
|
||||
# Use the following lists to block specific kinds of file downloads.
|
||||
#
|
||||
fileextlist = 'name=bannedextension,messageno=900,path=__LISTDIR__/bannedextensionlist'
|
||||
mimelist = 'name=bannedmime,messageno=800,path=__LISTDIR__/bannedmimetypelist'
|
||||
|
||||
#
|
||||
# In either file filtering mode, the following lists can be used to override
|
||||
# MIME type & extension blocks for particular domains & URLs (trusted download sites).
|
||||
#
|
||||
sitelist = 'name=exceptionfile,path=__LISTDIR__/exceptionfilesitelist'
|
||||
ipsitelist = 'name=exceptionfile,path=__LISTDIR__/exceptionfilesiteiplist'
|
||||
urllist = 'name=exceptionfile,path=__LISTDIR__/exceptionfileurllist'
|
||||
|
||||
###
|
||||
### END of FILE_TYPES section
|
||||
|
||||
### TIMES section
|
||||
###
|
||||
|
||||
# NEW in v5.4 bannedtimelist - times when no access is allowed
|
||||
# To activate a storyboard change is required - see examplef1.story
|
||||
#timelist = 'name=bannedtimes,messageno=122,path=__LISTDIR__/bannedtimelist'
|
||||
|
||||
# NEW in v5.4 blankettimelist - times when blanket block is applied
|
||||
# To activate a storyboard change is required - see examplef1.story
|
||||
#timelist = 'name=blankettimes,messageno=122,path=__LISTDIR__/blankettimelist'
|
||||
|
||||
###
|
||||
### END of TIMES section
|
||||
|
||||
### APPS section
|
||||
###
|
||||
### These lists are useful for allowing/blocking apps or browsers based
|
||||
### on the user-agent
|
||||
|
||||
regexpboollist = 'name=banneduseragent,messageno=522,path=__LISTDIR__/bannedregexpuseragentlist'
|
||||
|
||||
regexpboollist = 'name=exceptionuseragent,messageno=610,path=__LISTDIR__/exceptionregexpuseragentlist'
|
||||
|
||||
###
|
||||
### END of APPS section
|
||||
|
||||
### REFERER section
|
||||
###
|
||||
|
||||
# refererexception lists are used to make a request an exception based on the
|
||||
# Referer header.
|
||||
|
||||
sitelist = 'name=refererexception,messageno=620,path=__LISTDIR__/refererexceptionsitelist'
|
||||
ipsitelist = 'name=refererexception,messageno=620,path=__LISTDIR__/refererexceptionsiteiplist'
|
||||
urllist = 'name=refererexception,messageno=620,path=__LISTDIR__/refererexceptionurllist'
|
||||
|
||||
# Some sites have the referering url in their url. Put these url in these
|
||||
# lists and e2g will extract the embeded url and then check this againist
|
||||
# the refererexception lists.
|
||||
# For best results be as specific as possible
|
||||
|
||||
sitelist = 'name=embededreferer,path=__LISTDIR__/../common/embededreferersitelist'
|
||||
ipsitelist = 'name=embededreferer,path=__LISTDIR__/../common/embededreferersiteiplist'
|
||||
urllist = 'name=embededreferer,path=__LISTDIR__/../common/embededrefererurllist'
|
||||
|
||||
|
||||
###
|
||||
### END of REFERER section
|
||||
|
||||
### URL_MOD section
|
||||
###
|
||||
|
||||
# change list is used to modify url on the fly
|
||||
# use to enforce safe search etc.
|
||||
# Do not try and change target site - use redirect for this.
|
||||
regexpreplacelist = 'name=change,path=__LISTDIR__/urlregexplist'
|
||||
|
||||
# Replace target connection site for a ssl connection request
|
||||
# Note: this does not change the url in any way. It just changes
|
||||
# where the request is sent upstream and the new target must accept
|
||||
# the original url.
|
||||
regexpreplacelist = 'name=sslreplace,path=__LISTDIR__/sslsiteregexplist'
|
||||
|
||||
###
|
||||
### END of URL_MOD section
|
||||
|
||||
|
||||
### REDIRECT section
|
||||
###
|
||||
|
||||
# Used to redirect browser to different site and or url
|
||||
regexpreplacelist = 'name=redirect,path=__LISTDIR__/urlredirectregexplist'
|
||||
|
||||
###
|
||||
### END of REDIRECT section
|
||||
|
||||
|
||||
### LOG_ONLY section
|
||||
###
|
||||
|
||||
# Categorise without blocking:
|
||||
|
||||
# Supply categorised lists here and the category string shall be logged against
|
||||
# matching requests, but matching these lists does not perform any filtering
|
||||
# action.
|
||||
#sitelist = 'name=log,path=__LISTDIR__/logsitelist'
|
||||
#ipsitelist = 'name=log,path=__LISTDIR__/logsiteiplist'
|
||||
#urllist = 'name=log,path=__LISTDIR__/logurllist'
|
||||
#regexpboollist = 'name=log,path=__LISTDIR__/logregexpurllist'
|
||||
|
||||
###
|
||||
### END of LOG_ONLY section
|
||||
|
||||
|
||||
### POST section
|
||||
###
|
||||
|
||||
#maxuploadsize = -1
|
||||
#
|
||||
# POST protection (web upload and forms)
|
||||
# does not block forms without any file upload, i.e. this is just for
|
||||
# blocking or limiting uploads
|
||||
# measured in kibibytes after MIME encoding and header bumph
|
||||
# use 0 for a complete block
|
||||
# use higher (e.g. 512 = 512Kbytes) for limiting
|
||||
# use -1 for no blocking
|
||||
# NOTE: POST PROTECTION IS NOT YET IMPLIMENTED IN V5
|
||||
#maxuploadsize = 512
|
||||
#maxuploadsize = 0
|
||||
# default -1
|
||||
|
||||
###
|
||||
### END of POST section
|
||||
|
||||
|
||||
### ACCESS_LOG section
|
||||
###
|
||||
|
||||
# Do not log sites/urls/ext
|
||||
# Useful to prevent requests not made by user directly being logged
|
||||
# Makes logs more readable
|
||||
sitelist = 'name=nolog,path=__LISTDIR__//../common/nologsitelist'
|
||||
ipsitelist = 'name=nolog,path=__LISTDIR__//../common/nologsiteiplist'
|
||||
urllist = 'name=nolog,path=__LISTDIR__//../common/nologurllist'
|
||||
regexpboollist = 'name=nolog,path=__LISTDIR__//../common/nologregexpurllist'
|
||||
fileextlist = 'name=nolog,path=__LISTDIR__//../common/nologextensionlist'
|
||||
|
||||
###
|
||||
### END of ACCESS_LOG section
|
||||
|
||||
|
||||
### PHRASES section
|
||||
###
|
||||
|
||||
#weightedphrasemode = 0
|
||||
# Weighted phrase mode
|
||||
# Optional; overrides the weightedphrasemode option in e2guardian.conf
|
||||
# for this particular group. See documentation for supported values in
|
||||
# that file.
|
||||
|
||||
# textmimetypes = 'application/xhtml+xml,application/xml,application/json,application/javascript,application/x-javascript'
|
||||
#
|
||||
# Phrase filter additional mime types (by default just text/*)
|
||||
|
||||
categorydisplaythreshold = 0
|
||||
#
|
||||
# Category display threshold
|
||||
# This option only applies to pages blocked by weighted phrase filtering.
|
||||
# Defines the minimum score that must be accumulated within a particular
|
||||
# category in order for it to show up on the block pages' category list.
|
||||
# All categories under which the page scores positively will be logged; those
|
||||
# that were not displayed to the user appear in brackets.
|
||||
#
|
||||
# -1 = display only the highest scoring category
|
||||
# 0 = display all categories (default)
|
||||
# > 0 = minimum score for a category to be displayed
|
||||
|
||||
|
||||
bannedphraselist = '__LISTDIR__/bannedphraselist'
|
||||
weightedphraselist = '__LISTDIR__/weightedphraselist'
|
||||
exceptionphraselist = '__LISTDIR__/exceptionphraselist'
|
||||
## To use oldphraselists comment out last 3 lines and
|
||||
## uncomment the follwing 3 lines
|
||||
#bannedphraselist = '__LISTDIR__/oldbannedphraselist'
|
||||
#weightedphraselist = '__LISTDIR__/oldweightedphraselist'
|
||||
#exceptionphraselist = '__LISTDIR__/oldexceptionphraselist'
|
||||
|
||||
###
|
||||
### END of PHRASES section
|
||||
|
||||
|
||||
### SEARCH section
|
||||
###
|
||||
|
||||
# Search term blocking
|
||||
# Search terms can be extracted from search URLs and filtered using one or
|
||||
# both of two different methods.
|
||||
|
||||
# Method 1 is that developed by Protex where specific
|
||||
# search terms are contained in a bannedsearchlist.
|
||||
# (localbannedsearchlist and bannedsearchoveridelist can be used to suppliment
|
||||
# and overide this list as required.)
|
||||
# These lists contain banned search words combinations on each line.
|
||||
# Words are separated by '+' and must be in sorted order within a line.
|
||||
# so to block 'sexy girl' then the list must contain the line
|
||||
# girl+sexy
|
||||
# and this will block both 'sexy girl' and 'girl sexy'
|
||||
# To use this method, the searchregexplist must be enabled and the bannedsearchlist(s) defined
|
||||
|
||||
# Method 2 is uses the
|
||||
# bannedphraselist, weightedphraselist and exceptionphraselist, with a separate
|
||||
# threshold for blocking than that used for normal page content.
|
||||
# To do this, the searchregexplist must be enabled and searchtermlimit
|
||||
# must be greater than 0.
|
||||
|
||||
# Search engine regular expression list (need for both options)
|
||||
# List of regular expressions for matching search engine URLs. It is assumed
|
||||
# that the search terms themselves will be contained in the
|
||||
# of output of each expression.
|
||||
regexpreplacelist = 'name=searchterms,path=__LISTDIR__/../common/searchregexplist'
|
||||
# search engine regexp exception (overide) list
|
||||
# Used to prevent urls such os completetion suggestion requests from being detected
|
||||
# as search requests
|
||||
regexpboollist = 'name=searchtermexceptions, path=__LISTDIR__/../common/searchexceptionregexplist'
|
||||
|
||||
# Search Term list(s) for option 1
|
||||
searchlist = 'name=banned,path=__LISTDIR__/bannedsearchlist'
|
||||
searchlist = 'name=override,path=__LISTDIR__/bannedsearchoveridelist'
|
||||
|
||||
searchlist = 'name=localbanned,messageno=581,path=__LISTDIR__/localbannedsearchlist'
|
||||
|
||||
#searchtermlimit = 0
|
||||
#
|
||||
# Search term limit (for Option 2)
|
||||
# The limit over which requests will be blocked for containing search terms
|
||||
# which match the weightedphraselist. This should usually be lower than the
|
||||
# 'naughtynesslimit' value above, because the amount of text being filtered
|
||||
# is only a few words, rather than a whole page.
|
||||
# This option must be uncommented if searchregexplist is uncommented.
|
||||
# A value of 0 here indicates that search terms should be extracted,
|
||||
# but no phrase filtering should be performed on the resulting text.
|
||||
|
||||
# Search term phrase lists (for Option 2)
|
||||
# If the three lines below are uncommented, search term blocking will use
|
||||
# the banned, weighted & exception phrases from these lists, instead of using
|
||||
# the same phrase lists as for page content. This is optional but recommended,
|
||||
# as weights for individual phrases in the "normal" lists may not be
|
||||
# appropriate for blocking when those phrases appear in a much smaller block
|
||||
# of text.
|
||||
# Please note that all or none of the below should be uncommented, not a
|
||||
# mixture.
|
||||
# NOTE: these are phrase lists and still use the old style defines
|
||||
#bannedsearchtermlist = '__LISTDIR__/bannedsearchtermlist'
|
||||
#weightedsearchtermlist = '__LISTDIR__/weightedsearchtermlist'
|
||||
#exceptionsearchtermlist = '__LISTDIR__/exceptionsearchtermlist'
|
||||
|
||||
###
|
||||
### END of SEARCH section
|
||||
|
||||
|
||||
### AV_SCANNERS section
|
||||
###
|
||||
|
||||
#disablecontentscan = off
|
||||
#
|
||||
# Disable content scanning
|
||||
# If you enable this option you will disable content scanning for this group.
|
||||
# Content scanning primarily is AV scanning (if enabled) but could include
|
||||
# other types.
|
||||
# (on|off) default = off.
|
||||
|
||||
#disablecontentscanerror = off
|
||||
#
|
||||
# Disable content scanning with error (timeout, AV crash, etc)
|
||||
# If you enable this option you will allow object with an unexpected result
|
||||
# Content scanning primarily is AV scanning (if enabled) but could include
|
||||
# other types.
|
||||
# With "on" you can allow INFECTED objects
|
||||
# (on|off) default = off. (default and highly recommended)
|
||||
|
||||
#contentscanexceptions = off
|
||||
#
|
||||
# If 'on' exception sites, urls, users etc will be scanned
|
||||
# This is probably not desirable behavour as exceptions are
|
||||
# supposed to be trusted and will increase load.
|
||||
# Correct use of grey lists are a better idea.
|
||||
# (on|off) default = off
|
||||
|
||||
#Virus checking exceptions - matched urls will not be virus checked
|
||||
#Note that you also need to amend site.story in order for this to work.
|
||||
#mimelist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirusmimetypelist'
|
||||
#fileextlist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirusextensionlist'
|
||||
#sitelist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirussitelist'
|
||||
#ipsitelist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirussiteiplist'
|
||||
#urllist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirusurllist'
|
||||
|
||||
###
|
||||
### END of AV_SCANNERS section
|
||||
|
||||
|
||||
### HEADER section
|
||||
###
|
||||
|
||||
# Outgoing HTTP request header rules:
|
||||
# Lists for blocking based on, and modification of, outgoing HTTP
|
||||
# request headers. Format for headerregexplist is one modification rule per
|
||||
# line, similar to content/URL modifications. Format for
|
||||
# bannedregexpheaderlist is one regular expression per line, with matching
|
||||
# headers causing a request to be blocked.
|
||||
# Headers are matched/replaced on a line-by-line basis, not as a contiguous
|
||||
# block.
|
||||
# Use for example, to remove cookies or prevent certain user-agents.
|
||||
regexpreplacelist = 'name=headermods,path=__LISTDIR__/headerregexplist'
|
||||
regexpboollist = 'name=bannedheader,path=__LISTDIR__/bannedregexpheaderlist'
|
||||
regexpboollist = 'name=exceptionheader,path=__LISTDIR__/exceptionregexpheaderlist'
|
||||
# add cookies etc
|
||||
regexpreplacelist = 'name=addheader,path=__LISTDIR__/addheaderregexplist'
|
||||
|
||||
# Response HTTP header rules:
|
||||
# Lists for modification or removal of HTTP response headers.
|
||||
# Format for reponseheaderregexplist is one rule per line, similar to
|
||||
# content/URL modifications.
|
||||
# Headers are matched/replaced on a line-by-line basis, not as a contiguous
|
||||
# block.
|
||||
# Use for example, to remove protocol upgrade requests.
|
||||
regexpreplacelist = 'name=reponseheadermods,path=__LISTDIR__/responseheaderregexplist'
|
||||
|
||||
###
|
||||
### END of HEADER section
|
||||
|
||||
|
||||
### BLOCK_PAGE section
|
||||
###
|
||||
|
||||
#reportinglevel = 3
|
||||
#
|
||||
#
|
||||
# -1 = log, but do not block - Stealth mode
|
||||
# 0 = just say 'Access Denied'
|
||||
# 1 = report why but not what denied phrase
|
||||
# 2 = report fully
|
||||
# 3 = use HTML template file (accessdeniedaddress ignored) - recommended
|
||||
#
|
||||
# If defined, this overrides the global setting in e2guardian.conf for
|
||||
# members of this filter group.
|
||||
|
||||
#accessdeniedaddress = 'http://YOURSERVER.YOURDOMAIN/cgi-bin/e2guardian.pl'
