Update sup and first compose mulit smp version

compose/README.md

@@ -0,0 +1,7 @@
+This project consists of components that work together, squid and e2guardian, to create a high-performing deployment for larger organizations.
+
+You can deploy many squid on the same server, all compiled to works in SSLBUMP mode 
+
+Traefik proxy load balance requests 
+
+For now there no sticky session: https://github.com/traefik/traefik/issues/1035 (works in progress)

compose/docker-compose.yml

@@ -0,0 +1,58 @@
+version: '3'
+services:
+  proxy:
+    image: traefik:latest
+    command:
+      - "--log.level=DEBUG"
+    volumes:
+      - ./traefik:/etc/traefik:ro
+        #    network_mode: host
+    ports:
+      - 3128:3128
+      - 8080:8080
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.api.service=api@internal"
+      - "traefik.http.routers.api.entrypoints=http"
+      - "traefik.http.routers.api.tls=false"
+      - "traefik.http.routers.dashboard.rule=Host(`traefik.example.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
+      - "traefik.http.routers.dashboard.service=api@internal"
+        #      - "traefik.tcp.routers.squid.rule=HostSNI(`*`)" 
+        #- "traefik.tcp.routers.squid.service=squid@file"
+/bin/bash: ligne 1: q : commande introuvable
+  squid:
+    image: fredbcode/squid:latest-amd64
+    volumes:
+      - ./squid/squid.conf:/etc/squid/squid.conf:ro
+    networks:
+      - proxy
+    ports:
+      - 3129:3128
+    labels:
+      - "traefik.enable=false"
+
+  squid1:
+    image: fredbcode/squid:latest-amd64
+    volumes:
+      - ./squid/squid.conf:/etc/squid/squid.conf:ro
+    ports:
+      - 3130:3128
+    labels:
+      - "traefik.enable=false"
+
+# You can add any squid you want
+
+# e2guardian with 5000 workers
+# default denied website toto.fr
+  e2guardian:
+    image: fredbcode/e2guardian:v5.4-amd64
+    networks:
+      - proxy
+    volumes:
+      - ./e2guardian/:/etc/e2guardian:ro
+    labels:
+      - "traefik.enable=false"
+
+networks:
+  proxy:
+

compose/e2guardian/authplugins/dnsauth.conf

@@ -0,0 +1,19 @@
+# IP/DNS-based auth plugin
+#
+# Obtains user and group from domain entry maintained by separate authentication# program.
+
+plugname = 'dnsauth'
+
+# Base DNS domain
+#basedomain = "my.privatedomain"
+
+# Authentication URL
+#authurl = "http://192.168.1.3/auth/login/login.pl?url"
+
+# Prefix for auth URLs
+#prefix_auth = "http://192.168.1.3/auth/"
+
+# Redirect to auth (i.e. log-in) 
+#  yes - redirects to authurl to login
+#  no - drops through to next auth plugin 
+redirect_to_auth = "yes"

compose/e2guardian/authplugins/ident.conf

@@ -0,0 +1,23 @@
+# Ident auth plugin
+# Identifies users via IDENT servers running on client machines
+
+plugname = 'ident'
+
+story_function = 'auth_ident'
+# This defines the storybaord function in pre-auth.story
+# which determines the filter group used.
+
+# Default group settings for this plug-in
+# If these are set group determination will always succeed 
+# and auth plug-in scan will stop
+# even if the user is not found in group list(s)
+
+# These settings override the global defaultfiltergroup and 
+# defaulttransparentfiltergroup settings for this plug-in only.
+
+#defaultfiltergroup = 1
+# This applies to explict proxy and icap requests
+
+#defaulttransparentfiltergroup = 2
+# This appies to transparent requests (http & https)
+# Note if not defined does NOT default to defaultfiltergroup

compose/e2guardian/authplugins/ip.conf

@@ -0,0 +1,29 @@
+# IP-based auth plugin
+#
+# Maps client IPs to filter groups.
+# If "usexforwardedfor" is enabled, grabs the IP from the X-Forwarded-For
+# header, if available.
+
+plugname = 'ip'
+
+# ipgroups file - is defined in e2guardian.conf from v5.4
+# List file assigning IP addresses, subnets and ranges to filter groups
+
+story_function = 'auth_ip'
+# This defines the storybaord function in pre-auth.story
+# which determines the filter group used.
+
+# Default group settings for this plug-in
+# If these are set group determination will always succeed 
+# and auth plug-in scan will stop
+# even if the user is not found in group list(s)
+
+# These settings override the global defaultfiltergroup and 
+# defaulttransparentfiltergroup settings for this plug-in only.
+
+#defaultfiltergroup = 1
+# This applies to explict proxy and icap requests
+
+#defaulttransparentfiltergroup = 2
+# This appies to transparent requests (http & https)
+# Note if not defined does NOT default to defaultfiltergroup

compose/e2guardian/authplugins/pf-basic.conf

@@ -0,0 +1,24 @@
+# Proxy-Basic auth plugin
+# Identifies usernames in "Proxy-Authorization: Basic" headers;
+# relies upon the upstream proxy (squid) to perform the actual password check.
+
+plugname = 'pf-basic'
+
+story_function = 'auth_pf_basic'
+# This defines the storybaord function in pre-auth.story
+# which determines the filter group used.
+
+# Default group settings for this plug-in
+# If these are set group determination will always succeed 
+# and auth plug-in scan will stop
+# even if the user is not found in group list(s)
+
+# These settings override the global defaultfiltergroup and 
+# defaulttransparentfiltergroup settings for this plug-in only.
+
+#defaultfiltergroup = 1
+# This applies to explict proxy requests
+
+#defaulttransparentfiltergroup = 2
+# This appies to transparent requests (http & https)
+# Note if not defined does NOT default to defaultfiltergroup

compose/e2guardian/authplugins/port.conf

@@ -0,0 +1,24 @@
+# IP-Port-based auth plugin
+#
+# Maps IP Ports to filter groups.
+
+plugname = 'port'
+
+story_function = auth_port
+# This defines the storybaord function in pre-auth.story
+# which determines the filter group used.
+
+# Default group settings for this plug-in
+# If these are set group determination will always succeed 
+# and auth plug-in scan will stop
+# even if the user is not found in group list(s)
+
+# These settings override the global defaultfiltergroup and 
+# defaulttransparentfiltergroup settings for this plug-in only.
+
+#defaultfiltergroup = 1
+# This applies to explict proxy and icap requests
+
+#defaulttransparentfiltergroup = 2
+# This appies to transparent requests (http & https)
+# Note if not defined does NOT default to defaultfiltergroup

compose/e2guardian/authplugins/proxy-basic.conf

@@ -0,0 +1,24 @@
+# Proxy-Basic auth plugin
+# Identifies usernames in "Proxy-Authorization: Basic" headers;
+# relies upon the upstream proxy (squid) to perform the actual password check.
+
+plugname = 'proxy-basic'
+
+story_function = 'auth_proxy_basic'
+# This defines the storybaord function in pre-auth.story
+# which determines the filter group used.
+
+# Default group settings for this plug-in
+# If these are set group determination will always succeed 
+# and auth plug-in scan will stop
+# even if the user is not found in group list(s)
+
+# These settings override the global defaultfiltergroup and 
+# defaulttransparentfiltergroup settings for this plug-in only.
+
+#defaultfiltergroup = 1
+# This applies to explict proxy and icap requests
+
+#defaulttransparentfiltergroup = 2
+# This appies to transparent requests (http & https)
+# Note if not defined does NOT default to defaultfiltergroup

compose/e2guardian/authplugins/proxy-digest.conf

@@ -0,0 +1,26 @@
+# Proxy-Digest auth plugin
+# Identifies usernames in "Proxy-Authorization: Digest" headers;
+# relies upon the upstream proxy (squid) to perform the actual password check.
+
+# Contributed by Darryl Sutherland <darryl@weblink.co.za>
+
+plugname = 'proxy-digest'
+
+story_function = auth_proxy_digest
+# This defines the storybaord function in pre-auth.story
+# which determines the filter group used.
+
+# Default group settings for this plug-in
+# If these are set group determination will always succeed 
+# and auth plug-in scan will stop
+# even if the user is not found in group list(s)
+
+# These settings override the global defaultfiltergroup and 
+# defaulttransparentfiltergroup settings for this plug-in only.
+
+#defaultfiltergroup = 1
+# This applies to explict proxy and icap requests
+
+#defaulttransparentfiltergroup = 2
+# This appies to transparent requests (http & https)
+# Note if not defined does NOT default to defaultfiltergroup

compose/e2guardian/authplugins/proxy-header.conf

@@ -0,0 +1,34 @@
+# Proxy-header auth plugin
+# FredB August 2016
+# Identifies users with header;
+# relies upon the upstream proxy.
+# Eg: in groups file
+# Mozilla/5.0 (Windows NT 6.1; rv:47.0) Gecko/20100101 Firefox/47.0=filter3
+# here:
+# header = 'user-agent'
+# Firefox 47 + windows is added to group3 without any kind of authentification (! not related with your proxy configuration/identification !)
+# THIS IS REALLY INSECURE This can be easily compromised by spoofing the Origin header
+
+# low case
+header = ''
+
+plugname = 'proxy-header'
+
+story_function = auth_proxy_header
+# This defines the storybaord function in pre-auth.story
+# which determines the filter group used.
+
+# Default group settings for this plug-in
+# If these are set group determination will always succeed 
+# and auth plug-in scan will stop
+# even if the user is not found in group list(s)
+
+# These settings override the global defaultfiltergroup and 
+# defaulttransparentfiltergroup settings for this plug-in only.
+
+#defaultfiltergroup = 1
+# This applies to explict proxy and icap requests
+
+#defaulttransparentfiltergroup = 2
+# This appies to transparent requests (http & https)
+# Note if not defined does NOT default to defaultfiltergroup

compose/e2guardian/authplugins/proxy-ntlm.conf

@@ -0,0 +1,24 @@
+# Proxy-NTLM auth plugin
+# Identifies usernames in "Proxy-Authorization: NTLM" headers;
+# relies on the upstream proxy (squid) to perform the actual password check.
+
+plugname = 'proxy-ntlm'
+
+story_function = auth_proxy_ntlm
+# This defines the storybaord function in pre-auth.story
+# which determines the filter group used.
+
+# Default group settings for this plug-in
+# If these are set group determination will always succeed 
+# and auth plug-in scan will stop
+# even if the user is not found in group list(s)
+
+# These settings override the global defaultfiltergroup and 
+# defaulttransparentfiltergroup settings for this plug-in only.
+
+#defaultfiltergroup = 1
+# This applies to explict proxy and icap requests
+
+#defaulttransparentfiltergroup = 2
+# This appies to transparent requests (http & https)
+# Note if not defined does NOT default to defaultfiltergroup