|
||||
#
|
||||
# accessdeniedaddress is the address of your web server to which the cgi
|
||||
# e2guardian reporting script was copied. Only used in reporting levels
|
||||
# 1 and 2.
|
||||
#
|
||||
# This webserver must be either:
|
||||
# 1. Non-proxied. Either a machine on the local network, or listed as an
|
||||
# exception in your browser's proxy configuration.
|
||||
# 2. Added to the exceptionsitelist. Option 1 is preferable; this option is
|
||||
# only for users using both transparent proxying and a non-local server
|
||||
# to host this script.
|
||||
#
|
||||
|
||||
#nonstandarddelimiter = off
|
||||
#
|
||||
# Non standard delimiter (only used with accessdeniedaddress)
|
||||
# To help preserve the full banned URL, including parameters, the variables
|
||||
# passed into the access denied CGI are separated using non-standard
|
||||
# delimiters. This can be useful to ensure correct operation of the filter
|
||||
# bypass modes. Parameters are split using "::" in place of "&", and "==" in
|
||||
# place of "=".
|
||||
# Default is enabled, but to go back to the standard mode, disable it.
|
||||
|
||||
#htmltemplate = 'custom.html'
|
||||
#
|
||||
# HTML Template override
|
||||
# If defined, this specifies a custom HTML template file for members of this
|
||||
# filter group, overriding the global setting in e2guardian.conf. This is
|
||||
# only used in reporting level 3.
|
||||
#
|
||||
# The default template file path is <languagedir>/<language>/template.html
|
||||
# e.g. /usr/share/e2guardian/languages/ukenglish/template.html when using 'ukenglish'
|
||||
# language.
|
||||
#
|
||||
# This option generates a file path of the form:
|
||||
# <languagedir>/<language>/<htmltemplate>
|
||||
# e.g. /usr/share/e2guardian/languages/ukenglish/custom.html
|
||||
|
||||
#neterrtemplate = 'custom_neterr_template.html'
|
||||
#
|
||||
#Template for use to report network issues and sites which are not responding
|
||||
# The default template file path is <languagedir>/<language>/neterr_template.html
|
||||
# e.g. /usr/share/e2guardian/languages/ukenglish/neterr_template.html when using
|
||||
# 'ukenglish' language.
|
||||
|
||||
|
||||
|
||||
###
|
||||
### END of BLOCK_PAGE section
|
||||
|
||||
|
||||
### BYPASS section
|
||||
###
|
||||
|
||||
#bypass = 0
|
||||
#
|
||||
# Temporary Denied Page Bypass
|
||||
# This provides a link on the denied page to bypass the ban for a few minutes. To be
|
||||
# secure it uses a random hashed secret generated at daemon startup. You define the
|
||||
# number of seconds the bypass will function for before the deny will appear again.
|
||||
# To allow the link on the denied page to appear you will need to edit the template.html
|
||||
# or e2guardian.pl file for your language.
|
||||
# 300 = enable for 5 minutes
|
||||
# 0 = disable ( defaults to 0 )
|
||||
# -1 - depreciated - for backward compatability enables cgibypass with bypassversion 1
|
||||
|
||||
bypassversion = 2
|
||||
#
|
||||
# Byapss version 2 provides a secure cgi communication (see notes/cgi_bypass documentation)
|
||||
#
|
||||
# Bypass version
|
||||
# can be 1 or 2
|
||||
# Always use v2 unless you have old style cgi hash generation in use
|
||||
# Default is 1
|
||||
|
||||
# cgibypass = 'off'
|
||||
#
|
||||
# cgibypass - Use a separate program/CGI to (in v1 generate) or (in v2 validate) link
|
||||
# 'on' or 'off' (default)
|
||||
|
||||
#bypasskey = ''
|
||||
#
|
||||
# Temporary Denied Page Bypass Secret Key
|
||||
# Rather than generating a random key you can specify one. It must be more than 8 chars.
|
||||
# '' = generate a random one (recommended and default)
|
||||
# 'Mary had a little lamb.' = an example
|
||||
# '76b42abc1cd0fdcaf6e943dcbc93b826' = an example
|
||||
|
||||
cgikey = 'you must change this text in order to be secure'
|
||||
# magic key for cgi bypass v2 - used to sign communications between e2g and cgi
|
||||
# default is blank
|
||||
|
||||
|
||||
# Users will not be able to bypass sites/urls in these lists
|
||||
sitelist = 'name=bannedbypass,messageno=500,path=__LISTDIR__/domainsnobypass'
|
||||
#ipsitelist = 'name=bannedbypass,messageno=500,path=__LISTDIR__/ipnobypass'
|
||||
#urllist = 'name=bannedbypass,messageno=501,path=__LISTDIR__/urlnobypass'
|
||||
|
||||
#infectionbypass = 0
|
||||
#
|
||||
# Infection/Scan Error Bypass
|
||||
# Similar to the 'bypass' setting, but specifically for bypassing files scanned and found
|
||||
# to be infected, or files that trigger scanner errors - for example, archive types with
|
||||
# recognised but unsupported compression schemes, or corrupt archives.
|
||||
# The option specifies the number of seconds for which the bypass link will be valid.
|
||||
# 300 = enable for 5 minutes
|
||||
# 0 = disable (default)
|
||||
# -1 - depreciated - for backward compatability enables cgiinfectionbypass with bypassversion 1
|
||||
|
||||
# cgiinfectionbypass = 'off'
|
||||
#
|
||||
# cgiinfectionbypass - Use a separate program/CGI to (v1 generate) or (v2 validate) link
|
||||
# 'on' or 'off' (default)
|
||||
|
||||
#infectionbypasskey = ''
|
||||
#
|
||||
# Infection/Scan Error Bypass Secret Key
|
||||
# Same as the 'bypasskey' option, but used for infection bypass mode.
|
||||
|
||||
#infectionbypasserrorsonly = on
|
||||
#
|
||||
# Infection/Scan Error Bypass on Scan Errors Only
|
||||
# Enable this option to allow infectionbypass links only when virus scanning fails,
|
||||
# not when a file is found to contain a virus.
|
||||
# on = enable (default and highly recommended)
|
||||
# off = disable
|
||||
|
||||
|
||||
###
|
||||
### END of BYPASS section
|
||||
|
||||
|
||||
### EMAILER section
|
||||
###
|
||||
### Note this is experimental in v5 - not supported by maintainers
|
||||
|
||||
# Email reporting - original patch by J. Gauthier
|
||||
|
||||
#usesmtp = off #NOT YET TESTED
|
||||
#
|
||||
# If on, will enable system wide events to be reported by email.
|
||||
# need to configure mail program (see 'mailer' in global config)
|
||||
# and email recipients
|
||||
# default usesmtp = off
|
||||
|
||||
#mailfrom = ''
|
||||
#
|
||||
# who the email would come from
|
||||
# example: mailfrom = 'e2guardian@mycompany.com'
|
||||
|
||||
#avadmin = ''
|
||||
#
|
||||
# who the virus emails go to (if notify av is on)
|
||||
# example: avadmin = 'admin@mycompany.com'
|
||||
|
||||
#contentadmin = ''
|
||||
#
|
||||
# who the content emails go to (when thresholds are exceeded)
|
||||
# and contentnotify is on
|
||||
# example: contentadmin = 'admin@mycompany.com'
|
||||
|
||||
#avsubject = 'e2guardian virus block'
|
||||
#
|
||||
# Subject of the email sent when a virus is caught.
|
||||
# only applicable if notifyav is on
|
||||
# default avsubject = 'e2guardian virus block'
|
||||
|
||||
#contentsubject = 'e2guardian violation'
|
||||
#
|
||||
# Subject of the email sent when violation thresholds are exceeded
|
||||
# default contentsubject = 'e2guardian violation'
|
||||
|
||||
#notifyav = off
|
||||
#
|
||||
# This will send a notification, if usesmtp/notifyav is on, any time an
|
||||
# infection is found.
|
||||
# Important: If this option is off, viruses will still be recorded like a
|
||||
# content infraction.
|
||||
|
||||
#notifycontent = off
|
||||
#
|
||||
# This will send a notification, if usesmtp is on, based on thresholds
|
||||
# below
|
||||
|
||||
#thresholdbyuser = off
|
||||
#
|
||||
# results are only predictable with user authenticated configs
|
||||
# if enabled the violation/threshold count is kept track of by the user
|
||||
|
||||
#violations = 0
|
||||
#
|
||||
# number of violations before notification
|
||||
# setting to 0 will never trigger a notification
|
||||
|
||||
#threshold = 0
|
||||
#
|
||||
# this is in seconds. If 'violations' occur in 'threshold' seconds, then
|
||||
# a notification is made.
|
||||
# if this is set to 0, then whenever the set number of violations are made a
|
||||
# notifaction will be sent.
|
||||
|
||||
###
|
||||
### END of EMAILER section
|
||||
|
||||
|
||||
### OBSOLETE section
|
||||
###
|
||||
|
||||
# groupmode = 1 #DISABLED
|
||||
# Filter group mode IS NOT LONGER SUPPORTED
|
||||
# Unauthenticated users are treated as being in the default filter group.
|
||||
|
||||
# ssllegacylogic = off
|
||||
# Enable legacy (E2) ssl logic
|
||||
# The option is replaced by storyboard logic
|
||||
|
||||
#sslcertcheck = off - NOT implimented in V5 yet
|
||||
#SSL certificate checking
|
||||
# Check that ssl certificates for servers on https connections are valid
|
||||
# and signed by a ca in the configured path
|
||||
# ONLY for connections that are NOT MITM
|
||||
|
||||
# bannedregexwithblanketblock = off
|
||||
# option is replaced by storyboard logic
|
||||
|
||||
#blockdownloads = off
|
||||
# option is replaced by storyboard logic
|
||||
|
||||
#embeddedurlweight = 0
|
||||
# - NOT implimented in v5
|
||||
# Embedded URL weighting
|
||||
# When set to something greater than zero, this option causes URLs embedded within a
|
||||
# page's HTML (from links, image tags, etc.) to be extracted and checked against the
|
||||
# bannedsitelist and bannedurllist. Each link to a banned page causes the amount set
|
||||
# here to be added to the page's weighting.
|
||||
# The behaviour of this option with regards to multiple occurrences of a site/URL is
|
||||
# affected by the weightedphrasemode setting.
|
||||
#
|
||||
# NB: Currently, this feature uses regular expressions that require the PCRE library.
|
||||
# As such, it is only available if you compiled e2guardian with '--enable-pcre=yes'.
|
||||
# You can check compile-time options by running 'e2guardian -v'.
|
||||
#
|
||||
# Set to 0 to disable.
|
||||
# Defaults to 0.
|
||||
# WARNING: This option is highly CPU intensive!
|
||||
|
||||
#onlymitmsslgrey = off - ignored in V5
|
||||
#Limit SSL MITM to sites in greysslsitelist(s)
|
||||
# ignored if sslmitm is off
|
||||
# SSL sites not matching greysslsitelist will be treat as if sslmitm is off.
|
||||
# The option is replaced by storyboard logic
|
||||
|
||||
#contentregexplist = '__LISTDIR__/contentregexplist'
|
||||
#
|
||||
# not yet implemented in v5
|
||||
|
||||
###
|
||||
### END of OBSOLETE section
|
||||
|
||||
|
||||
|
||||
### INFO section
|
||||
###
|
||||
### No settings just info on new features etc
|
||||
|
||||
# New in v5.4.2:- relative paths
|
||||
# Relative paths can used in .Include<> and list files.
|
||||
# The directory of current file will be insert where the file name
|
||||
# does not start with '/'
|
||||
|
||||
|
||||
# Also NEW in v5.4.2 - LISTDIR 'variable' definition
|
||||
# LISTDIR can be defined in .conf files.
|
||||
# This allows for more readable configuration and for templating.
|
||||
# This works similarly to a shell environment variable
|
||||
# The text between <> will replace occurances of __LISTDIR__ in .conf and
|
||||
# list files.
|
||||
# Note: Currently only LISTDIR may be defined.
|
||||
#
|
||||
# The mapping is actioned as the file is read and is valid until another LISTDIR
|
||||
# is defined later in the file, or in an included .conf file.
|
||||
#
|
||||
# The scope of LISTDIR is in the rest of file it is defined in and all
|
||||
# .Include<> files or list files in that portion of the file.
|
||||
|
||||
###
|
||||
### END of INFO section
|
||||
66
docker-compose/e2guardian/examplef1.story
Normal file
66
docker-compose/e2guardian/examplef1.story
Normal file
@ -0,0 +1,66 @@
|
||||
.Include</etc/e2guardian/common.story>
|
||||
.Include</etc/e2guardian/site.story>
|
||||
|
||||
# Add any altered functions for this filtergroup here
|
||||
# They will overwrite library or site level definitions
|
||||
|
||||
# To allow unfiltered access to this group
|
||||
# uncomment next 4 lines
|
||||
#function(checkrequest)
|
||||
#if(true) return setexception
|
||||
#function(thttps-checkrequest)
|
||||
#if(true) return setexception
|
||||
|
||||
# To block all access to this group
|
||||
# uncomment next 4 lines
|
||||
#function(checkrequest)
|
||||
#if(true,,105) return setblock
|
||||
#function(sslexceptioncheck)
|
||||
#function(localsslcheckrequest)
|
||||
|
||||
# To block all access to this group at certain times
|
||||
# define times in bannedtimelist,
|
||||
# uncomment the list definition for 'bannedtimes' in e2guardianfn.conf,
|
||||
# and uncomment the next 2 lines
|
||||
#function(checktimesblocked)
|
||||
#if(timein,bannedtimes) return true
|
||||
|
||||
# Note: Blanket blocks are checked after exceptions
|
||||
# and can be used to make a 'walled garden' filtergroup
|
||||
|
||||
# To create blanket block for http (and MITM https)
|
||||
# uncomment next line and one condition line.
|
||||
#function(checkblanketblock)
|
||||
#if(true,,502) return setblock # = ** total blanket
|
||||
#if(siteisip,,505) return setblock # = *ip ip blanket
|
||||
|
||||
# To use timed blanket block
|
||||
# define times in blankettimelist,
|
||||
# uncomment the list definition for 'blankettimes' in e2guardianfn.conf,
|
||||
# and uncomment the next line
|
||||
#if(timein,blankettimes) return setblock
|
||||
|
||||
# To create blanket block for SSL
|
||||
# uncomment next line and one condition line.
|
||||
#function(sslcheckblanketblock)
|
||||
#if(true,,506) return setblock # = **s total blanket
|
||||
#if(siteisip,,507) return setblock # = **ips ip blanket
|
||||
|
||||
# To limit MITM to sslgreylist
|
||||
# replaces onlymitmsslgrey e2guardianf1.conf option
|
||||
# uncomment the next 2 lines
|
||||
#function(sslcheckmitm)
|
||||
#if(true) return sslcheckmitmgreyonly
|
||||
|
||||
# SNI checking - overrides default action when no SNI or TSL is present on a
|
||||
# THTTPS connection
|
||||
# To allow (tunnell) non-tls and/or non-sni connections uncomment the next 3 lines
|
||||
#function(checksni)
|
||||
#ifnot(tls,,511) return setexception # change to setblock to block only non-tls
|
||||
#ifnot(hassniset,,512) return setexception
|
||||
|
||||
# automitm - overrides default action when thttps
|
||||
# To disable automitm for trans https uncomment the next 2 lines
|
||||
# function(thttps_automitm)
|
||||
# if(true) unsetautomitm
|
||||
|
||||
24
docker-compose/e2guardian/lists/README
Normal file
24
docker-compose/e2guardian/lists/README
Normal file
@ -0,0 +1,24 @@
|
||||
README for lists directory
|
||||
|
||||
All lists have now been moved into sub-directories
|
||||
|
||||
As before plugins have their own directories for lists and mappings
|
||||
used by plugins
|
||||
|
||||
Sub-directories:
|
||||
|
||||
authplugins - lists/maps used by authplugins
|
||||
blacklists - placeholder for 3rd party url lists
|
||||
common - lists used by e2guardian.conf and common lists for groups
|
||||
contentscanners - lists used by content/AV scanners
|
||||
downloadmanagers - lists used by downloadmanagers
|
||||
example.group - example lists for group use used by e2guardianf1.conf
|
||||
group1 - lists for group 1
|
||||
group2 - lists for group 2
|
||||
...