compose/e2guardian/common.story

@@ -0,0 +1,331 @@
+# Storyboard library file
+
+# For ease of upgrade DO NOT CHANGE THIS library file 
+# Make your function changes by using user 'hook' functions
+# or by overriding functions
+# in the site.story file - for site wide changes.
+# 
+# and in filtergroup specific story file - see examplef1.story
+#
+# This library is built to largely duplicate the logic in V4
+# 
+# Many e2guardian[f1].conf flags are replaced by overiding
+# library functions - see site.story and examplef1.story
+#
+# Simple functions are defined which control the logic flow and the
+# lists that are used.  See notes/Storyboard for details.
+#
+# The entry point in v5 for standard filtering is 'checkrequest'
+#
+
+# Entry function called by standard proxy module to check http,
+#   https proxy and transparent http requests
+# It is also called within a MITM session
+function(checkrequest)
+if(true) returnif hook_checkrequest
+if(viruscheckset) checknoscanlists
+if(bypassallowset) checknobypasslists
+if(exceptionset) return true 
+#if(fullurlin,searchterms) setsearchterm
+if(true) is_search_term
+ifnot(greyset) returnif localcheckrequest
+if(connect) return sslrequestcheck
+ifnot(greyset) returnif exceptioncheck
+ifnot(greyset) greycheck
+ifnot(greyset) returnif bannedcheck
+if(fullurlin, change) setmodurl
+if(true) returnif embeddedcheck
+if(headerin,headermods) setmodheader
+if(fullurlin, addheader) setaddheader
+if(searchin,override) setexception
+if(returnset) return setdone
+if(searchin,banned) return setblock
+if(fullurlin,redirect) return setredirect
+if(true) setgrey
+
+
+# Entry function called by proxy module to check http response
+# It is also called within a MITM session
+function(checkresponse)
+if(true) returnif hook_checkresponse
+if(exceptionset) return false
+if(responseheaderin,reponseheadermods) setmodheader
+if(viruscheckset) checknoscantypes
+if(urlin,exceptionfile) return false
+if(true) return checkfiletype
+
+# Entry function called by THTTPS module to check https request
+function(thttps-checkrequest)
+if(true) returnif hook_thttps-checkrequest
+if(true) thttps_automitm
+if(true) returnif checktimesblocked
+if(true) returnif localsslrequestcheck
+if(true) returnif sslrequestcheck
+ifnot(hassniset) checksni
+
+# Entry function called by ICAP module to check reqmod
+function(icap-checkrequest)
+if(true) returnif hook_icap-checkrequest
+#unless blocked or redirect or connect - leave logging for RESPMOD
+if(connect) return icapsslrequestcheck
+ifnot(greyset) icap-checkrequest2
+if(redirectset) return true
+ifnot(blockset) setnolog
+
+function(icap-checkrequest2)
+if(viruscheckset) checknoscanlists
+if(bypassallowset) checknobypasslists
+if(exceptionset) return true
+#if(fullurlin,searchterms) setsearchterm
+if(true) is_search_term
+ifnot(greyset) returnif localcheckrequest
+ifnot(greyset) returnif exceptioncheck
+ifnot(greyset) greycheck
+ifnot(greyset) returnif bannedcheck
+if(fullurlin, change) setmodurl
+if(true) returnif embeddedcheck
+if(headerin,headermods) setmodheader
+if(fullurlin, addheader) setaddheader
+if(searchin,override) return setgrey
+if(searchin,banned) return setblock
+if(true) setgrey
+
+# Entry function called by ICAP module to check respmod
+function(icap-checkresponse)
+if(true) returnif hook_icap-checkresponse
+if(viruscheckset) checknoscanlists
+if(true) return checkresponse
+
+# Checks embeded urls
+#  returns true if blocked, otherwise false
+function(embeddedcheck)
+if(embeddedin, localexception) return false
+if(embeddedin, localgrey) return false
+if(embeddedin, localbanned) return setblock
+if(embeddedin, exception) return false
+if(embeddedin, grey) return false
+if(embeddedin, banned) return setblock
+
+# Local checks
+#  returns true if matches local exception or banned
+function(localcheckrequest)
+if(true) returnif hook_localcheckrequest
+if(connect) return localsslrequestcheck
+if(true) checktimesblocked
+if(returnset) return setblock
+ifnot(greyset) returnif localexceptioncheck
+ifnot(greyset) localgreycheck
+ifnot(greyset) returnif localbannedcheck
+if(searchin,localbanned) return setblock
+
+
+# Local SSL checks
+#  returns true if matches local exception 
+function(localsslrequestcheck)
+if(true) returnif hook_localsslrequestcheck
+if(true) returnif sslchecktimesblocked
+if(sitein, localexception) return setexception
+if(sitein, localgreyssl) returnif sslcheckmitm
+if(sitein, localbanned) true
+ifnot(returnset) return false
+if(true) returnif sslcheckmitm
+if(true) return setblock
+
+# SSL site replace (used instead of dns kulge)
+#  returns true on match and successful replacement
+function(sslreplace)
+if(fullurlin,sslreplace) return setconnectsite
+if(true) return false
+
+function(sslchecktimesblocked)
+if(true) checktimesblocked
+ifnot(returnset) return false
+if(true) returnif sslcheckmitm
+if(true) return setblock
+
+# Local grey check
+#  returns true on match
+function(localgreycheck)
+if(urlin, localgrey) return setgrey
+
+# Local banned check
+#  returns true on match
+function(localbannedcheck)
+if(urlin, localbanned) return setblock
+
+# Local exception check
+#  returns true on match
+function(localexceptioncheck)
+if(urlin, localexception) return setexception
+
+# Exception check
+#  returns true on match
+function(exceptioncheck)
+if(urlin, exception) return setexception
+if(refererin,refererexception) return setexception
+if(headerin, exceptionheader) return setexception
+if(useragentin, exceptionuseragent) return setexception
+ifnot(urlin,embededreferer) return false
+if(embeddedin,refererexception) return setexception
+
+# SSL Exception check
+#  returns true on match
+function(sslexceptioncheck)
+if(sitein, exception) return setexception
+if(headerin, exceptionheader) return setexception
+if(useragentin, exceptionuseragent) return setexception
+if(true) return false
+
+# Greylist check
+#  returns true on match
+function(greycheck)
+if(urlin, grey) return setgrey
+
+# Banned list check
+#  returns true on match
+function(bannedcheck)
+if(true) returnif checkblanketblock
+if(urlin, banned) return setblock
+ifnot(urlin,exceptionfile) returnif checkurlextension
+if(useragentin, banneduseragent) return setblock
+if(headerin, bannedheader) return setblock
+
+# Checks url for banned extensions
+#  returns true on match
+function(checkurlextension)
+if(urlin,bannedextension) return setblock
+
+# Local SSL list(s) check
+#  returns true on match
+function(localsslcheckrequest)
+if(true) returnif hook_localsslcheckrequest
+if(sitein, localexception) return setexception
+#if(sitein, localbanned) return setblock
+
+# Check whether to go MITM
+#  returns true if yes, false if no
+function(sslcheckmitm)
+# use next line to have general MITM
+if(true) return sslcheckmitmgeneral
+# use next line instead of last to limit MITM to greylist
+#if(true) return sslcheckmitmgreyonly
+
+# Always go MITM
+#  returns true if yes, false if no
+function(sslcheckmitmgeneral)
+if(true) setgomitm
+ifnot(returnset) return false
+if(sitein, nocheckcert) setnocheckcert
+if(true) sslreplace
+if(true) return true
+
+# Only go MITM when in greyssl list
+#  returns true if yes, false if no
+function(sslcheckmitmgreyonly)
+if(sitein, greyssl) setgomitm
+ifnot(returnset) return false
+if(sitein, nocheckcert) setnocheckcert
+if(true) sslreplace
+if(true) return true
+
+# SSL request check
+#  returns true if exception or gomitm
+function(sslrequestcheck)
+if(true) returnif hook_sslrequestcheck
+if(true) returnif sslexceptioncheck
+if(true) returnif sslcheckmitm
+if(sitein, banned) return setblock
+if(true) sslreplace
+ifnot(returnset) returnif sslcheckblanketblock
+if(true) setgrey
+
+function(checknoscanlists)
+if(urlin,exceptionvirus) unsetviruscheck
+
+function(checknoscantypes)
+if(mimein,exceptionvirus) return unsetviruscheck
+if(extensionin,exceptionvirus) return unsetviruscheck
+
+function(checknobypasslists)
+if(urlin,bannedbypass) return unsetbypassallow
+
+# ICAP SSL request check
+#  returns true if exception 
+function(icapsslrequestcheck)
+if(true) returnif hook_icapsslrequestcheck
+if(true) returnif icapsquidbump
+if(true) returnif sslexceptioncheck
+# Squid ignores sslreplace and throws error so comment out for now
+#t configif(true) sslreplace
+if(sitein, banned) return setblock
+
+# Blanket block
+#  returns true if to block
+#  Placeholder function - overide in fn.story
+function(checkblanketblock)
+
+# SSL Blanket block
+#  returns true if to block
+#  Placeholder function - overide in fn.story
+function(sslcheckblanketblock)
+
+# ICAP Squid bump
+#  override in site.story to return true if bump is being deployed on squid
+function(icapsquidbump)
+
+# File type blocking
+#  returns true if blocking
+# Default uses banned lists and allows all others
+# Overide in site.story or fn.story if only types in exception file type lists 
+# are to be allowed
+function(checkfiletype)
+if(mimein, bannedmime) return setblock
+if(extensionin, bannedextension) return setblock
+
+# SNI checking - determines default action when no SNI or TSL is present on a 
+#    THTTPS connection
+# Default blocks all requests with TLS or SNI absent that are not ip site exceptions
+function(checksni)
+ifnot(tls,,511) return setblock
+ifnot(hassniset,,512) return setblock
+
+# automitm on transparent https
+#   default enables on transparent https - to allow block/status pages to browsers
+#   override this is fn.story if this causes problems with apps
+function(thttps_automitm)
+if(true) setautomitm
+
+# Timed global block
+#  returns true if to block
+#  Placeholder function - overide in fn.story
+function(checktimesblocked)
+
+# Entry function to check if to log
+# returns true if log entry is to be made
+# This can be overriden in site.story (or fn.story) to log all for testing.
+function(checklogging)
+if(urlin,nolog) setnolog
+if(returnset) return false
+if(true) return true
+
+function(is_search_term)
+if(urlin,searchtermexceptions) return false
+if(fullurlin,searchterms) setsearchterm
+if(returnset) return true
+
+# Placeholder functions for user hooks
+# Allow user code to be actioned at the start of key functions
+# If hook function returns false (default) processing continues
+# in parent function
+# if hook function returns true parent function exits with true
+#
+function(hook_checkrequest)
+function(hook_checkresponse)
+function(hook_thttps-checkrequest)
+function(hook_icap-checkrequest)
+function(hook_icap-checkresponse)
+function(hook_localcheckrequest)
+function(hook_localsslrequestcheck)
+function(hook_localsslcheckrequest)
+function(hook_sslrequestcheck)
+function(hook_icapsslrequestcheck)

compose/e2guardian/contentscanners/avastdscan.conf

@@ -0,0 +1,12 @@
+plugname = 'avastdscan'
+
+# edit this to match the location of your AvastD UNIX domain socket
+#avastdudsfile = '/var/run/avast4/local.sock'
+
+# edit this to block unscannable files (e.g. encrypted archives)
+#archivewarn = off
+
+#Specify the version of avast protocol. It Must be 'avast4' or 'avast2014'
+#default is avast4 for compatibility
+avastprotocol = 'avast4'
+

compose/e2guardian/contentscanners/clamdscan.conf

@@ -0,0 +1,13 @@
+plugname = 'clamdscan'
+
+# edit this to match the location of your ClamD UNIX domain socket
+#clamdudsfile = '/var/run/clamav/clamd.sock'
+
+# If this string is set, the text it contains shall be removed from the
+# beginning of filenames when passing them to ClamD.
+# Use it to - for example - support a ClamD running inside a chroot jail:
+# if DG's filecachedir is set to "/var/clamdchroot/downloads/" and pathprefix
+# is set to "/var/clamdchroot", then file names given to ClamD will be of the
+# form "/downloads/tf*" instead of "/var/clamdchroot/downloads/tf*".
+#pathprefix = '/var/clamdchroot'
+