|
||||
groupn - lists for group n
|
||||
oldphraselists - old style format phraselists
|
||||
phraselists - lists of phrases
|
||||
rooms - location (ip) based block/allow
|
||||
|
||||
|
||||
10
docker-compose/e2guardian/lists/authplugins/filtergroupslist
Executable file
10
docker-compose/e2guardian/lists/authplugins/filtergroupslist
Executable file
@ -0,0 +1,10 @@
|
||||
# Filter Groups List file for e2guardian
|
||||
#
|
||||
# Format is <user>=<1-99> where 1-99 are the groups
|
||||
# Legacy format is also recognised: <user>=filter<1-99> where 1-99 are the groups
|
||||
#
|
||||
# Eg:
|
||||
# daniel=2
|
||||
#
|
||||
# This file is only of use if you have more than 1 filter group
|
||||
#
|
||||
11
docker-compose/e2guardian/lists/authplugins/ipgroups
Executable file
11
docker-compose/e2guardian/lists/authplugins/ipgroups
Executable file
@ -0,0 +1,11 @@
|
||||
# IP-Group list
|
||||
# Used by the IP-based auth plugin to assign IP addresses to filter groups.
|
||||
#
|
||||
# Examples:
|
||||
# Straight IP matching:
|
||||
#192.168.0.1 = filter1
|
||||
# Subnet matching:
|
||||
#192.168.1.0/255.255.255.0 = filter1
|
||||
# Range matching:
|
||||
#192.168.1.0-192.168.1.255 = filter1
|
||||
|
||||
8
docker-compose/e2guardian/lists/authplugins/portgroups
Executable file
8
docker-compose/e2guardian/lists/authplugins/portgroups
Executable file
@ -0,0 +1,8 @@
|
||||
# Port-Group list
|
||||
# Used by the Port-based auth plugin to assign Ports to filter groups.
|
||||
#
|
||||
# Note that ports MUST be entered in ascending order
|
||||
#
|
||||
# Examples:
|
||||
#8080 = filter1
|
||||
#8081 = filter2
|
||||
73
docker-compose/e2guardian/lists/common/README
Normal file
73
docker-compose/e2guardian/lists/common/README
Normal file
@ -0,0 +1,73 @@
|
||||
README for lists/common directory
|
||||
|
||||
### Lists held in this directory:-
|
||||
|
||||
## Lists defined in e2guardian.conf
|
||||
|
||||
# Sites that are impossible or undesirable to MITM
|
||||
#
|
||||
nomitmsitelist
|
||||
nomitmsiteiplist
|
||||
|
||||
|
||||
# Banned clients
|
||||
#
|
||||
bannediplist
|
||||
# ONLY for banned client IP
|
||||
#
|
||||
exceptioniplist
|
||||
# ONLY for exception client IP
|
||||
#
|
||||
bannedclientlist
|
||||
# Put client dns names in bannedclientlist if required
|
||||
exceptionclientlist
|
||||
# Put client dns names in exceptionclientlist if required
|
||||
|
||||
# Auth exceptions
|
||||
# Target Sites/Urls allowed before authentication
|
||||
# to allow for machines to update without user authentication
|
||||
#
|
||||
authexceptioniplist
|
||||
authexceptionsitelist
|
||||
authexceptionurllist
|
||||
|
||||
browserregexpboollist
|
||||
#
|
||||
# List of regexp that match match User-agent of browsers
|
||||
# Used to determine if client is a browser
|
||||
# and decide whether to send a block page or go MITM
|
||||
|
||||
|
||||
## Lists common to all groups (defined in e2guardianfn.conf)
|
||||
|
||||
|
||||
# Embeded referer
|
||||
# Some sites have the referering url in their url. Put these url in these
|
||||
# lists and e2g will extract the embeded url and then check this againist
|
||||
# the refererexception lists.
|
||||
# For best results be as specific as possible
|
||||
embededreferersitelist
|
||||
embededreferersiteiplist
|
||||
embededrefererurllist
|
||||
|
||||
# Nolog lists
|
||||
# Do not log sites/urls/ext
|
||||
# Useful to prevent requests not made by user directly being logged
|
||||
# Makes logs more readable
|
||||
nologsitelist
|
||||
nologsiteiplist
|
||||
nologurllist
|
||||
nologregexpurllist
|
||||
nologextensionlist
|
||||
|
||||
# Search engine regular expression list
|
||||
# List of regular expressions for matching search engine URLs. It is assumed
|
||||
# that the search terms themselves will be contained in the
|
||||
# of output of each expression.
|
||||
searchregexplist
|
||||
#
|
||||
# search engine regexp exception (overide) list
|
||||
# Used to prevent urls such os completetion suggestion requests from being detected
|
||||
# as search requests
|
||||
searchexceptionregexplist
|
||||
|
||||
@ -0,0 +1,9 @@
|
||||
#Access allowed prior to authentication
|
||||
# IP site addresses
|
||||
#
|
||||
# Single IPs, ranges and subnets can be used,
|
||||
# e.g.
|
||||
# 192.168.0.1
|
||||
# 10.0.0.1-10.0.0.3
|
||||
# 10.0.0.0/24
|
||||
#
|
||||
@ -0,0 +1 @@
|
||||
#Access allowed prior to authentication
|
||||
@ -0,0 +1 @@
|
||||
#Access allowed prior to authentication
|
||||
6
docker-compose/e2guardian/lists/common/bannedclientlist
Executable file
6
docker-compose/e2guardian/lists/common/bannedclientlist
Executable file
@ -0,0 +1,6 @@
|
||||
# Domain names of client machines to
|
||||
# disallow web access to.
|
||||
#
|
||||
# This is not the the domains of web servers
|
||||
# you want to filter.
|
||||
|
||||
12
docker-compose/e2guardian/lists/common/bannediplist
Executable file
12
docker-compose/e2guardian/lists/common/bannediplist
Executable file
@ -0,0 +1,12 @@
|
||||
# IP addresses of client machines to
|
||||
# disallow web access to.
|
||||
#
|
||||
# This is not the IP of web servers
|
||||
# you want to filter.
|
||||
|
||||
# Single IPs, ranges and subnets can be used,
|
||||
# e.g.
|
||||
# 192.168.0.1
|
||||
# 10.0.0.1-10.0.0.3
|
||||
# 10.0.0.0/24
|
||||
#
|
||||
15
docker-compose/e2guardian/lists/common/browserregexplist
Normal file
15
docker-compose/e2guardian/lists/common/browserregexplist
Normal file
@ -0,0 +1,15 @@
|
||||
# Reg Exp to check user-agent shows request is from a browser
|
||||
#
|
||||
# The format is: "extended regular expression"
|
||||
|
||||
(Firefox/)
|
||||
(Chrome/)
|
||||
(MSIE/)
|
||||
(Opera/)
|
||||
(Safari/)
|
||||
(Edge/)
|
||||
|
||||
# curl and wget are not browsers - but are often used for testing
|
||||
# so are included below
|
||||
(curl/)
|
||||
(wget/)
|
||||
@ -0,0 +1,10 @@
|
||||
# Embeded referer IP sites
|
||||
# sites which may contain embeded exception referer sites in the url
|
||||
# IP site addresses
|
||||
#
|
||||
# Single IPs, ranges and subnets can be used,
|
||||
# e.g.
|
||||
# 192.168.0.1
|
||||
# 10.0.0.1-10.0.0.3
|
||||
# 10.0.0.0/24
|
||||
#
|
||||
@ -0,0 +1,2 @@
|
||||
# Embeded referer sites
|
||||
# sites which may contain embeded exception referer sites in the url
|
||||
@ -0,0 +1,5 @@
|
||||
# Embeded referer urls
|
||||
# urls which may contain embeded exception referer sites in the url
|
||||
|
||||
# e.g. to allow youtube video when embeded in a trusted referer site/urls
|
||||
# www.youtube.com/get_video_info
|
||||
16
docker-compose/e2guardian/lists/common/exceptionclientlist
Executable file
16
docker-compose/e2guardian/lists/common/exceptionclientlist
Executable file
@ -0,0 +1,16 @@
|
||||
# Doamin names of computers from which
|
||||
# web access should not be filtered.
|
||||
#
|
||||
# These would be servers which
|
||||
# need unfiltered access for
|
||||
# updates. Also administrator
|
||||
# workstations which need to
|
||||
# download programs and check
|
||||
# out blocked sites should be
|
||||
# put here.
|
||||
#
|
||||
# To work you must
|
||||
# cater for reverse DNS lookups
|
||||
# on your LAN and enable the
|
||||
# "reverseclientiplookups" option in
|
||||
# e2guardian.conf
|
||||
27
docker-compose/e2guardian/lists/common/exceptioniplist
Executable file
27
docker-compose/e2guardian/lists/common/exceptioniplist
Executable file
@ -0,0 +1,27 @@
|
||||
# IP addresses of computers from which
|
||||
# web access should not be filtered.
|
||||
#
|
||||
# These would be servers which
|
||||
# need unfiltered access for
|
||||
# updates. Also administrator
|
||||
# workstations which need to
|
||||
# download programs and check
|
||||
# out blocked sites should be
|
||||
# put here.
|
||||
#
|
||||
# Hostnames are NOT allowed here,
|
||||
# put these in exceptionclientlist and
|
||||
# enable the reverseclientlookups option.
|
||||
#
|
||||
# This is not the IP of web servers
|
||||
# you don't want to filter.
|
||||
|
||||
#192.168.0.1
|
||||
#192.168.0.2
|
||||
#192.168.42.2
|
||||
|
||||
# Ranges and subnets can also be used,
|
||||
# e.g.
|
||||
# 10.0.0.1-10.0.0.3
|
||||
# 10.0.0.0/24
|
||||
#
|
||||
31
docker-compose/e2guardian/lists/common/nologextensionlist
Executable file
31
docker-compose/e2guardian/lists/common/nologextensionlist
Executable file
@ -0,0 +1,31 @@
|
||||
# No Log file extension list
|
||||
|
||||
# requests with extensions in this list will not be logged
|
||||
|
||||
# Text/web document types
|
||||
|
||||
.css
|
||||
|
||||
# Image types
|
||||
|
||||
#.bmp
|
||||
#.cod
|
||||
#.gif
|
||||
#.ief
|
||||
#.jpe
|
||||
#.jpeg
|
||||
#.jpg
|
||||
#.jfif
|
||||
#.tif
|
||||
#.tiff
|
||||
#.ras
|
||||
#.cmx
|
||||
#.ico
|
||||
#.pnm
|
||||
#.pbm
|
||||
#.pgm
|
||||
#.ppm
|
||||
#.rgb
|
||||
#.xbm
|
||||
#.xpm
|
||||
#.xwd
|
||||
4
docker-compose/e2guardian/lists/common/nologregexpurllist
Executable file
4
docker-compose/e2guardian/lists/common/nologregexpurllist
Executable file
@ -0,0 +1,4 @@
|
||||
# No Log regular expression URL list
|
||||
#
|
||||
# This acts as a list of URL regexes which, if matched, will
|
||||
# not be logged
|
||||
13
docker-compose/e2guardian/lists/common/nologsiteiplist
Executable file
13
docker-compose/e2guardian/lists/common/nologsiteiplist
Executable file
@ -0,0 +1,13 @@
|
||||
# No Log IP site list
|
||||
#
|
||||
# This acts as a list of IP sites which, when found,
|
||||
# will not be logged
|
||||
|
||||
# IP site addresses
|
||||
#
|
||||
# Single IPs, ranges and subnets can be used,
|
||||
# e.g.
|
||||
# 192.168.0.1
|
||||
# 10.0.0.1-10.0.0.3
|
||||
# 10.0.0.0/24
|
||||
#
|
||||
4
docker-compose/e2guardian/lists/common/nologsitelist
Executable file
4
docker-compose/e2guardian/lists/common/nologsitelist
Executable file
@ -0,0 +1,4 @@
|
||||
# No Log site list
|
||||
#
|
||||
# This acts as a list of domains which, when found,
|
||||
# will not be logged.
|
||||
9
docker-compose/e2guardian/lists/common/nologurllist
Executable file
9
docker-compose/e2guardian/lists/common/nologurllist
Executable file
@ -0,0 +1,9 @@
|
||||
# No Log URL list
|
||||
#
|
||||
# This acts as a list of URLs which, when found, will
|
||||
# not be logged
|
||||
|
||||
www.google.com/complete
|
||||
www.google.co.uk/complete
|
||||
|
||||
|
||||
9
docker-compose/e2guardian/lists/common/nomitmsiteiplist
Normal file
9
docker-compose/e2guardian/lists/common/nomitmsiteiplist
Normal file
@ -0,0 +1,9 @@
|
||||
#IP in nomitmsiteiplist
|
||||
|
||||
#This list is to stop any attempt to mitm these sites,
|
||||
# including trying to MITM to client to deliver an error message
|
||||
|
||||
#Only put IP sites which cannot be MITM in this list
|
||||
#This applies to sites which are only used by apps
|
||||
#Sites not using http(s) but connecting via https or CONNECT
|
||||
|
||||
14
docker-compose/e2guardian/lists/common/nomitmsitelist
Normal file
14
docker-compose/e2guardian/lists/common/nomitmsitelist
Normal file
@ -0,0 +1,14 @@
|
||||
#domains in nomitmsitelist
|
||||
#Don't bother with the www. or the http://
|
||||
|
||||
#This list is to stop any attempt to mitm these sites,
|
||||
# including trying to MITM to client to deliver an error message
|
||||
|
||||
#Only put sites which cannot be MITM in this list
|
||||
#This applies to sites which are only used by apps
|
||||
#Sites not using http(s) but connecting via https or CONNECT
|
||||
|
||||
#NOTE: Sites using just IP should be put into nomitmsiteiplist
|
||||
|
||||
reports.crashlytics.com # google app crash tool
|
||||
|
||||
@ -0,0 +1,11 @@
|
||||
# This defines urls which will be not search term checked
|
||||
# Overrides searchregexplist
|
||||
#
|
||||
# The format is: "extended regular expression"
|
||||
#
|
||||
|
||||
#"^http://[0-9a-z]+\.google\.[a-z]+[-%.0-9a-z]*/complete"
|
||||
"^http://www.google.com/complete"
|
||||
"^http://www.google.co.uk/complete"
|
||||
|
||||
|
||||
37
docker-compose/e2guardian/lists/common/searchregexplist
Normal file
37
docker-compose/e2guardian/lists/common/searchregexplist
Normal file
@ -0,0 +1,37 @@
|
||||
# This defines sites which will be search term checked
|
||||
#
|
||||
# The format is: "extended regular expression"->"search words"
|
||||
#
|
||||
# left is the site matching pattern
|
||||
# right is the search words
|
||||
|
||||
"^http://[0-9a-z]+\.google\.[a-z]+[-/%.0-9a-z]*\?q=([^&]*)\&.*"->"\1"
|
||||
"^http://[0-9a-z]+\.google\.[a-z]+[-/%.0-9a-z]*/.*\&q=([^&]*).*"->"\1"
|
||||
"^http://[0-9a-z]+\.google\.[a-z]+[-/%.0-9a-z]*\?q=([^&]*)"->"\1"
|
||||
"^http://[0-9a-z]+\.google\.[a-z]+[-/%.0-9a-z]*/.*\&q=([^&]*)"->"\1"
|
||||
|
||||
"^http://www\.qwant\.com/.*\?q=([^&]*)\&.*"->"\1"
|
||||
"^http://www\.qwant\.com/.*\&q=([^&]*).*"->"\1"
|
||||
"^http://www\.qwant\.com/.*\?q=([^&]*)"->"\1"
|
||||
"^http://www\.qwant\.com/.*\&q=([^&]*)"->"\1"
|
||||
"^http://api\.qwant\.com/.*\?q=([^&]*)\&.*"->"\1"
|
||||
"^http://api\.qwant\.com/.*\&q=([^&]*).*"->"\1"
|
||||
"^http://api\.qwant\.com/.*\?q=([^&]*)"->"\1"
|
||||
"^http://api\.qwant\.com/.*\&q=([^&]*)"->"\1"
|
||||
|
||||
"^http://duckduckgo.com/\?q=([^&]*)\&.*"->"\1"
|
||||
"^http://duckduckgo.com/.*\&q=([^&]*).*"->"\1"
|
||||
"^http://duckduckgo.com/\?q=([^&]*)"->"\1"
|
||||
"^http://duckduckgo.com/.*\&q=([^&]*)"->"\1"
|
||||
|
||||
"^http://[0-9a-z]+\.youtube\.[a-z]+[-/%.0-9a-z]*\?search_query=([^&]*).*"->"\1"
|
||||
|
||||
"^http://[0-9a-z]+\.yahoo\.[a-z]+[-/%.0-9a-z]*/search[^?]*\?p=([^&]*).*"->"\1"
|
||||
"^http://[0-9a-z]+\.yahoo\.[a-z]+[-/%.0-9a-z]*/search[^?]*.*\&p=([^&]*).*"->"\1"
|
||||
|
||||
"^http://[0-9a-z]+\.answers\.[a-z]+[-/%.0-9a-z]*\?s=([^&]*)\&.*"->"\1"
|
||||
"^http://www\.answers\.[a-z]+[-%.0-9a-z]*/([^&]*).*"->"\1"
|
||||
|
||||
"^http://[0-9a-z]+\.bing\.com[-/%.0-9a-z]*/search\?q=([^&]*).*"->"\1"
|
||||
"^http://[0-9a-z]+\.bing\.com[-/%.0-9a-z]*\&q=([^&]*).*"->"\1"
|
||||
|
||||
35
docker-compose/e2guardian/lists/contentscanners/exceptionvirusextensionlist
Executable file
35
docker-compose/e2guardian/lists/contentscanners/exceptionvirusextensionlist
Executable file
@ -0,0 +1,35 @@
|
||||
#Exception Virus extension list
|
||||
|
||||
#This file originally from:
|
||||
#http://dgav.sourceforge.net
|
||||
|
||||
# The Virus scanning code will ignore files with these extensions.
|
||||
|
||||
# File extensions with executable code
|
||||
|
||||
|
||||
# Files which one normally things as non-executable but
|
||||
# can contain harmful macros and viruses
|
||||
|
||||
|
||||
# Other files which may contain files with executable code
|
||||
|
||||
|
||||
# Time/bandwidth wasting files
|
||||
|
||||
.mp3 # Music file
|
||||
.mpeg # Movie file
|
||||
.mpg # Movie file
|
||||
.avi # Movie file
|
||||
.ra # Real Audio
|
||||
.ram # "
|
||||
.rm # "
|
||||
|
||||
# Image files not to scan
|
||||
.gif
|
||||
.png
|
||||
.tiff
|
||||
.ico
|
||||
# http://www.kb.cert.org/vuls/id/297462
|
||||
#.jpg
|
||||
#.jpeg
|
||||
28
docker-compose/e2guardian/lists/contentscanners/exceptionvirusmimetypelist
Executable file
28
docker-compose/e2guardian/lists/contentscanners/exceptionvirusmimetypelist
Executable file
@ -0,0 +1,28 @@
|
||||
# MIME types the virus scanning code ignores.
|
||||
|
||||
#This file originally from:
|
||||
#http://dgav.sourceforge.net
|
||||
|
||||
audio/mpeg
|
||||
audio/x-mpeg
|
||||
audio/x-pn-realaudio
|
||||
audio/x-wav
|
||||
audio/x-realaudio
|
||||
audio/x-pn-realaudio
|
||||
audio/vnd.rn-realaudio
|
||||
application/ogg
|
||||
video/mpeg
|
||||
video/x-mpeg2
|
||||
video/acorn-replay
|
||||
video/quicktime
|
||||
video/x-msvideo
|
||||
video/msvideo
|
||||
video/vnd.rn-realvideo
|
||||
|
||||
image/png
|
||||
image/gif
|
||||
image/tiff
|
||||
# http://www.kb.cert.org/vuls/id/297462
|
||||
# image/jpeg
|
||||
|
||||
# text/html
|
||||
12
docker-compose/e2guardian/lists/contentscanners/exceptionvirussitelist
Executable file
12
docker-compose/e2guardian/lists/contentscanners/exceptionvirussitelist
Executable file
@ -0,0 +1,12 @@
|
||||
#Sites in virus exception list will not be virus scanned
|
||||
#Don't bother with the www. or
|
||||
#the http://
|
||||
#
|
||||
#These are specifically domains and are not URLs.
|
||||
#For example 'foo.bar/porn/' is no good, you need
|
||||
#to just have 'foo.bar'.
|
||||
#
|
||||
#You can also match IPs here too.
|
||||
#
|
||||
|
||||
example.com
|
||||
15
docker-compose/e2guardian/lists/contentscanners/exceptionvirusurllist
Executable file
15
docker-compose/e2guardian/lists/contentscanners/exceptionvirusurllist
Executable file
@ -0,0 +1,15 @@
|
||||
#URLs in exception virus list will not be virus scanned
|
||||
#Don't bother with the www. or
|
||||
#the http://
|
||||
#
|
||||
#These are parts of sites that filtering should
|
||||
#be switched off for.
|
||||
#
|
||||
#These should not be domains, i.e. entire sites,
|
||||
#they should be a domain with a path.
|
||||
#
|
||||
#For example 'foo.bar' is no good, you need
|
||||
#to just have 'foo.bar/porn'.
|
||||
#
|
||||
#Another example:
|
||||
#generallybadsite.tld/partthatsok
|
||||
42
docker-compose/e2guardian/lists/downloadmanagers/managedextensionlist
Executable file
42
docker-compose/e2guardian/lists/downloadmanagers/managedextensionlist
Executable file
@ -0,0 +1,42 @@
|
||||
# Managed extension list
|
||||
# For use as the 'managedextensionlist' option in the configuration of
|
||||
# download managers supporting this feature.
|
||||
#
|
||||
# When enabled, only content matching the extensions given in this list will
|
||||
# be handled by the download manager.
|
||||
# If a managedmimetypelist is also enabled, then only content matching both
|
||||
# a mimetype and an extension in the lists will be handled.
|
||||
|
||||
.bat
|
||||
.cab
|
||||
.com
|
||||
.crt
|
||||
.exe
|
||||
.hlp
|
||||
.ini
|
||||
.hta
|
||||
.inf
|
||||
.lnk
|
||||
.mdb
|
||||
.pcd
|
||||
.sh
|
||||
.vbs
|
||||
.doc
|
||||
.xls
|
||||
.gz
|
||||
.tar
|
||||
.bz2
|
||||
.sit
|
||||
.bin
|
||||
.hqx
|
||||
.zip
|
||||
.sxw
|
||||
.doc
|
||||
.iso
|
||||
.pdf
|
||||
.rar
|
||||
.ace
|
||||
.arj
|
||||
.dll
|
||||
.mda
|
||||
.mde
|
||||
174
docker-compose/e2guardian/lists/downloadmanagers/managedmimetypelist
Executable file
174
docker-compose/e2guardian/lists/downloadmanagers/managedmimetypelist
Executable file
@ -0,0 +1,174 @@
|
||||
# Managed mime type list
|
||||
# For use as the 'managedmimetypelist' option in the configuration of
|
||||
# download managers supporting this feature.
|
||||
#
|
||||
# When enabled, only content matching the mime types given in this list will
|
||||
# be handled by the download manager.
|
||||
# If a managedextensionlist is also enabled, then only content matching both
|
||||
# a mimetype and an extension in the lists will be handled.
|
||||
|
||||
# List originally by David Chewning <david.chewning@onedatacentral.com>
|
||||
|
||||
# MIME Types Researched at http://filext.com/
|
||||
# bat
|
||||
application/bat
|
||||
application/x-bat
|
||||
# cab
|
||||
application/cab
|
||||
zz-application/zz-winassoc-cab
|
||||
# com
|
||||
application/com
|
||||
application/x-com
|
||||
# crt
|
||||
application/x-x509-ca-cert
|
||||
application/pkix-cert
|
||||
application/keychain_access
|
||||
# exe
|
||||
application/octet-stream
|
||||
application/exe
|
||||
application/x-exe
|
||||
application/dos-exe
|
||||
vms/exe
|
||||
application/x-winexe
|
||||
application/msdos-windows
|
||||
# hlp
|
||||
application/winhlp
|
||||
application/x-helpfile
|
||||
application/x-winhelp
|
||||
zz-application/zz-winassoc-hlp
|
||||
# ini
|
||||
zz-application/zz-winassoc-ini
|
||||
# hta
|
||||
application/hta
|
||||
# inf
|
||||
text/inf
|
||||
application/x-setupscript
|
||||
# lnk
|
||||
application/x-ms-shortcut
|
||||
# mdb
|
||||
application/x-msaccess
|
||||
application/vnd.msaccess
|
||||
application/mdb
|
||||
application/x-mdb
|
||||
zz-application/zz-winassoc-mdb
|
||||
# pcd
|
||||
image/pcd
|
||||
image/x-photo-cd
|
||||
# sh
|
||||
application/x-sh
|
||||
application/x-shar
|
||||
# vbs
|
||||
application/x-vbs
|
||||
text/vbs
|
||||
text/vbscript
|
||||
# doc
|
||||
application/msword
|
||||
application/doc
|
||||
application/vnd.msword
|
||||
application/vnd.ms-word
|
||||
application/winword
|
||||
application/word
|
||||
application/x-msw6
|
||||
application/x-msword
|
||||
zz-application/zz-winassoc-doc
|
||||
# xls
|
||||
application/msexcel
|
||||
application/x-msexcel
|
||||
application/x-ms-excel
|
||||
application/vnd.ms-excel
|
||||
application/x-excel
|
||||
application/x-dos_ms_excel
|
||||
application/xls
|
||||
application/x-xls
|
||||
zz-application/zz-winassoc-xls
|
||||
# gz
|
||||
application/gzip
|
||||
application/x-gunzip
|
||||
application/gzipped
|
||||
application/gzip-compressed
|
||||
gzip/document
|
||||
# tar
|
||||
application/tar
|
||||
applicaton/x-gtar
|
||||
multipart/x-tar
|
||||
# bz2
|
||||
application/bzip2
|
||||
application/x-bz2
|
||||
application/x-bzip
|
||||
# sit
|
||||
application/stuffit
|
||||
application/x-sit
|
||||
# bin
|
||||
application/macbinary
|
||||
application/x-macbinary
|
||||
application/bin
|
||||
application/binary
|
||||
# hqx
|
||||
application/binhex
|
||||
application/mac-binhex
|
||||
application/mac-binhex40
|
||||
application/x-winzip
|
||||
# zip
|
||||
application/zip
|
||||
application/x-zip
|
||||
multipart/x-zip
|
||||
|
||||
# Audio/video types commented out to prevent breakage of streaming apps
|
||||
# mp3
|
||||
#audio/mpeg
|
||||
#audio/x-mpeg
|
||||
#audio/mp3
|
||||
#audio/x-mp3
|
||||
#audio/mpeg3
|
||||
#audio/x-mpeg3
|
||||
#audio/mpg
|
||||
#audio/x-mpg
|
||||
#audio/x-mpegaudio
|
||||
# mpeg
|
||||
#video/mpeg
|
||||
# avi
|
||||
#video/avi
|
||||
#video/msvideo
|
||||
#video/x-msvideo
|
||||
#image/avi
|
||||
#video/xmpg2
|
||||
#application/x-troff-msvideo
|
||||
#audio/aiff
|
||||
#audio/avi
|
||||
# asf
|
||||
#audio/asf
|
||||
#application/asx
|
||||
#video/x-ms-asf-plugin
|
||||
#application/x-mplayer2
|
||||
#video/x-ms-asf
|
||||
#application/vnd.ms-asf
|
||||
#video/x-ms-asf-plugin
|
||||
#video/x-ms-wm
|
||||
#video/x-ms-wmx
|
||||
# ogg
|
||||
#audio/x-ogg
|
||||
#application/x-ogg
|
||||
|
||||
# Multiple extensions
|
||||
# bat, com, dll, exe
|
||||
application/x-msdos-program
|
||||
# cab, gz, tar, zip
|
||||
application/x-compress
|
||||
# cab, gz, tar, bz2, zip
|
||||
application/x-compressed
|
||||
# com, dll, exe, bin
|
||||
application/x-msdownload
|
||||
# mda, mdb, mde
|
||||
application/msaccess
|
||||
application/vnd.ms-access
|
||||
# sct, wsc
|
||||
text/scriptlet
|
||||
# sit, bin, hqx
|
||||
application/x-stuffit
|
||||
# gz, hqx
|
||||
application/x-gzip
|
||||
# tar, hqx
|
||||
application/x-tar
|
||||
# hqx, zip
|
||||
application/x-zip-compressed
|
||||
|
||||
185
docker-compose/e2guardian/lists/example.group/README
Executable file
185
docker-compose/e2guardian/lists/example.group/README
Executable file
@ -0,0 +1,185 @@
|
||||
|
||||
### Lists in this directory relate to a single filter group
|
||||
### each filter group has it's own directory
|
||||
|
||||
###
|
||||
### Many of the exception/grey/banned site/ipsite/url lists are used for
|
||||
### switching on/off standard list categories
|
||||
###
|
||||
### Where available it is best to use the LOCAL lists for your own lists of
|
||||
### sites/urls as these override the main ones.
|
||||
|
||||
## Order of checking is broadly as follows:-
|
||||
##
|
||||
## 1. If in Local Exception lists - allow with no further checking
|
||||
## 2. If in Local Grey lists - retrieve page and content-check
|
||||
## 3. If in Local Banned lists - block with no further checking
|
||||
## 4. If in Main Exception lists - allow with no further checking
|
||||
## 5. If in Main Grey lists - retrieve page and content-check
|
||||
## 6. If in Main Banned lists (or blanket blocked) - block with no further checking
|
||||
## 7. If gets here - retrieve page and content-check
|
||||
## 8. Check blocked/exception file/mime types.
|
||||
## 9. Content-check page
|
||||
|
||||
## Lists in this directory:-
|
||||
|
||||
# Nocheckcert lists
|
||||
# Do not check ssl certificates for sites listed
|
||||
# Can be used to allow sites with self-signed or invalid certificates
|
||||
# or to reduced CPU load by not checking certs on heavily used sites (e.g. Google, Bing)
|
||||
# Use with caution!
|
||||
# Ignored if mitmcheckcert is 'off'
|
||||
#
|
||||
nocheckcertsitelist
|
||||
nocheckcertsiteiplist
|
||||
|
||||
# greyssl lists only used in onlymitmsslgrey mode to define sites that
|
||||
# will be MITM
|
||||
greysslsitelist
|
||||
greysslsiteiplist
|
||||
localgreysslsitelist
|
||||
localgreysslsiteiplist
|
||||
|
||||
## Exception lists
|
||||
## Put sites you trust in these lists
|
||||
## they override Grey and Banned entries
|
||||
exceptionsitelist
|
||||
exceptionsiteiplist
|
||||
exceptionurllist
|
||||
exceptionregexpurllist
|
||||
|
||||
## Grey (i.e. content check) lists
|
||||
## Put sites you want content-checked in these lists
|
||||
## they override Banned entries
|
||||
greysitelist
|
||||
greysiteiplist
|
||||
greyurllist
|
||||
|
||||
## Banned sites/urls
|
||||
bannedsitelist
|
||||
bannedsiteiplist
|
||||
bannedurllist
|
||||
bannedregexpurllist
|
||||
|
||||
# 'bannedssl' lists are not currently used
|
||||
bannedsslsitelist
|
||||
bannedsslsiteiplist
|
||||
|
||||
## Local Exception lists
|
||||
localexceptionsitelist
|
||||
localexceptionsiteiplist
|
||||
localexceptionurllist
|
||||
|
||||
## Local Grey lists
|
||||
localgreysitelist
|
||||
localgreysiteiplist
|
||||
localgreyurllist
|
||||
|
||||
## Local Banned lists
|
||||
localbannedsitelist
|
||||
localbannedsiteiplist
|
||||
localbannedurllist
|
||||
|
||||
## Bannedssl lists are not currently used
|
||||
localbannedsslsitelist
|
||||
localbannedsslsiteiplist
|
||||
|
||||
|
||||
# File type/extensions
|
||||
exceptionextensionlist
|
||||
exceptionmimetypelist
|
||||
|
||||
|
||||
# Use the following lists to block specific kinds of file downloads.
|
||||
bannedextensionlist
|
||||
bannedmimetypelist
|
||||
|
||||
# In either file filtering mode, the following lists can be used to override
|
||||
# MIME type & extension blocks for particular domains & URLs (trusted download sites).
|
||||
#
|
||||
exceptionfilesitelist
|
||||
exceptionfilesiteiplist
|
||||
exceptionfileurllist
|
||||
|
||||
# NEW in v5.4 bannedtimelist - times when no access is allowed
|
||||
# To activate a storyboard change is required - see examplef1.story
|
||||
bannedtimelist
|
||||
|
||||
# NEW in v5.4 blankettimelist - times when blanket block is applied
|
||||
# To activate a storyboard change is required - see examplef1.story
|
||||
blankettimelist
|
||||
|
||||
|
||||
### These lists are useful for allowing/blocking apps or browsers based
|
||||
### on the user-agent
|
||||
bannedregexpuseragentlist
|
||||
exceptionregexpuseragentlist
|
||||
|
||||
# refererexception lists are used to make a request an exception based on the
|
||||
# Referer header.
|
||||
refererexceptionsitelist
|
||||
refererexceptionsiteiplist
|
||||
refererexceptionurllist
|
||||
|
||||
# Used to modify url on the fly
|
||||
# use to enforce safe search etc.
|
||||
# Do not try and change target site - use redirect for this.
|
||||
urlregexplist
|
||||
|
||||
# Replace target connection site for a ssl connection request
|
||||
# Note: this does not change the url in any way. It just changes
|
||||
# where the request is sent upstream and the new target must accept
|
||||
# the original url.
|
||||
sslsiteregexplist
|
||||
|
||||
# Used to redirect browser to different site and or url
|
||||
urlredirectregexplist
|
||||
|
||||
# Categorise without blocking:
|
||||
# Supply categorised lists here and the category string shall be logged against
|
||||
# matching requests, but matching these lists does not perform any filtering
|
||||
# action.
|
||||
logsitelist
|
||||
logsiteiplist
|
||||
logurllist
|
||||
logregexpurllist
|
||||
|
||||
# Phrase lists
|
||||
bannedphraselist
|
||||
weightedphraselist
|
||||
exceptionphraselist
|
||||
|
||||
oldbannedphraselist
|
||||
oldweightedphraselist
|
||||
oldexceptionphraselist
|
||||
|
||||
# Search Term list(s) for option 1
|
||||
bannedsearchlist
|
||||
bannedsearchoveridelist
|
||||
|
||||
localbannedsearchlist
|
||||
|
||||
# Outgoing HTTP request header rules:
|
||||
# Lists for blocking based on, and modification of, outgoing HTTP
|
||||
# request headers. Format for headerregexplist is one modification rule per
|
||||
# line, similar to content/URL modifications. Format for
|
||||
# bannedregexpheaderlist is one regular expression per line, with matching
|
||||
# headers causing a request to be blocked.
|
||||
# Headers are matched/replaced on a line-by-line basis, not as a contiguous
|
||||
# block.
|
||||
# Use for example, to remove cookies or prevent certain user-agents.
|
||||
headerregexplist
|
||||
bannedregexpheaderlist
|
||||
exceptionregexpheaderlist
|
||||
|
||||
# add cookies or other headers etc to matched urls
|
||||
addheaderregexplist
|
||||
|
||||
# Response HTTP header rules:
|
||||
# Lists for modification or removal of HTTP response headers.
|
||||
# Format for reponseheaderregexplist is one rule per line, similar to
|
||||
# content/URL modifications.
|
||||
# Headers are matched/replaced on a line-by-line basis, not as a contiguous
|
||||
# block.
|
||||
# Use for example, to remove protocol upgrade requests.
|
||||
responseheaderregexplist
|
||||
@ -0,0 +1,13 @@
|
||||
#Add header where url matches
|
||||
#
|
||||
## to enable restricted YouTube
|
||||
#"(^http://www\.youtube\.com/.*$)"->"YouTube-Restrict: Strict"
|
||||
#"(^http://m\.youtube\.com/.*$)"->"YouTube-Restrict: Strict"
|
||||
#"(^http://youtubei\.googleapis\.com/.*$)"->"YouTube-Restrict: Strict"
|
||||
#"(^http://youtube\.googleapis\.com/.*$)"->"YouTube-Restrict: Strict"
|
||||
#"(^http://www\.youtube-nocookie\.com/.*$)"->"YouTube-Restrict: Strict"
|
||||
#"(^http://www\.youtube\.com$)"->"YouTube-Restrict: Strict"
|
||||
#"(^http://m\.youtube\.com$)"->"YouTube-Restrict: Strict"
|
||||
#"(^http://youtubei\.googleapis\.com$)"->"YouTube-Restrict: Strict"
|
||||
#"(^http://youtube\.googleapis\.com$)"->"YouTube-Restrict: Strict"
|
||||
#"(^http://www\.youtube-nocookie\.com$)"->"YouTube-Restrict: Strict"
|
||||
211
docker-compose/e2guardian/lists/example.group/bannedextensionlist
Executable file
211
docker-compose/e2guardian/lists/example.group/bannedextensionlist
Executable file
@ -0,0 +1,211 @@
|
||||
#Banned extension list
|
||||
|
||||
# File extensions with executable code
|
||||
|
||||
# The following file extensions can contain executable code.
|
||||
# This means they can potentially carry a virus to infect your computer.
|
||||
|
||||
.ade # Microsoft Access project extension
|
||||
.adp # Microsoft Access project
|
||||
.asx # Windows Media Audio / Video
|
||||
.bas # Microsoft Visual Basic class module
|
||||
.bat # Batch file
|
||||
.cab # Windows setup file
|
||||
.chm # Compiled HTML Help file
|
||||
.cmd # Microsoft Windows NT Command script
|
||||
.com # Microsoft MS-DOS program
|
||||
.cpl # Control Panel extension
|
||||
.crt # Security certificate
|
||||
.dll # Windows system file
|
||||
.exe # Program
|
||||
.hlp # Help file
|
||||
.ini # Windows system file
|
||||
.hta # HTML program
|
||||
.inf # Setup Information
|
||||
.ins # Internet Naming Service
|
||||
.isp # Internet Communication settings
|
||||
# .js # JScript file - often needed in web pages
|
||||
# .jse # Jscript Encoded Script file - often needed in web pages
|
||||
.lnk # Windows Shortcut
|
||||
.mda # Microsoft Access add-in program
|
||||
.mdb # Microsoft Access program
|
||||
.mde # Microsoft Access MDE database
|
||||
.mdt # Microsoft Access workgroup information
|
||||
.mdw # Microsoft Access workgroup information
|
||||
.mdz # Microsoft Access wizard program
|
||||
.msc # Microsoft Common Console document
|
||||
.msi # Microsoft Windows Installer package
|
||||
.msp # Microsoft Windows Installer patch
|
||||
.mst # Microsoft Visual Test source files
|
||||
.pcd # Photo CD image, Microsoft Visual compiled script
|
||||
.pif # Shortcut to MS-DOS program
|
||||
.prf # Microsoft Outlook profile settings
|
||||
.reg # Windows registry entries
|
||||
.scf # Windows Explorer command
|
||||
.scr # Screen saver
|
||||
.sct # Windows Script Component
|
||||
.sh # Shell script
|
||||
.shs # Shell Scrap object
|
||||
.shb # Shell Scrap object
|
||||
.sys # Windows system file
|
||||
.url # Internet shortcut
|
||||
.vb # VBScript file
|
||||
.vbe # VBScript Encoded script file
|
||||
.vbs # VBScript file
|
||||
.vxd # Windows system file
|
||||
.wsc # Windows Script Component
|
||||
.wsf # Windows Script file
|
||||
.wsh # Windows Script Host Settings file
|
||||
.otf # Font file - can be used to instant reboot 2k and xp
|
||||
.ops # Office XP settings
|
||||
|
||||
|
||||
|
||||
# Files which one normally things as non-executable but
|
||||
# can contain harmful macros and viruses
|
||||
|
||||
.doc # Word document
|
||||
.xls # Excel document
|
||||
.pps
|
||||
|
||||
|
||||
# Other files which may contain files with executable code
|
||||
|
||||
.gz # Gziped file
|
||||
.tar # Tape ARchive file
|
||||
.zip # Windows compressed file
|
||||
.tgz # Unix compressed file
|
||||
.bz2 # Unix compressed file
|
||||
.cdr # Mac disk image
|
||||
.dmg # Mac disk image
|
||||
.smi # Mac self mounting disk image
|
||||
.sit # Mac compressed file
|
||||
.sea # Mac compressed file, self extracting
|
||||
.bin # Mac binary compressed file
|
||||
.hqx # Mac binhex encoded file
|
||||
.rar # Similar to zip
|
||||
|
||||
|
||||
# Time/bandwidth wasting files
|
||||
|
||||
.mp3 # Music file
|
||||
.mpeg # Movie file
|
||||
.mpg # Movie file
|
||||
.avi # Movie file
|
||||
.asf # this can also exploit a security hole allowing virus infection
|
||||
.iso # CD ISO image
|
||||
.ogg # Music file
|
||||
.wmf # Movie file
|
||||
.bin # CD ISO image
|
||||
.cue # CD ISO image
|
||||
|
||||
# Banned Media extension list (Audio , Video , Streaming)
|
||||
# Arrange Alphabetically
|
||||
# Some have no Description
|
||||
#.3g2 #
|
||||
#.3gp # Nokia Movie File
|
||||
#.3gp2
|
||||
#.3gpp
|
||||
#.3gpp2
|
||||
#.aac # AAC Audio
|
||||
#.acp # AAC for SD Media
|
||||
#.adts
|
||||
#.aif
|
||||
#.aifc
|
||||
#.aiff # AIFF Audio
|
||||
#.amc # AMC Media
|
||||
#.amr # narrow-Band Content
|
||||
#.asf # Media / this can also exploit a security hole allowing virus infection
|
||||
#.asx # Windows Media Audio / Video
|
||||
#.au # uLaw/AU Audio
|
||||
#.avi # Movie file
|
||||
#.awb # AMR Wide-Band Content
|
||||
#.bwf
|
||||
#.caf # CAF Audio
|
||||
#.cda # Audio CD File
|
||||
#.cdda # Audio CD File
|
||||
#.cel
|
||||
#.cue # CD ISO image
|
||||
#.dif
|
||||
#.divx # Compress Movie
|
||||
#.dv # Video Format used in Portable Camera
|
||||
#.flc # Autodesk Animator
|
||||
#.fli
|
||||
#.flv # Internet Movies
|
||||
#.gsm
|
||||
#.ivf
|
||||
#.kar # Karaoke Media Files
|
||||
#.m15
|
||||
#.m1a
|
||||
#.m1s
|
||||
#.m1v
|
||||
#.m2v
|
||||
#.m3u # MP3 Playlist
|
||||
#.m4a # AAC Audio
|
||||
#.m4b
|
||||
#.m4e
|
||||
#.m4p # AAC Audio (Protected)
|
||||
#.m4v # Video (Protected)
|
||||
#.m75
|
||||
#.mid # Midi Audio Files
|
||||
#.midi # Midi Audio Files
|
||||
#.mjpg
|
||||
#.mov # Movie Files
|
||||
#.mp1
|
||||
#.mp2
|
||||
#.mp3 # Music file
|
||||
#.mp4 # Mpeg-4 Media
|
||||
#.mpa
|
||||
#.mpe
|
||||
#.mpeg # Movie file
|
||||
#.mpg # Movie file
|
||||
#.mpga
|
||||
#.mpm
|
||||
#.mps
|
||||
#.mpv
|
||||
#.mpv2
|
||||
#.mqv # Quicktime Movies
|
||||
#.mv
|
||||
#.ogg # Music file
|
||||
#.ogm # Ogg Based Movie Files
|
||||
#.pls # Shoutcast type of radio
|
||||
#.qcp # Qualcomm Purevoice Audio
|
||||
#.qt # Quicktime File
|
||||
#.qtc
|
||||
#.qtl # Quicktime Movies
|
||||
#.ra # Real Audio
|
||||
#.ram # Real Audio Media
|
||||
#.rm # Real Media Files
|
||||
#.rmi
|
||||
#.rmm
|
||||
#.rmp
|
||||
#.rmvb # Real Media Video
|
||||
#.rnx
|
||||
#.rp # Real Player Files
|
||||
#.rt
|
||||
#.rts
|
||||
#.rtsp
|
||||
#.rv
|
||||
#.sd2 # Sound Designer II
|
||||
#.sdp # Stream Descriptor
|
||||
#.sdv # SD Video
|
||||
#.sf
|
||||
#.smf
|
||||
#.smi #
|
||||
#.smil # SMIL Multimedia Presentation (Video and Audio Presentation
|
||||
#.snd
|
||||
#.ssm # Streaming Media Metafile
|
||||
#.swa # MP3 Audio
|
||||
#.swf # Shockwave Streaming files
|
||||
#.ulw
|
||||
#.vfw # Video for Windows
|
||||
#.wav
|
||||
#.wax
|
||||
#.wm
|
||||
#.wma
|
||||
#.wmf # Movie file
|
||||
#.wmp
|
||||
#.wmv # Windows Media Video
|
||||
#.wmx
|
||||
#.wvx
|
||||
#.xpl
|
||||
18
docker-compose/e2guardian/lists/example.group/bannedmimetypelist
Executable file
18
docker-compose/e2guardian/lists/example.group/bannedmimetypelist
Executable file
@ -0,0 +1,18 @@
|
||||
# banned MIME types
|
||||
|
||||
audio/mpeg
|
||||
audio/x-mpeg
|
||||
audio/x-pn-realaudio
|
||||
audio/x-wav
|
||||
video/mpeg
|
||||
video/x-mpeg2
|
||||
video/acorn-replay
|
||||
video/quicktime
|
||||
video/x-msvideo
|
||||
video/msvideo
|
||||
application/gzip
|
||||
application/x-gzip
|
||||
application/zip
|
||||
application/compress
|
||||
application/x-compress
|
||||
application/java-vm
|
||||
@ -0,0 +1,47 @@
|
||||
# BANNEDPHRASELIST - INSTRUCTIONS FOR USE
|
||||
#
|
||||
# To block any page with the word "sex".
|
||||
# < sex >
|
||||
#
|
||||
# To block any page with words that contain the string "sex". (ie. sexual)
|
||||
# <sex>
|
||||
#
|
||||
# To block any page with the string "sex magazine".
|
||||
# <sex magazine>
|
||||
#
|
||||
# To block any page containing the words/strings "sex" and "fetish".
|
||||
# <sex>,<fetish>
|
||||
#
|
||||
# < test> will match any word with the string 'test' at the beginning
|
||||
# <test > will match any word with the string 'test' at the end
|
||||
# <test> will match any word with the string 'test' at any point in the word
|
||||
# < test > will match only the word 'test'
|
||||
# <this is a test phrase> will match that exact phrase
|
||||
# <test>,<secondtest> will match if both words are found in the page
|
||||
# A combination of the above can also be used eg < test>,<secondtest>
|
||||
#
|
||||
# All phrases need to be within < and > to work, othewise they will be
|
||||
# ignored.
|
||||
|
||||
# Note: Use these sparingly - banned phrases tend to overblock
|
||||
|
||||
|
||||
#listcategory: "Banned Phrases"
|
||||
|
||||
|
||||
# The following banned phraselists are included in the default e2g distribution.
|
||||
|
||||
.Include</etc/e2guardian/lists/phraselists/ukenglish/pornography/banned>
|
||||
|
||||
#.Include</etc/e2guardian/lists/phraselists/ukenglish/gambling/banned>
|
||||
#.Include</etc/e2guardian/lists/phraselists/ukenglish/badwords/banned>
|
||||
|
||||
#.Include</etc/e2guardian/lists/phraselists/portuguese/gambling/banned>
|
||||
#.Include</etc/e2guardian/lists/phraselists/portuguese/intolerance/banned>
|
||||
#.Include</etc/e2guardian/lists/phraselists/portuguese/personals/banned>
|
||||
|
||||
#.Include</etc/e2guardian/lists/phraselists/ukenglish/gambling/banned>
|
||||
#.Include</etc/e2guardian/lists/phraselists/portuguese/gambling/banned>
|
||||
|
||||
|
||||
|
||||
9
docker-compose/e2guardian/lists/example.group/bannedregexpheaderlist
Executable file
9
docker-compose/e2guardian/lists/example.group/bannedregexpheaderlist
Executable file
@ -0,0 +1,9 @@
|
||||
#Banned outgoing HTTP headers based on regular expressions
|
||||
#
|
||||
# E.g. 'User-Agent: .*MSIE' would block several versions of Internet Explorer
|
||||
# (assuming the user-agent is not being spoofed by the client)
|
||||
#
|
||||
# Headers are matched line-by-line, not as a single block.
|
||||
|
||||
#listcategory: "Banned Regular Expression HTTP Headers"
|
||||
|
||||
122
docker-compose/e2guardian/lists/example.group/bannedregexpurllist
Executable file
122
docker-compose/e2guardian/lists/example.group/bannedregexpurllist
Executable file
@ -0,0 +1,122 @@
|
||||
#Banned URLs based on Regular Expressions
|
||||
#
|
||||
# E.g. 'sex' would block sex.com and middlesex.com etc
|
||||
|
||||
#listcategory: "Banned Regular Expression URLs"
|
||||
|
||||
#Banned URLs based on Regular Expressions
|
||||
|
||||
#These examples should be used with extreme caution
|
||||
# as most regexp url patterns tend to overblock
|
||||
# Be as specific as possible as this helps avoid this
|
||||
|
||||
######################################################
|
||||
# Pornography, Modelling and Adult Sites
|
||||
######################################################
|
||||
|
||||
#\b(big|cyber|hard|huge|mega|small|soft|super|tiny|bare|naked|nude|anal|oral|topp?les|sex|phone)+\b.*\b(anal|babe|bharath|boob|breast|busen|busty|clit|cum|cunt|dick|fetish|fuck|girl|hooter|lez|lust|naked|nude|oral|orgy|penis|porn|porno|pupper|pussy|rotten|sex|shit|smutpump|teen|tit|topp?les|xxx)s\b?