compose/e2guardian/contentscanners/commandlinescan.conf

@@ -0,0 +1,45 @@
+plugname = 'commandlinescan'
+
+# Program to run & initial arguments - filename for scanning will be appended
+#progname = /path/to/scanner
+
+# At least one of the following three options must be defined!
+# They are checked in the following order, with the first match determining
+# the scan result:
+# virusregexp - regular expression for extracting virus names from
+#               the scanner's output
+# cleancodes - program return code(s), as a comma-separated list, for
+#              uninfected files
+# infectedcodes - program return code(s), as a comma-separated list, for
+#                 infected files
+
+#virusregexp = (someregexp)
+
+# Which submatch of the above contains the virus name? (0 = all matched text)
+#submatch = 1
+
+# cleancodes = 0
+# infectedcodes = 1,2,3
+
+# Default result when none of the other options triggers a match
+# Valid values are "infected" and "clean"
+#defaultresult = infected
+
+
+
+#
+# Example configuration for clamdscan
+#
+
+## Path to binary
+#progname = '/usr/bin/clamdscan'
+
+## Program returns 0 for clean files (for an easy out)
+#cleancodes = 0
+
+## Regular expression for virus names
+#virusregexp = : ([ -/a-zA-Z0-9\.]+) FOUND
+#submatch = 1
+
+## Default scan result when the above don't match
+#defaultresult = infected

compose/e2guardian/contentscanners/icapscan.conf

@@ -0,0 +1,8 @@
+plugname = 'icapscan'
+
+# ICAP URL
+# Use hostname rather than IP address
+# Always specify the port
+#
+icapurl = 'icap://icapserver:1344/avscan'
+

compose/e2guardian/contentscanners/kavdscan.conf

@@ -0,0 +1,13 @@
+plugname = 'kavdscan'
+
+# edit this to match the location of your KAVD UNIX domain socket
+#kavdudsfile = '/var/run/aveserver'
+
+# If this string is set, the text it contains shall be removed from the
+# beginning of filenames when passing them to KAVD.
+# Use it to - for example - support a KAVD running inside a chroot jail:
+# if DG's filecachedir is set to "/var/kavdchroot/downloads/" and pathprefix
+# is set to "/var/kavdchroot", then file names given to KAVD will be of the
+# form "/downloads/tf*" instead of "/var/kavdchroot/downloads/tf*".
+#pathprefix = '/var/kavdchroot'
+

compose/e2guardian/downloadmanagers/default.conf

@@ -0,0 +1,17 @@
+# The default download manager.
+# This is the safest option for unknown user-agents and content types, and
+# hence a good one to include last.
+
+# Which plugin should be loaded?
+plugname = 'default'
+
+# Regular expression for matching user agents
+# When not defined, matches all agents.
+#useragentregexp = '.*'
+
+# Lists of mime types and extensions to manage
+# When not defined, matches everything.
+# These can be enabled separately; when both enabled,
+# a request may match either list.
+#managedmimetypelist = ''
+#managedextensionlist = ''

compose/e2guardian/e2guardianf1.conf

@@ -0,0 +1,882 @@
+# e2guardian filter group config file for version 5.4.4
+
+# This file is re-read on gentle restart and any changes actioned
+
+### Filtergroup config is now split into sections as follows
+###
+### QUICK_START         - Items to check to get you started
+### MITM                - SSL MITM settings
+### URL_FILTERING       - URL filtering settings
+### URL_MAIN_LISTS	- URL/SITE lists - for downloaded lists(?)
+### URL_LOCAL_LISTS	- URL/SITE lists - local
+### FILE_TYPES		- Lists that control download filetype access
+### TIMES		- Time based lists
+### APPS		- Lists to control apps/browsers
+### REFERER		- Lists to allow exceptions based on referer site/url
+### URL_MOD		- Lists to modify url and ssl site target
+### REDIRECT		- Redirection list
+### LOG_ONLY		- Categorise and log but do not filter lists
+### POST		- Post filtering - not implimented yet in v5
+### PHRASES             - Content phrase settings and lists
+### SEARCH		- Search term filtering settings and lists
+### AV_SCANNERS         - AV scanner settings and lists
+### HEADER              - HTTP Header handling
+### BLOCK_PAGE          - Block Page formats and handling
+### BYPASS		- Bypass settings and lists
+### EMAILER		- Emailer settings (experimental)
+### OBSOLETE            - Obsolete settings
+### INFO                - Info on new features etc
+###
+
+
+### QUICK_START section
+###
+### e2guardian will work using examplef1.story 
+### and the example.group sub-directory of the lists directory
+### without you making any changes to this file.
+###
+### The items you are likely to need to change in production are 
+### in this section.
+### 
+### To set up for production:-
+###
+### In config directory:-
+###   Copy examplef1.story to group1.story
+### In list directory:-
+###   Create a group1 directory
+###   Copy the lists in lists/example.group into this directory
+###	and edit them to your requirements
+### Comment out .define.., and storyboard = lines below.
+###
+### To add group two:-
+###
+### Copy this file to e2guardianf2.conf
+### and repeat above steps, but for group2.story, lists/group2 directory etc
+###
+### Repeat for any further groups
+###
+### Remember to adjust the 'filtergroups' setting in e2guardian.conf
+### to the number of groups you now have.
+
+#groupname = 'my_name_for_group'
+#
+# Filter group name
+# Used to fill in the -FILTERGROUP -placeholder in the HTML template file, and to
+# name the group in the access logs
+# Default 'group1' where 1 is the group number
+
+storyboard = '/etc/e2guardian/examplef1.story'   # comment out for production
+#
+# Storyboard logic for this group
+#
+# defaults to '/etc/e2guardian/group1.story' where 1 is the group number
+
+.Define LISTDIR </etc/e2guardian/lists/example.group>  # comment out for production 
+# The directory path for list files for this group
+# This path replaces __LISTDIR__ wherever it occurs below or in included files.
+# See INFO section for full details
+# defaults (initialized) as </etc/e2guardian/lists/group1> where 1 is the group number
+ 
+#naughtynesslimit = 60
+#
+# Naughtiness limit
+# This the limit over which the page will be blocked.  Each weighted phrase is given
+# a value either positive or negative and the values added up.  Phrases to do with
+# good subjects will have negative values, and bad subjects will have positive
+# values.  See the weightedphraselist file for examples.
+# As a guide:
+# 60 is for young children,  100 for old children,  160 for young adults.
+# default 60
+
+###
+### END of QUICK_START section 
+
+
+### MITM section
+###
+
+# NOTE to enable SSL MITM 
+# enablessl must be defined as 'on' in e2guardian.conf
+
+#sslmitm = on
+#
+#SSL man in the middle
+# Forge ssl certificates for all non-exception sites, decrypt the data then re encrypt it
+# using a different private key. Used to filter ssl sites
+#default off
+
+# mitmcheckcert = on
+#
+# Enable MITM site certificate checking
+# ignored if  sslmitm is off
+# default (recommended) is 'on'
+
+#Do not check ssl certificates for sites listed
+# Can be used to allow sites with self-signed or invalid certificates
+# or to reduced CPU load by not checking certs on heavily used sites (e.g. Google, Bing)
+# Use with caution!
+# Ignored if mitmcheckcert is 'off'
+#
+sitelist = 'name=nocheckcert,path=__LISTDIR__/nocheckcertsitelist'
+ipsitelist = 'name=nocheckcert,path=__LISTDIR__/nocheckcertsiteiplist'
+#
+
+# automitm = on
+#
+# Auto switch to MITM with upstream connection error or to deliver block page
+# ignored if  sslmitm is off
+# To revert to v4 type behavour switch this off
+# Default is 'on'
+
+# greyssl lists only used in onlymitmsslgrey mode to define sites that
+# will be MITM
+
+sitelist = 'name=greyssl,path=__LISTDIR__/greysslsitelist'
+ipsitelist = 'name=greyssl,path=__LISTDIR__/greysslsiteiplist'
+
+sitelist = 'name=localgreyssl,path=__LISTDIR__/localgreysslsitelist'
+#ipsitelist = 'name=localgreyssl,path=__LISTDIR__/localgreysslsiteiplist'
+
+###
+### END of MITM section 
+
+
+### URL_FILTERING section
+###
+
+#deepurlanalysis = off
+# Enable Deep URL Analysis
+# When enabled, E2 looks for URLs within URLs, checking against the bannedsitelist and
+# bannedurllist. This can be used, for example, to block images originating from banned
+# sites from appearing in Google Images search results, as the original URLs are
+# embedded in the thumbnail GET requests.
+# (on|off) default = off
+
+###
+### END of URL_FILTERING section 
+
+
+### URL_MAINLISTS section
+###
+### Most of the site/ipsite/url lists in this section are used for
+### switching on/off standard list categories
+###
+### It is best to use the LOCAL lists for your own lists of sites/urls
+### As these override the main ones.
+
+## For info on the format of list definitions see notes/V5_list_definition
+
+## Order of checking is broadly as follows:-
+##
+## 1. If in Local Exception lists - allow with no further checking
+## 2. If in Local Grey lists - retrieve page and content-check
+## 3. If in Local Banned lists - block with no further checking
+## 4. If in Main Exception lists - allow with no further checking
+## 5. If in Main Grey lists - retrieve page and content-check
+## 6. If in Main Banned lists (or blanket blocked) - block with no further checking
+## 7. If gets here  - retrieve page and content-check