|
||||
#\b(anal|babe|bharath|boob|breast|busen|busty|clit|cum|cunt|dick|fetish|fuck|girl|hooter|lez|lust|naked|nude|oral|orgy|penis|porn|porno|pupper|pussy|rotten|sex|shit|smutpump|teen|tit|topp?les|xxx)+\b.*\b(big|cyber|hard|huge|mega|small|soft|super|tiny|bare|naked|nude|anal|oral|topp?les|sex)\b+
|
||||
|
||||
#HardCore phrases
|
||||
#(adultsight|adultsite|adultsonly|adultweb|blowjob|bondage|centerfold|cumshot|cyberlust|cybercore|hardcore|masturbat)
|
||||
#(bangbros|pussylip|playmate|pornstar|sexdream|showgirl|softcore|striptease)
|
||||
|
||||
#SoftCore phrases - more likely to overblock - possibly on news sites
|
||||
#(incest|obscene|pedophil|pedofil)
|
||||
|
||||
#Photo Modeling - supplied by David Burkholder
|
||||
#(male|m[ae]n|boy|girl|beaut|agen[ct]|glam)+.*(model|talent)
|
||||
|
||||
# The following will help to block explicit media files (images and video)
|
||||
#(sex|fuck|boob|cunt|fetish|tits|anal|hooter|asses|shemale|submission|porn|xxx|busty|knockers|slut|nude|naked|pussy)+.*(\.jpg|\.wmv|\.mpg|\.mpeg|\.gif|\.mov)
|
||||
#(girls|babes|bikini|model)+.*(\.jpg|\.wmv|\.mpg|\.mpeg|\.gif|\.mov)
|
||||
|
||||
#Block Naturism and Nudist sites
|
||||
#(naturism|naturist|nude|nudist|nudism|nekkid|nakt|naakt)
|
||||
|
||||
|
||||
######################################################
|
||||
# Search Engine and Related
|
||||
######################################################
|
||||
|
||||
#Block unfiltered options on various search engines
|
||||
#(^|[\?+=&/])(.*\.google\..*/.*\?.*safe=off)([\?+=&/]|$)
|
||||
#(^|[\?+=&/])(.*\.alltheweb.com/customize\?.*copt_offensive=off)([\?+=&/]|$)
|
||||
|
||||
#Block images and video on altavista, alltheweb, yahoo etc - as they are anonomised
|
||||
#(yahoo.com\/image\/)
|
||||
#(yimg.com\/image\/)
|
||||
#(altavista.com\/image\/)
|
||||
#(altavista.com\/video\/)
|
||||
#(picsearch.com\/is)
|
||||
|
||||
#Block images and video on google
|
||||
#(images.google)+.*(\.jpg|\.wmv|\.mpg|\.mpeg|\.gif|\.mov)
|
||||
#(google.com\/video) #block all video
|
||||
#(google.com\/ThumbnailServer) #block video thumbnails
|
||||
#(google.com\/videoplay) #block only playing the video
|
||||
|
||||
|
||||
######################################################
|
||||
# Proxy Sites
|
||||
######################################################
|
||||
|
||||
#Block Cgiproxy, Poxy, PHProxy and other Web-based proxies
|
||||
#(cecid.php|nph-webpr|nph-pro|/dmirror|cgiproxy|phpwebproxy|__proxy_url|proxy.php)
|
||||
|
||||
#Block websites containing proxy lists
|
||||
#(anonymizer|proxify|megaproxy)
|
||||
|
||||
#AGRESSIVE blocking of all URLs containing proxy - WARNING - this WILL overblock!!
|
||||
#(proxy)
|
||||
|
||||
|
||||
######################################################
|
||||
# Gambling - supplied by David Burkholder
|
||||
######################################################
|
||||
#(casino|bet(ting|s)|lott(ery|o)|gam(e[rs]|ing|bl(e|ing))|sweepstake|poker)
|
||||
|
||||
|
||||
######################################################
|
||||
# Sport - supplied by David Burkholder
|
||||
######################################################
|
||||
#(bowling|badminton|box(e[dr]|ing)|skat(e[rs]|ing)|hockey|soccer|nascar|wrest|rugby|tennis|sports|cheerlead|rodeo|cricket|badminton|stadium|derby)
|
||||
#((paint|volley|bas(e|ket)|foot|quet)ball|/players[/\.]?|(carn|fest)ival)
|
||||
|
||||
#Racing - supplied by David Burkholder
|
||||
#(speed(st|wa|y)|corvette|rac[eiy]|wrest|harley|motorcycle|nascar)
|
||||
|
||||
|
||||
######################################################
|
||||
# News sites - supplied by David Burkholder
|
||||
######################################################
|
||||
#(news(watch|pap|cast)|herald|sentinel|courier|gazet|tribune|chronicle|daily|ning)news)
|
||||
|
||||
|
||||
######################################################
|
||||
# Dating Sites - supplied by David Burkholder
|
||||
######################################################
|
||||
#(meet|hook|mailord|latin|(asi|mexic|dominic|russi|kore|colombi|balk)an|brazil|filip|french|chinese|ukrain|thai|tour|foreign|date)+.*(dar?[lt]ing|(sing|coup)le|m[ae]n|girl|boy|guy|mat(e|ing)|l[ou]ve?|partner|meet)
|
||||
#(marr(y|i[ae])|roman(ce|tic)|fiance|bachelo|dating|affair|personals)
|
||||
|
||||
|
||||
######################################################
|
||||
# Miscellaneous - Productivity etc.
|
||||
######################################################
|
||||
|
||||
#Use this to block web counters:
|
||||
#(adlog.php|cnt.cgi|count.cgi|count.dat|count.jsp|count.pl|count.php|counter.cgi|counter.js|counter.pl|countlink.cgi|fpcount.exe|logitpro.cgi|rcounter.dll|track.pl|w_counter.js)
|
||||
#Contributed by proxy@barendse.to
|
||||
|
||||
#Free stuff - supplied by David Burkholder
|
||||
#(free|phone|mobile)+.*(love|music|movie|dvd|video|stuff|site|arcade|wallpaper|mp3)
|
||||
#((ring|real)tone)
|
||||
|
||||
#Music - supplied by David Burkholder
|
||||
#(rock|pop|jazz|rap|punk)+.*(cult|roll|geek|drum|music|history|band)
|
||||
|
||||
# WARNING: This is part of the URL for the e2guardian.org sample virus archive.
|
||||
# You probably don't want to go there unintentionally.
|
||||
(Variants/AVTest)
|
||||
|
||||
|
||||
12
docker-compose/e2guardian/lists/example.group/bannedregexpuseragentlist
Executable file
12
docker-compose/e2guardian/lists/example.group/bannedregexpuseragentlist
Executable file
@ -0,0 +1,12 @@
|
||||
#Banned User-Agents based on regular expressions
|
||||
#
|
||||
# E.g. ' .*MSIE' would block several versions of Internet Explorer
|
||||
# (assuming the user-agent is not being spoofed by the client)
|
||||
#
|
||||
#listcategory: "user-agent"
|
||||
#
|
||||
# This is useful for blocking apps
|
||||
# e.g. to block Kindle app
|
||||
#kindle
|
||||
#Kindle
|
||||
|
||||
@ -0,0 +1,9 @@
|
||||
#Banned Search Words
|
||||
#
|
||||
#Words must be in alphabetic order within a single line
|
||||
# and separated by a '+' sign.
|
||||
#All combinations of the words will be blocked
|
||||
# e.g. girl+naughty
|
||||
# will block naughty+girl as well as girl+naughty
|
||||
|
||||
|
||||
12
docker-compose/e2guardian/lists/example.group/bannedsiteiplist
Executable file
12
docker-compose/e2guardian/lists/example.group/bannedsiteiplist
Executable file
@ -0,0 +1,12 @@
|
||||
# IP sites in banned list
|
||||
|
||||
#The bannedsiteiplist is for blocking ALL of an IP site
|
||||
|
||||
# IP site addresses
|
||||
#
|
||||
# Single IPs, ranges and subnets can be used,
|
||||
# e.g.
|
||||
# 192.168.0.1
|
||||
# 10.0.0.1-10.0.0.3
|
||||
# 10.0.0.0/24
|
||||
#
|
||||
97
docker-compose/e2guardian/lists/example.group/bannedsitelist
Normal file
97
docker-compose/e2guardian/lists/example.group/bannedsitelist
Normal file
@ -0,0 +1,97 @@
|
||||
#domains in banned list
|
||||
#Don't bother with the www. or the http://
|
||||
|
||||
#The bannedurllist is for blocking PART of a site
|
||||
#The bannedsitelist is for blocking ALL of a site
|
||||
|
||||
#NOTE: Sites using just IP should be put into bannedsiteiplist
|
||||
|
||||
#You can include
|
||||
#.tld so for example you can match .gov for example
|
||||
|
||||
#The 'grey' lists override the 'banned' lists.
|
||||
#The 'exception' lists override the 'banned' lists also.
|
||||
#The difference is that the 'exception' lists completely switch
|
||||
#off *all* other filtering for the match. 'grey' lists only
|
||||
#stop the URL filtering and allow the normal filtering to work.
|
||||
|
||||
#An example of grey list use is when in Blanket Block (whitelist)
|
||||
#mode and you want to allow some sites but still filter as normal
|
||||
#on their content
|
||||
|
||||
#Another example of grey list use is when you ban a site but want
|
||||
#to allow part of it.
|
||||
|
||||
#To include additional files in this list use this example:
|
||||
#.Include</etc/e2guardian/anotherbannedurllist>
|
||||
|
||||
#You can have multiple .Includes.
|
||||
|
||||
# Time limiting syntax:
|
||||
# #time: <start hour> <start minute> <end hour> <end minute> <days>
|
||||
# Example:
|
||||
##time: 9 0 17 0 01234
|
||||
# Remove the first # from the line above to enable this list only from
|
||||
# 9am to 5pm, Monday to Friday.
|
||||
|
||||
# List categorisation
|
||||
#listcategory: "Banned Sites"
|
||||
|
||||
#List other sites to block:
|
||||
|
||||
# badboys.com
|
||||
|
||||
# NOTE: From v5 Blanket blocks are now implimented using Storyboarding
|
||||
# WARNING: Old style Blanket blocks in this file will be silently ignored
|
||||
|
||||
|
||||
# The squidGuard advert domain/URL lists are now included by default.
|
||||
# To work with advanced ad blocking & the logadblocks option, advert
|
||||
# phrase/site/URL lists should have the string "ADs" in their listcategory.
|
||||
# .Include</etc/e2guardian/lists/blacklists/ads/domains>
|
||||
|
||||
#Remove the # from the following and edit as needed to use a stock
|
||||
#squidGuard/urlblacklists collection.
|
||||
#.Include</etc/e2guardian/lists/blacklists/adult/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/aggressive/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/artnudes/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/audio-video/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/beerliquorinfo/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/beerliquorsale/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/chat/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/childcare/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/clothing/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/culinary/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/dialers/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/drugs/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/entertainment/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/forums/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/frencheducation/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/gambling/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/government/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/hacking/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/homerepair/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/hygiene/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/jewelry/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/jobsearch/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/kidstimewasting/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/mail/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/news/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/onlineauctions/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/onlinegames/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/onlinepayment/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/personalfinance/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/pets/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/porn/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/proxy/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/publicite/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/redirector/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/ringtones/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/sportnews/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/sports/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/vacation/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/violence/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/virusinfected/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/warez/domains>
|
||||
|
||||
# You will need to edit to add and remove categories you want
|
||||
@ -0,0 +1,15 @@
|
||||
#IP sites in banned ssl list
|
||||
#This list is only used for SSL (or CONNECT) requests
|
||||
#Unlike the bannedsitelist it overides all other lists
|
||||
# so can be used ban an https site white the http is allowed or made an exception
|
||||
#
|
||||
#Only list sites where you only want the https site blocked
|
||||
#Use bannedsiteiplist for sites where you want both http & https blocked
|
||||
# IP site addresses
|
||||
#
|
||||
# Single IPs, ranges and subnets can be used,
|
||||
# e.g.
|
||||
# 192.168.0.1
|
||||
# 10.0.0.1-10.0.0.3
|
||||
# 10.0.0.0/24
|
||||
#
|
||||
@ -0,0 +1,9 @@
|
||||
#domains in banned ssl list
|
||||
#Don't bother with the www. or the https://
|
||||
#This list is only used for SSL (or CONNECT) requests
|
||||
# and will not have any effect when MITM is enabled.
|
||||
#Unlike the bannedsitelist it overides all other lists
|
||||
# so can be used ban an https site white the http is allowed or made an exception
|
||||
#
|
||||
#Only list sites where you only want the https site blocked
|
||||
#Use bannedsitelist for sites where you want both http & https blocked
|
||||
13
docker-compose/e2guardian/lists/example.group/bannedtimelist
Normal file
13
docker-compose/e2guardian/lists/example.group/bannedtimelist
Normal file
@ -0,0 +1,13 @@
|
||||
#timebands when internet blocked
|
||||
|
||||
#You can have multiple .Includes.
|
||||
|
||||
# Tiime banding syntax:
|
||||
# <start hour> <start minute> <end hour> <end minute> <days>
|
||||
# Note figures are 0 based - hours (0-23) mins (0-59) days (0-6)
|
||||
# Example:
|
||||
# 22 0 23 59 01234
|
||||
# 0 0 07 0 01234
|
||||
|
||||
# Uncomment the lines above to block access from
|
||||
# 0am to 5am and 10pm to 11:59pm, Monday to Friday.
|
||||
59
docker-compose/e2guardian/lists/example.group/bannedurllist
Normal file
59
docker-compose/e2guardian/lists/example.group/bannedurllist
Normal file
@ -0,0 +1,59 @@
|
||||
#URLs in banned list
|
||||
#Don't bother with the http:// or the www
|
||||
|
||||
#The bannedurllist is for blocking PART of a site
|
||||
#The bannedsitelist is for blocking ALL of a site
|
||||
|
||||
#The 'grey' lists override the 'banned' lists.
|
||||
#The 'exception' lists override the 'banned' lists also.
|
||||
#The difference is that the 'exception' lists completely switch
|
||||
#off *all* other filtering for the match. 'grey' lists only
|
||||
#stop the URL filtering and allow the normal filtering to work.
|
||||
|
||||
#An example of grey list use is when in Blanket Block (whitelist)
|
||||
#mode and you want to allow some sites but still filter as normal
|
||||
#on their content
|
||||
|
||||
#Another example of grey list use is when you ban a site but want
|
||||
#to allow part of it.
|
||||
|
||||
#To include additional files in this list use this example:
|
||||
#.Include</etc/e2guardian/anotherbannedurllist>
|
||||
|
||||
#You can have multiple .Includes.
|
||||
|
||||
#listcategory: "Banned URLs"
|
||||
|
||||
#List other URLs to block:
|
||||
|
||||
# members.home.net/uporn
|
||||
|
||||
# The squidGuard advert domain/URL lists are now included by default.
|
||||
# To work with advanced ad blocking & the logadblocks option, advert
|
||||
# phrase/site/URL lists should have the string "ADs" in their listcategory.
|
||||
#.Include</etc/e2guardian/lists/blacklists/ads/urls>
|
||||
|
||||
#Remove the # from the following and edit as needed to use a stock
|
||||
#squidGuard/urlblacklist blacklists collection.
|
||||
#.Include</etc/e2guardian/lists/blacklists/adult/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/aggressive/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/audio-video/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/chat/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/drugs/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/entertainment/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/frencheducation/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/gambling/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/government/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/hacking/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/jobsearch/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/kidstimewasting/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/mail/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/news/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/porn/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/proxy/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/publicite/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/redirector/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/violence/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/virusinfected/urls>
|
||||
#.Include</etc/e2guardian/lists/blacklists/warez/urls>
|
||||
# You will need to edit to add and remove categories you want
|
||||
@ -0,0 +1,16 @@
|
||||
#timebands when blanket block is applied
|
||||
# (only exception sites will be allowed)
|
||||
# To enable this list edit e2guardianfn.conf and filter group i
|
||||
# storyboard fn.story - see examplef1.story
|
||||
|
||||
#You can have multiple .Includes.