+## 8. Check blocked/exception file/mime types.
+## 9. Content-check page
+
+## Exception lists
+
+sitelist = 'name=exception,messageno=602,path=__LISTDIR__/exceptionsitelist'
+ipsitelist = 'name=exception,messageno=602,path=__LISTDIR__/exceptionsiteiplist'
+urllist = 'name=exception,messageno=603,path=__LISTDIR__/exceptionurllist'
+
+regexpboollist = 'name=exception,messageno=609,path=__LISTDIR__/exceptionregexpurllist'
+
+## Grey (i.e. content check) lists
+
+sitelist = 'name=grey,path=__LISTDIR__/greysitelist'
+ipsitelist = 'name=grey,path=__LISTDIR__/greysiteiplist'
+urllist = 'name=grey,path=__LISTDIR__/greyurllist'
+
+## Banned sites/urls
+
+sitelist = 'name=banned,messageno=500,path=__LISTDIR__/bannedsitelist'
+ipsitelist = 'name=banned,messageno=510,path=__LISTDIR__/bannedsiteiplist'
+urllist = 'name=banned,messageno=501,path=__LISTDIR__/bannedurllist'
+
+regexpboollist = 'name=banned,messageno=503,path=__LISTDIR__/bannedregexpurllist'
+
+# 'bannedssl' lists are not currently used
+#sitelist = 'name=bannedssl,messageno=520,path=__LISTDIR__/bannedsslsitelist'
+#ipsitelist = 'name=bannedssl,messageno=520,path=__LISTDIR__/bannedsslsiteiplist'
+
+###
+### END of URL_MAINLISTS section 
+
+
+### URL_LOCAL_LISTS section
+###
+### if you do not want to use local lists
+### then comment out (or remove) all the list entries in this section and
+### make adjustments to site.story
+###
+
+
+## Local Exception lists
+
+sitelist = 'name=localexception,messageno=662,path=__LISTDIR__/localexceptionsitelist'
+ipsitelist = 'name=localexception,messageno=662,path=__LISTDIR__/localexceptionsiteiplist'
+urllist = 'name=localexception,messageno=663,path=__LISTDIR__/localexceptionurllist'
+
+## Local Grey lists
+
+sitelist = 'name=localgrey,path=__LISTDIR__/localgreysitelist'
+ipsitelist = 'name=localgrey,path=__LISTDIR__/localgreysiteiplist'
+urllist = 'name=localgrey,path=__LISTDIR__/localgreyurllist'
+
+## Local Banned lists
+
+sitelist = 'name=localbanned,messageno=560,path=__LISTDIR__/localbannedsitelist'
+ipsitelist = 'name=localbanned,messageno=560,path=__LISTDIR__/localbannedsiteiplist'
+urllist = 'name=localbanned,messageno=561,path=__LISTDIR__/localbannedurllist'
+
+## Bannedssl lists are not currently used
+#sitelist = 'name=localbannedssl,messageno=580,path=__LISTDIR__/localbannedsslsitelist'
+#ipsitelist = 'name=localbannedssl,messageno=580,path=__LISTDIR__/localbannedsslsiteiplist'
+
+###
+### END of URL_LOCAL_LISTS section 
+
+### FILE_TYPES section
+###
+
+# Uncomment the two lines below if want to ONLY allow extentions/mime types in these lists
+# You will also need to uncomment the checkfiletype function in site.story to enable this
+#fileextlist = 'name=exceptionextension,path=__LISTDIR__/exceptionextensionlist'
+#mimelist = 'name=exceptionmime,path=__LISTDIR__/exceptionmimetypelist'
+
+
+# Use the following lists to block specific kinds of file downloads.
+#
+fileextlist = 'name=bannedextension,messageno=900,path=__LISTDIR__/bannedextensionlist'
+mimelist = 'name=bannedmime,messageno=800,path=__LISTDIR__/bannedmimetypelist'
+
+#
+# In either file filtering mode, the following lists can be used to override
+# MIME type & extension blocks for particular domains & URLs (trusted download sites).
+#
+sitelist = 'name=exceptionfile,path=__LISTDIR__/exceptionfilesitelist'
+ipsitelist = 'name=exceptionfile,path=__LISTDIR__/exceptionfilesiteiplist'
+urllist = 'name=exceptionfile,path=__LISTDIR__/exceptionfileurllist'
+
+###
+### END of FILE_TYPES section 
+
+### TIMES section
+###
+
+# NEW in v5.4 bannedtimelist - times when no access is allowed
+# To activate a storyboard change is required - see examplef1.story
+#timelist = 'name=bannedtimes,messageno=122,path=__LISTDIR__/bannedtimelist'
+
+# NEW in v5.4 blankettimelist - times when blanket block is applied
+# To activate a storyboard change is required - see examplef1.story
+#timelist = 'name=blankettimes,messageno=122,path=__LISTDIR__/blankettimelist'
+
+###
+### END of TIMES section 
+
+### APPS section
+###
+### These lists are useful for allowing/blocking apps or browsers based 
+### on the user-agent
+
+regexpboollist = 'name=banneduseragent,messageno=522,path=__LISTDIR__/bannedregexpuseragentlist'
+
+regexpboollist = 'name=exceptionuseragent,messageno=610,path=__LISTDIR__/exceptionregexpuseragentlist'
+
+###
+### END of APPS section 
+
+### REFERER section
+###
+
+# refererexception lists are used to make a request an exception based on the
+# Referer header.
+
+sitelist = 'name=refererexception,messageno=620,path=__LISTDIR__/refererexceptionsitelist'
+ipsitelist = 'name=refererexception,messageno=620,path=__LISTDIR__/refererexceptionsiteiplist'
+urllist = 'name=refererexception,messageno=620,path=__LISTDIR__/refererexceptionurllist'
+
+# Some sites have the referering url in their url. Put these url in these
+# lists and e2g will extract the embeded url and then check this againist
+# the refererexception lists.  
+# For best results be as specific as possible
+
+sitelist = 'name=embededreferer,path=__LISTDIR__/../common/embededreferersitelist'
+ipsitelist = 'name=embededreferer,path=__LISTDIR__/../common/embededreferersiteiplist'
+urllist = 'name=embededreferer,path=__LISTDIR__/../common/embededrefererurllist'
+
+
+###
+### END of REFERER section 
+
+### URL_MOD section
+###
+
+# change list is used to modify url on the fly
+# use to enforce safe search etc.
+# Do not try and change target site - use redirect for this.
+regexpreplacelist = 'name=change,path=__LISTDIR__/urlregexplist'
+
+# Replace target connection site for a ssl connection request
+# Note: this does not change the url in any way. It just changes
+# where the request is sent upstream and the new target must accept 
+# the original url. 
+regexpreplacelist = 'name=sslreplace,path=__LISTDIR__/sslsiteregexplist'
+
+###
+### END of URL_MOD section 
+
+
+### REDIRECT section
+###
+
+# Used to redirect browser to different site and or url
+regexpreplacelist = 'name=redirect,path=__LISTDIR__/urlredirectregexplist'
+
+###
+### END of REDIRECT section 
+
+
+### LOG_ONLY section
+###
+
+# Categorise without blocking:
+
+# Supply categorised lists here and the category string shall be logged against
+# matching requests, but matching these lists does not perform any filtering
+# action.
+#sitelist = 'name=log,path=__LISTDIR__/logsitelist'