|
||||
|
||||
# Tiime banding syntax:
|
||||
# <start hour> <start minute> <end hour> <end minute> <days>
|
||||
# Note figures are 0 based - hours (0-23) mins (0-59) days (0-6)
|
||||
# Example:
|
||||
# 22 0 23 59 01234
|
||||
# 0 0 07 0 01234
|
||||
|
||||
# Uncomment the lines above to blanket block from
|
||||
# 0am to 5am and 10pm to 11:59pm, Monday to Friday.
|
||||
93
docker-compose/e2guardian/lists/example.group/contentregexplist
Executable file
93
docker-compose/e2guardian/lists/example.group/contentregexplist
Executable file
@ -0,0 +1,93 @@
|
||||
#Content modifying Regular Expressions
|
||||
#
|
||||
# The format is: "extended regular expression"->"replacement straight string"
|
||||
# E.g. "shit"->"censored" would replace all occurances of shit in any case.
|
||||
# Far more complicated matches are possible. See other sources for examples
|
||||
# of extended regular expressions.
|
||||
|
||||
# These are just some examples. If you write any, for example, to
|
||||
# remove popups etc, please send them to author at e2guardian.org.
|
||||
#
|
||||
#"<script language.*open\(.*script>"->"<!-- its gone -->"
|
||||
#"fuck|cunt|shit"->"**censored**"
|
||||
#
|
||||
# For ALL of these to work it requires e2guardian to be built with PCRE support,
|
||||
# but some may work with the default C library regular expression support.
|
||||
#
|
||||
# Some of these are based on regular expressions from Privoxy.
|
||||
|
||||
#remove popups by AFN 2004/2/28
|
||||
#"<html>"->"<script language='javascript'>fwo=window.open;function NO(url,nam,atr){return(this.window);}window.open=NO;</script><html>"
|
||||
#"=[ ]*?window\.open[ ]*?\("->"=fwo("
|
||||
#"<html>"->"<script language='javascript'>function NO(url,nam,atr){return(this.window);}window.open=NO;</script><html>"
|
||||
|
||||
# Fix Firefox <= 1.0.7 DoS
|
||||
# http://www.whitedust.net/speaks/1432/
|
||||
#"((<source)|(</source))text>"->"$1dosremovedtext"
|
||||
|
||||
# Disable ActiveX objects.
|
||||
#"<object [^>]*application\/x-oleobject[^>]*>.*?<\/object>"->"<!-- Guardian Removed ActiveX Object -->"
|
||||
#"<embed [^>]*(application/x-oleobject).*?>(.*?</embed>)?"->"<!-- Guardian Removed ActiveX Embed -->"
|
||||
|
||||
# Warn about address bar spoofing.
|
||||
#"(<a[^>]*href[^>]*)(\x01|\x02|\x03|%0[012])"->"$1MALICIOUS-LINK"
|
||||
|
||||
# Disable all popups in JavaScript and HTML. It may cause unavoidable
|
||||
# Javascript warnings or errors. Do not enable at the same time as other
|
||||
# popup removing lines.
|
||||
#"((\W\s*)(window|this|parent)\.)open\s*\\?\("->"$1concat("
|
||||
#"\starget\s*=\s*(['"]?)_?(blank|new)\1?"->" notarget"
|
||||
|
||||
# Removes the APPLET tag which is generally used Java applets.
|
||||
#"<applet[^>]*>.*?<\/applet>"->""
|
||||
|
||||
# Disable the BLINK and MARQUEE tags.
|
||||
#"</?(blink|marquee)[^>]*>"->""
|
||||
|
||||
# Warn about potential cross-site-scripting vulnerability described here:
|
||||
# http://online.securityfocus.com/archive/1/298748/2002-11-02/2002-11-08/2
|
||||
#"f\("javascript:location.replace\('mk:@MSITStore:C:'\)"\);"->"alert\("This page looks like it tries to use a vulnerability described here:\n http://online.securityfocus.com/archive/1/298748/2002-11-02/2002-11-08/2"\);"
|
||||
|
||||
# Removes the SCRIPT tag with JavaScript. This will likely break sites that are
|
||||
# badly written and thus rely on JavaScript. This should not be used at the same
|
||||
# time as the 'script' category.
|
||||
#"<script [^>]*javascript[^>]*>.*?<\/script>"->""
|
||||
|
||||
# Removes href=javascript: onmouseover=javascript: and other javascript actions.
|
||||
# This is a good category to tick if using 'script' or 'javascript' categories.
|
||||
# Beware that there are likely going to be a large number of matches and will
|
||||
# require more CPU. Also this will break badly written sites that require
|
||||
# JavaScript for navigation.
|
||||
#"(onclick|ondblclick|onmousedown|onmouseup|onmouseover|onmousemove|onmouseout|onkeypress|onkeydown|onkeyup|href)(=("|')?)javascript:"->"guardianremoved$2none:"
|
||||
|
||||
# Remove cookies set by JavaScript and HTML.
|
||||
#"(\w+\.)+cookie(?=[ \t\r\n]*=)(?!='aab)"->"GuardianRemovedCookie"
|
||||
#"<meta\s+http-equiv=['"]?set-cookie.*>"->"<!-- GuardianRemovedCookie -->"
|
||||
|
||||
# Attempt to detect and stop Nimda infected servers's web pages. This is rare
|
||||
# and generally should be left unused.
|
||||
#"<script language="JavaScript">(window\.open|1;''\.concat)\("readme\.eml", null, "resizable=no,top=6000,left=6000"\)</script>"->"<br><font size="7"> WARNING: This Server is infected with <a href="http://www.cert.org/advisories/CA-2001-26.html">Nimda</a>!</font>"
|
||||
|
||||
# Disable onunload (page close) popups.
|
||||
#"(<body\s+[^>]*)onunload"->"$1never"
|
||||
#"(<script.*)window\.onunload(?=.*</script>)"->"$1never"
|
||||
|
||||
# Removes the SCRIPT tag which could include JavaScript, perlscript and vbscript.
|
||||
# This will likely break sites that are badly written and thus rely on client
|
||||
# side scripts. This should not be used at the same time as the 'javascript' line.
|
||||
#"<script[^>]*>.*?<\/script>"->""
|
||||
|
||||
# Disable Sockwave Flash objects.
|
||||
#"<object [^>]*macromedia[^>]*>.*?<\/object>"->"<!-- Guardian Removed Shockwave Object -->"
|
||||
#"<embed [^>]*(application/x-shockwave-flash\|\.swf).*?>(.*?</embed>)?"->"<!-- Guardian Removed Shockwave Flash Embed -->"
|
||||
|
||||
# Disable unsolicited popups.
|
||||
#"([^'"]\s*<head.*>)(?=\s*[^'"])"->"$1<script>function SWGuardianWindowOpen(){return(null);}</script>"
|
||||
#"([^\w\s.]\s*)((window|this|parent)\.)?open\s*\("->"$1SWGuardianWindowOpen("
|
||||
#"([^'"]\s*</html>)(?!\s*(\\n|'|"))"->"$1<script>function PrivoxyWindowOpen(a, b, c){return(window.open(a, b, c));}</script>"
|
||||
|
||||
# Remove 1x1 GIFs used for user tracking.
|
||||
#"<img\s+[^>]*(?:(width)|(height))\s*=\s*['"]?[01](?=\D)[^>]*(?:(width)|(height))\s*=\s*['"]?[01](?=\D)[^>]*?>"->""
|
||||
|
||||
# Prevent windows from resizing and moving themselves.
|
||||
#"(?:window|this|self|top)\.(?:move|resize)(?:to|by)\("->"''.concat("
|
||||
@ -0,0 +1,63 @@
|
||||
# User are not allowed to bypass domains in this list
|
||||
|
||||
#Don't bother with the www. or the http://
|
||||
|
||||
#NOTE: Sites using just IP should be put into bannedsiteiplistwithbypass
|
||||
|
||||
#You can include
|
||||
#.tld so for example you can match .gov for example
|
||||
|
||||
#.Include</etc/e2guardian/anotherbannedurllist>
|
||||
|
||||
#You can have multiple .Includes.
|
||||
|
||||
# WARNING: Old style Blanket blocks in this file will be silently ignored
|
||||
|
||||
|
||||
# .Include</etc/e2guardian/lists/blacklists/ads/domains>
|
||||
|
||||
#Remove the # from the following and edit as needed to use a stock
|
||||
#squidGuard/urlblacklists collection.
|
||||
#.Include</etc/e2guardian/lists/blacklists/adult/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/aggressive/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/artnudes/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/audio-video/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/beerliquorinfo/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/beerliquorsale/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/chat/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/childcare/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/clothing/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/culinary/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/dialers/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/drugs/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/entertainment/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/forums/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/frencheducation/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/gambling/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/government/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/hacking/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/homerepair/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/hygiene/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/jewelry/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/jobsearch/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/kidstimewasting/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/mail/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/news/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/onlineauctions/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/onlinegames/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/onlinepayment/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/personalfinance/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/pets/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/porn/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/proxy/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/publicite/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/redirector/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/ringtones/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/sportnews/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/sports/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/vacation/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/violence/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/virusinfected/domains>
|
||||
#.Include</etc/e2guardian/lists/blacklists/warez/domains>
|
||||
|
||||
# You will need to edit to add and remove categories you want
|
||||
49
docker-compose/e2guardian/lists/example.group/exceptionextensionlist
Executable file
49
docker-compose/e2guardian/lists/example.group/exceptionextensionlist
Executable file
@ -0,0 +1,49 @@
|
||||
# Exception file extension list
|
||||
# Use as a filter group's "exceptionextensionlist",
|
||||
# to override a blanket download block.
|
||||
# (blockdownloads = on)
|
||||
#
|
||||
# DOES NOT override content/virus scanning or site/URL bans.
|
||||
#
|
||||
# Default list:
|
||||
# Unblock web pages & graphics
|
||||
|
||||
# Text/web document types
|
||||
|
||||
.css
|
||||
.html
|
||||
.shtml
|
||||
.htm
|
||||
.stm
|
||||
.asp
|
||||
.php
|
||||
.txt
|
||||
.rtx
|
||||
.xml
|
||||
.xsl
|
||||
.cgi
|
||||
.pl
|
||||
|
||||
# Image types
|
||||
|
||||
.bmp
|
||||
.cod
|
||||
.gif
|
||||
.ief
|
||||
.jpe
|
||||
.jpeg
|
||||
.jpg
|
||||
.jfif
|
||||
.tif
|
||||
.tiff
|
||||
.ras
|
||||
.cmx
|
||||
.ico
|
||||
.pnm
|
||||
.pbm
|
||||
.pgm
|
||||
.ppm
|
||||
.rgb
|
||||
.xbm
|
||||
.xpm
|
||||
.xwd
|
||||
15
docker-compose/e2guardian/lists/example.group/exceptionfilesiteiplist
Executable file
15
docker-compose/e2guardian/lists/example.group/exceptionfilesiteiplist
Executable file
@ -0,0 +1,15 @@
|
||||
# Exception file site ip list
|
||||
# Use this list to define ip sites from which files can be downloaded,
|
||||
# overriding a blanket download block (blockdownloads = on) or the
|
||||
# banned MIME type and extension lists (blockdownloads = off).
|
||||
#
|
||||
# DOES NOT override content/virus scanning or site/URL bans.
|
||||
|
||||
# IP site addresses
|
||||
#
|
||||
# Single IPs, ranges and subnets can be used,
|
||||
# e.g.
|
||||
# 192.168.0.1
|
||||
# 10.0.0.1-10.0.0.3
|
||||
# 10.0.0.0/24
|
||||
#
|
||||
30
docker-compose/e2guardian/lists/example.group/exceptionfilesitelist
Executable file
30
docker-compose/e2guardian/lists/example.group/exceptionfilesitelist
Executable file
@ -0,0 +1,30 @@
|
||||
# Exception file site list
|
||||
# Use this list to define sites from which files can be downloaded,
|
||||
# overriding a blanket download block (blockdownloads = on) or the
|
||||
# banned MIME type and extension lists (blockdownloads = off).
|
||||
#
|
||||
# DOES NOT override content/virus scanning or site/URL bans.
|
||||
|
||||
# Don't bother with the www. or
|
||||
# the http://
|
||||
#
|
||||
# These are specifically domains and are not URLs.
|
||||
# For example 'foo.bar/porn/' is no good, you need
|
||||
# to just have 'foo.bar'.
|
||||
#
|
||||
# You can also match IPs here too.
|
||||
#
|
||||
# As of DansGuardian 2.7.3 you can now include
|
||||
# .tld so for example you can match .gov for example
|
||||
|
||||
|
||||
# Time limiting syntax:
|
||||
# #time: <start hour> <start minute> <end hour> <end minute> <days>
|
||||
# Example:
|
||||
##time: 9 0 17 0 01234
|
||||
# Remove the first # from the line above to enable this list only from
|
||||
# 9am to 5pm, Monday to Friday.
|
||||
|
||||
windowsupdate.microsoft.com
|
||||
update.microsoft.com
|
||||
download.windowsupdate.com
|
||||
27
docker-compose/e2guardian/lists/example.group/exceptionfileurllist
Executable file
27
docker-compose/e2guardian/lists/example.group/exceptionfileurllist
Executable file
@ -0,0 +1,27 @@
|
||||
# Exception file URL list
|
||||
# Use this list to define URLs from which files can be downloaded,
|
||||
# overriding a blanket download block (blockdownloads = on) or the
|
||||
# banned MIME type and extension lists (blockdownloads = off).
|
||||
#
|
||||
# DOES NOT override content/virus scanning or site/URL bans.
|
||||
|
||||
# Don't bother with the www. or
|
||||
# the http://
|
||||
#
|
||||
# These are specifically domains and are not URLs.
|
||||
# For example 'foo.bar/porn/' is no good, you need
|
||||
# to just have 'foo.bar'.
|
||||
#
|
||||
# You can also match IPs here too.
|
||||
#
|
||||
# As of DansGuardian 2.7.3 you can now include
|
||||
# .tld so for example you can match .gov for example
|
||||
|
||||
|
||||
# Time limiting syntax:
|
||||
# #time: <start hour> <start minute> <end hour> <end minute> <days>
|
||||
# Example:
|
||||
##time: 9 0 17 0 01234
|
||||
# Remove the first # from the line above to enable this list only from
|
||||
# 9am to 5pm, Monday to Friday.
|
||||
|
||||
40
docker-compose/e2guardian/lists/example.group/exceptionmimetypelist
Executable file
40
docker-compose/e2guardian/lists/example.group/exceptionmimetypelist
Executable file
@ -0,0 +1,40 @@
|
||||
# Exception MIME type list
|
||||
# Use as a filter group's "exceptionmimetypelist",
|
||||
# to override a blanket download block.
|
||||
# (blockdownloads = on)
|
||||
#
|
||||
# DOES NOT override content/virus scanning or site/URL bans.
|
||||
#
|
||||
# Default list:
|
||||
# Unblock web pages & graphics
|
||||
|
||||
# Text/web document types
|
||||
|
||||
text/plain
|
||||
text/html
|
||||
text/css
|
||||
text/xml
|
||||
text/xsl
|
||||
text/richtext
|
||||
|
||||
# Image types
|
||||
|
||||
image/bmp
|
||||
image/cis-cod
|
||||
image/gif
|
||||
image/ief
|
||||
image/jpeg
|
||||
image/pipeg
|
||||
image/png
|
||||
image/tiff
|
||||
image/x-cmu-raster
|
||||
image/x-cmx
|
||||
image/x-icon
|
||||
image/x-portable-anymap
|
||||
image/x-portable-bitmap
|
||||
image/x-portable-graymap
|
||||
image/x-portable-pixmap
|
||||
image/x-rgb
|
||||
image/x-xbitmap
|
||||
image/x-xpixmap
|
||||
image/x-xwindowdump
|
||||
@ -0,0 +1,19 @@
|
||||
# EXCEPTIONPHRASELIST - INSTRUCTIONS FOR USE
|
||||
#
|
||||
# If any of the phrases listed below appear in a web page
|
||||
# then it will bypass the filtering and be allowed through
|
||||
# eg
|
||||
# < medical >
|
||||
#
|
||||
#
|
||||
# Combinations
|
||||
# Unblock the page if the following phrases are found on the same page.
|
||||
# Each line is a new combination.
|
||||
# eg
|
||||
#<education>,<biology>,<medical>
|
||||
#
|
||||
# See the bannedphraselist for more examples.
|
||||
|
||||
# Use this sparingly as can easily make exceptions of unsuitable urls
|
||||
|
||||
#.Include</etc/e2guardian/lists/phraselists/ukenglish/goodphrases/exception_email>
|
||||
8
docker-compose/e2guardian/lists/example.group/exceptionregexpheaderlist
Executable file
8
docker-compose/e2guardian/lists/example.group/exceptionregexpheaderlist
Executable file
@ -0,0 +1,8 @@
|
||||
#Allowed outgoing HTTP headers based on regular expressions
|
||||
#
|
||||
# E.g. 'User-Agent: .*MSIE' would allow several versions of Internet Explorer
|
||||
# (assuming the user-agent is not being spoofed by the client)
|
||||
#
|
||||
# Headers are matched line-by-line, not as a single block.
|
||||
|
||||
#listcategory: "Allowed Regular Expression HTTP Headers"
|
||||
15
docker-compose/e2guardian/lists/example.group/exceptionregexpurllist
Executable file
15
docker-compose/e2guardian/lists/example.group/exceptionregexpurllist
Executable file
@ -0,0 +1,15 @@
|
||||
#Exception URLs based on Regular Expressions
|
||||
#
|
||||
# E.g. 'news' would unblock news.bbc.com etc
|
||||
|
||||
# Example
|
||||
#news
|
||||
|
||||
# Prevent content scanning of CSS and/or JavaScript files
|
||||
#^[^?]*\.css($|\?)
|
||||
#^[^?]*\.jsp?($|\?)
|
||||
|
||||
# Allow Facebook plugin applications like
|
||||
# http://apps.facebook.com/neighborhoods/Setup.aspx and others.
|
||||
mock_ajax_proxy.php
|
||||
|
||||
10
docker-compose/e2guardian/lists/example.group/exceptionregexpuseragentlist
Executable file
10
docker-compose/e2guardian/lists/example.group/exceptionregexpuseragentlist
Executable file
@ -0,0 +1,10 @@
|
||||
#Exception User-Agent based on regular expressions
|
||||
#
|
||||
# E.g. ' .*MSIE' would allow several versions of Internet Explorer
|
||||
# (assuming the user-agent is not being spoofed by the client)
|
||||
#
|
||||
# Usefull for allowing 'apps' to work
|
||||
# E.g. 'Kindle' would make kindle app an exception
|
||||
|
||||
#listcategory: "user-agent"
|
||||
|
||||
9
docker-compose/e2guardian/lists/example.group/exceptionsiteiplist
Executable file
9
docker-compose/e2guardian/lists/example.group/exceptionsiteiplist
Executable file
@ -0,0 +1,9 @@
|
||||
#IP Sites in exception list
|
||||
# IP site addresses
|
||||
#
|
||||
# Single IPs, ranges and subnets can be used,
|
||||
# e.g.
|
||||
# 192.168.0.1
|
||||
# 10.0.0.1-10.0.0.3
|
||||
# 10.0.0.0/24
|
||||
#
|
||||
24
docker-compose/e2guardian/lists/example.group/exceptionsitelist
Executable file
24
docker-compose/e2guardian/lists/example.group/exceptionsitelist
Executable file
@ -0,0 +1,24 @@
|
||||
#Sites in exception list
|
||||
#Don't bother with the www. or
|
||||
#the http://
|
||||
#
|
||||
#These are specifically domains and are not URLs.
|
||||
#For example 'foo.bar/porn/' is no good, you need
|
||||
#to just have 'foo.bar'.
|
||||
#
|
||||
# IP must be put in exceptionsiteiplist
|
||||
#
|
||||
#.tld so for example you can match .gov for example
|
||||
|
||||
|
||||
# Time limiting syntax:
|
||||
# #time: <start hour> <start minute> <end hour> <end minute> <days>
|
||||
# Example:
|
||||
##time: 9 0 17 0 01234
|
||||
# Remove the first # from the line above to enable this list only from
|
||||
# 9am to 5pm, Monday to Friday.
|
||||
|
||||
# NOTE: From v5 Blanket exceptions are now implimented using Storyboarding
|
||||
# WARNING: Old style Blanket blocks in this file will be silently ignored
|
||||
|
||||
windowsupdate.microsoft.com
|
||||
15
docker-compose/e2guardian/lists/example.group/exceptionurllist
Executable file
15
docker-compose/e2guardian/lists/example.group/exceptionurllist
Executable file
@ -0,0 +1,15 @@
|
||||
#URLs in exception list
|
||||
#Don't bother with the www. or
|
||||
#the http://
|
||||
#
|
||||
#These are parts of sites that filtering should
|
||||
#be switched off for.
|
||||
#
|
||||
#These should not be domains, i.e. entire sites,
|
||||
#they should be a domain with a path.
|
||||
#
|
||||
#For example 'foo.bar' is no good, you need
|
||||
#to just have 'foo.bar/porn/'.
|
||||
#
|
||||
#Another example:
|
||||
#generallybadsite.tld/partthatsok/
|
||||
45
docker-compose/e2guardian/lists/example.group/exceptionvirusextensionlist
Executable file
45
docker-compose/e2guardian/lists/example.group/exceptionvirusextensionlist
Executable file
@ -0,0 +1,45 @@
|
||||
# Exception file extension list
|
||||
# Use as a filter group's "exceptionvirusextensionlist",
|
||||
#
|
||||
# Default list:
|
||||
# Unblock web pages & graphics
|
||||
|
||||
# Text/web document types
|
||||
|
||||
.css
|
||||
.html
|
||||
.shtml
|
||||
.htm
|
||||
.stm
|
||||
.asp
|
||||
.php
|
||||
.txt
|
||||
.rtx
|
||||
.xml
|
||||
.xsl
|
||||
.cgi
|
||||
.pl
|
||||
|
||||
# Image types
|
||||
|
||||
.bmp
|
||||
.cod
|
||||
.gif
|
||||
.ief
|
||||
.jpe
|
||||
.jpeg
|
||||
.jpg
|
||||
.jfif
|
||||
.tif
|
||||
.tiff
|
||||
.ras
|
||||
.cmx
|
||||
.ico
|
||||
.pnm
|
||||
.pbm
|
||||
.pgm
|
||||
.ppm
|
||||
.rgb
|
||||
.xbm
|
||||
.xpm
|
||||
.xwd
|
||||
12
docker-compose/e2guardian/lists/example.group/exceptionvirussiteiplist
Executable file
12
docker-compose/e2guardian/lists/example.group/exceptionvirussiteiplist
Executable file
@ -0,0 +1,12 @@
|
||||
# IP sites in exceptionvirussiteiplist
|
||||
|
||||
#The exceptionvirussiteiplist is for allowing ALL of an IP site
|
||||
|
||||
# IP site addresses
|
||||
#
|
||||
# Single IPs, ranges and subnets can be used,
|
||||
# e.g.
|
||||
# 192.168.0.1
|
||||
# 10.0.0.1-10.0.0.3
|
||||
# 10.0.0.0/24
|
||||
#
|
||||
16
docker-compose/e2guardian/lists/example.group/greysiteiplist
Executable file
16
docker-compose/e2guardian/lists/example.group/greysiteiplist
Executable file
@ -0,0 +1,16 @@
|
||||
# IP site in grey list
|
||||
|
||||
#The 'grey' lists override the 'banned' lists.
|
||||
#The 'exception' lists override the 'banned' lists also.
|
||||
#The difference is that the 'exception' lists completely switch
|
||||
#off *all* other filtering for the match. 'grey' lists only
|
||||
#stop the URL filtering and allow the normal filtering to work.
|
||||
|
||||
# IP site addresses
|
||||
#
|
||||
# Single IPs, ranges and subnets can be used,
|
||||
# e.g.
|
||||
# 192.168.0.1
|
||||
# 10.0.0.1-10.0.0.3
|
||||
# 10.0.0.0/24
|
||||
#
|
||||
59
docker-compose/e2guardian/lists/example.group/greysitelist
Executable file
59
docker-compose/e2guardian/lists/example.group/greysitelist
Executable file
@ -0,0 +1,59 @@
|
||||
#domains in grey list
|
||||
#Don't bother with the www. or the http://
|
||||
|
||||
#The 'grey' lists override the 'banned' lists.
|
||||
#The 'exception' lists override the 'banned' lists also.
|
||||
#The difference is that the 'exception' lists completely switch
|
||||
#off *all* other filtering for the match. 'grey' lists only
|
||||
#stop the URL filtering and allow the normal filtering to work.
|
||||
|
||||
#An example of grey list use is when in Blanket Block (whitelist)
|
||||
#mode and you want to allow some sites but still filter as normal
|
||||
#on their content
|
||||
|
||||
#Another example of grey list use is when you ban a site but want
|
||||
#to allow part of it.
|
||||
|
||||
#The greyurllist is for partly unblocking PART of a site
|
||||
#The greysitelist is for partly unblocking ALL of a site
|
||||
|
||||
#As of DansGuardian 2.7.3 you can now include
|
||||
#.tld so for example you can match .gov for example
|
||||
|
||||
#To include additional files in this list use this example:
|
||||
#.Include</etc/e2guardian/anotherurllist>
|
||||
|
||||
#You can have multiple .Includes.
|
||||
|
||||
# Time limiting syntax:
|
||||
# #time: <start hour> <start minute> <end hour> <end minute> <days>
|
||||
# Example:
|
||||
##time: 9 0 17 0 01234
|
||||
# Remove the first # from the line above to enable this list only from
|
||||
# 9am to 5pm, Monday to Friday.
|
||||
|
||||
|
||||
# Blanket match. To greylist all sites except those in the
|
||||
# exceptionsitelist and greysitelist files, remove
|
||||
# the # from the next line to leave only a '**':
|
||||
#**
|
||||
|
||||
# Blanket SSL/CONNECT match. To greylist all SSL
|
||||
# and CONNECT tunnels except to addresses in the
|
||||
# exceptionsitelist and greysitelist files, remove
|
||||
# the # from the next line to leave only a '**s':
|
||||
#**s
|
||||
|
||||
# Blanket IP match. To greylist all sites specified only as an IP,
|
||||
# remove the # from the next line to leave only a '*ip':
|
||||
#*ip
|
||||
|
||||
# Blanket SSL/CONNECT IP match. To greylist all SSL and CONNECT
|
||||
# tunnels to sites specified only as an IP,
|
||||
# remove the # from the next line to leave only a '*ips':
|
||||
#*ips
|
||||
|
||||
|
||||
#List other sites to greylist:
|
||||
|
||||
#www.bbc.co.uk
|
||||
@ -0,0 +1,10 @@
|
||||
# IP sites in SSL grey list
|
||||
|
||||
# IP site addresses
|
||||
#
|
||||
# Single IPs, ranges and subnets can be used,
|
||||
# e.g.
|
||||
# 192.168.0.1
|
||||
# 10.0.0.1-10.0.0.3
|
||||
# 10.0.0.0/24
|
||||
#
|
||||
@ -0,0 +1,4 @@
|
||||
#domains in SSL grey list
|
||||
#Don't bother with the www. or the https://
|
||||
|
||||
#This 'grey' lists override the 'banned' lists for SSL only.
|
||||
27
docker-compose/e2guardian/lists/example.group/greyurllist
Executable file
27
docker-compose/e2guardian/lists/example.group/greyurllist
Executable file
@ -0,0 +1,27 @@
|
||||
#URLs in grey list
|
||||
#Don't bother with the http:// or the www
|
||||
|
||||
#The greyurllist is for partly unblocking PART of a site
|
||||
#The greysitelist is for partly unblocking ALL of a site
|
||||
|
||||
#The 'grey' lists override the 'banned' lists.
|
||||
#The 'exception' lists override the 'banned' lists also.
|
||||
#The difference is that the 'exception' lists completely switch
|
||||
#off *all* other filtering for the match. 'grey' lists only
|
||||
#stop the URL filtering and allow the normal filtering to work.
|
||||
|
||||
#An example of grey list use is when in Blanket Block (whitelist)
|
||||
#mode and you want to allow some sites but still filter as normal
|
||||
#on their content
|
||||
|
||||
#Another example of grey list use is when you ban a site but want
|
||||
#to allow part of it.
|
||||
|
||||
#To include additional files in this list use this example:
|
||||
#.Include</etc/e2guardian/anotherurllist>
|
||||
|
||||
#You can have multiple .Includes.
|
||||
|
||||
#List other URLs to block:
|
||||
|
||||
#members.home.net/nice
|
||||
15
docker-compose/e2guardian/lists/example.group/headerregexplist
Executable file
15
docker-compose/e2guardian/lists/example.group/headerregexplist
Executable file
@ -0,0 +1,15 @@
|
||||
# Outgoing HTTP request header modifying Regular Expressions
|
||||
#
|
||||
# The format is: "extended regular expression"->"replacement straight string"
|
||||
# E.g. "shit"->"censored" would replace all occurances of shit in any case.
|
||||
# Far more complicated matches are possible. See other sources for examples
|
||||
# of extended regular expressions.
|
||||
#
|
||||
# Headers are run through replacements line-by-line, not as a single block.
|
||||
#
|
||||
# To remove a header put "X-E2G-IgnoreMe:" as the replacement
|
||||
# e.g. to remove 'upgrade:' headers
|
||||
#"upgrade:.*$"->"X-E2G-IgnoreMe:"
|
||||
|
||||
# Windows Live Search cookie replacement - force filtering on
|
||||
#"cookie:(.*)&ADLT=(OFF|DEMOTE)"->"Cookie:$1&ADLT=STRICT"
|
||||
13
docker-compose/e2guardian/lists/example.group/ipnobypass
Normal file
13
docker-compose/e2guardian/lists/example.group/ipnobypass
Normal file
@ -0,0 +1,13 @@
|
||||
# User are not allowed to bypass IP sites in this list
|
||||
|
||||
#
|
||||
# This is not the IP of web servers
|
||||
# you want to filter.
|
||||
|
||||
# Single IPs, ranges and subnets can be used,
|
||||
# e.g.
|
||||
# 192.168.0.1
|
||||
# 10.0.0.1-10.0.0.3
|
||||
# 10.0.0.0/24
|
||||
#
|
||||
|
||||
@ -0,0 +1,14 @@
|
||||
#Local Banned Search Words
|
||||
#
|
||||
#Words must be in alphabetic order within a single line
|
||||
# and separated by a '+' sign.
|
||||
#All combinations of the words will be blocked
|
||||
# e.g. girl+naughty
|
||||
# will block naughty+girl as well as girl+naughty
|
||||
|
||||
|
||||
#.Include</home/dg/etc/local/lists/local_block_all/bannedsearchterms>
|
||||
#.Include</home/dg/etc/local/lists/porn/bannedsearchterms>
|
||||
#.Include</home/dg/etc/local/lists/proxy/bannedsearchterms>
|
||||
#.Include</home/dg/etc/local/lists/hacking/bannedsearchterms>
|
||||
#.Include</home/dg/etc/local/lists/drugs/bannedsearchterms>
|
||||
@ -0,0 +1,10 @@
|
||||
# IP sites in local banned list
|
||||
|
||||
# IP site addresses
|
||||
#
|
||||
# Single IPs, ranges and subnets can be used,
|
||||
# e.g.
|
||||
# 192.168.0.1
|
||||
# 10.0.0.1-10.0.0.3
|
||||
# 10.0.0.0/24
|
||||
#
|
||||
@ -0,0 +1,6 @@
|
||||
#domains in local banned list
|
||||
#.Include</home/dg/etc/local/lists/local_block_all/domains>
|
||||
#.Include</home/dg/etc/local/lists/porn/domains>
|
||||
#.Include</home/dg/etc/local/lists/proxy/domains>
|
||||
#.Include</home/dg/etc/local/lists/hacking/domains>
|
||||
#.Include</home/dg/etc/local/lists/drugs/domains>
|
||||
@ -0,0 +1,12 @@
|
||||
# IP sites in local banned ssl list
|
||||
#This list is only used for SSL (or CONNECT) requests
|
||||
#Unlike the bannedsitelist it overides all other lists
|
||||
|
||||
# IP site addresses
|
||||
#
|
||||
# Single IPs, ranges and subnets can be used,
|
||||
# e.g.
|
||||
# 192.168.0.1
|
||||
# 10.0.0.1-10.0.0.3
|
||||
# 10.0.0.0/24
|
||||
#
|
||||
@ -0,0 +1,5 @@
|
||||
#domains in banned ssl list
|
||||
#Don't bother with the www. or the https://
|
||||
#This list is only used for SSL (or CONNECT) requests
|
||||
# and has no effect when MITM is enabled
|
||||
#Unlike the bannedsitelist it overides all other lists
|
||||
@ -0,0 +1 @@
|
||||
#URLs in local banned list
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user