+#ipsitelist = 'name=log,path=__LISTDIR__/logsiteiplist'
+#urllist = 'name=log,path=__LISTDIR__/logurllist'
+#regexpboollist = 'name=log,path=__LISTDIR__/logregexpurllist'
+
+###
+### END of LOG_ONLY section 
+
+
+### POST section
+###
+
+#maxuploadsize = -1
+#
+# POST protection (web upload and forms)
+# does not block forms without any file upload, i.e. this is just for
+# blocking or limiting uploads
+# measured in kibibytes after MIME encoding and header bumph
+# use 0 for a complete block
+# use higher (e.g. 512 = 512Kbytes) for limiting
+# use -1 for no blocking
+# NOTE: POST PROTECTION IS NOT YET IMPLIMENTED IN V5
+#maxuploadsize = 512
+#maxuploadsize = 0
+# default -1
+
+###
+### END of POST section 
+
+
+### ACCESS_LOG section
+###
+
+# Do not log sites/urls/ext
+# Useful to prevent requests not made by user directly being logged
+# Makes logs more readable
+sitelist = 'name=nolog,path=__LISTDIR__//../common/nologsitelist'
+ipsitelist = 'name=nolog,path=__LISTDIR__//../common/nologsiteiplist'
+urllist = 'name=nolog,path=__LISTDIR__//../common/nologurllist'
+regexpboollist = 'name=nolog,path=__LISTDIR__//../common/nologregexpurllist'
+fileextlist = 'name=nolog,path=__LISTDIR__//../common/nologextensionlist'
+
+###
+### END of ACCESS_LOG section 
+
+
+### PHRASES section
+###
+
+#weightedphrasemode = 0
+# Weighted phrase mode
+# Optional; overrides the weightedphrasemode option in e2guardian.conf
+# for this particular group.  See documentation for supported values in
+# that file.
+
+# textmimetypes = 'application/xhtml+xml,application/xml,application/json,application/javascript,application/x-javascript'
+#
+# Phrase filter additional mime types (by default just text/*)
+
+categorydisplaythreshold = 0
+#
+# Category display threshold
+# This option only applies to pages blocked by weighted phrase filtering.
+# Defines the minimum score that must be accumulated within a particular
+# category in order for it to show up on the block pages' category list.
+# All categories under which the page scores positively will be logged; those
+# that were not displayed to the user appear in brackets.
+#
+# -1 = display only the highest scoring category
+# 0 = display all categories (default)
+# > 0 = minimum score for a category to be displayed
+
+
+bannedphraselist = '__LISTDIR__/bannedphraselist'
+weightedphraselist = '__LISTDIR__/weightedphraselist'
+exceptionphraselist = '__LISTDIR__/exceptionphraselist'
+## To use oldphraselists comment out last 3 lines and
+## uncomment the follwing 3 lines
+#bannedphraselist = '__LISTDIR__/oldbannedphraselist'
+#weightedphraselist = '__LISTDIR__/oldweightedphraselist'
+#exceptionphraselist = '__LISTDIR__/oldexceptionphraselist'
+
+###
+### END of PHRASES section 
+
+
+### SEARCH section
+###
+
+# Search term blocking
+# Search terms can be extracted from search URLs and filtered using one or
+# both of two different methods.
+
+# Method 1 is that developed by Protex where specific
+# search terms are contained in a bannedsearchlist.
+# (localbannedsearchlist and bannedsearchoveridelist can be used to suppliment
+# and overide this list as required.)
+# These lists contain banned search words combinations on each line.
+# Words are separated by '+' and must be in sorted order within a line.
+#    so to block 'sexy girl' then the list must contain the line
+#       girl+sexy
+#    and this will block both 'sexy girl' and 'girl sexy'
+# To use this method, the searchregexplist must be enabled and the bannedsearchlist(s) defined
+
+# Method 2 is uses the
+# bannedphraselist, weightedphraselist and exceptionphraselist, with a separate
+# threshold for blocking than that used for normal page content.
+# To do this, the searchregexplist must be enabled and searchtermlimit
+# must be greater than 0.
+
+# Search engine regular expression list (need for both options)
+# List of regular expressions for matching search engine URLs.  It is assumed
+# that the search terms themselves will be contained in the
+# of output of each expression.
+regexpreplacelist = 'name=searchterms,path=__LISTDIR__/../common/searchregexplist'
+# search engine regexp exception (overide) list
+# Used to prevent urls such os completetion suggestion requests from being detected
+# as search requests
+regexpboollist = 'name=searchtermexceptions, path=__LISTDIR__/../common/searchexceptionregexplist'
+
+# Search Term list(s) for option 1
+searchlist = 'name=banned,path=__LISTDIR__/bannedsearchlist'
+searchlist = 'name=override,path=__LISTDIR__/bannedsearchoveridelist'
+
+searchlist = 'name=localbanned,messageno=581,path=__LISTDIR__/localbannedsearchlist'
+
+#searchtermlimit = 0
+#
+# Search term limit (for Option 2)
+# The limit over which requests will be blocked for containing search terms
+# which match the weightedphraselist.  This should usually be lower than the
+# 'naughtynesslimit' value above, because the amount of text being filtered
+# is only a few words, rather than a whole page.
+# This option must be uncommented if searchregexplist is uncommented.
+# A value of 0 here indicates that search terms should be extracted,
+# but no phrase filtering should be performed on the resulting text.
+
+# Search term phrase lists (for Option 2)
+# If the three lines below are uncommented, search term blocking will use
+# the banned, weighted & exception phrases from these lists, instead of using
+# the same phrase lists as for page content.  This is optional but recommended,
+# as weights for individual phrases in the "normal" lists may not be
+# appropriate for blocking when those phrases appear in a much smaller block
+# of text.
+# Please note that all or none of the below should be uncommented, not a
+# mixture.
+# NOTE: these are phrase lists and still use the old style defines
+#bannedsearchtermlist = '__LISTDIR__/bannedsearchtermlist'
+#weightedsearchtermlist = '__LISTDIR__/weightedsearchtermlist'
+#exceptionsearchtermlist = '__LISTDIR__/exceptionsearchtermlist'
+
+###
+### END of SEARCH section 
+
+
+### AV_SCANNERS section
+###
+
+#disablecontentscan = off
+#
+# Disable content scanning
+# If you enable this option you will disable content scanning for this group.
+# Content scanning primarily is AV scanning (if enabled) but could include
+# other types.
+# (on|off) default = off.
+
+#disablecontentscanerror = off
+#
+# Disable content scanning with error (timeout, AV crash, etc)
+# If you enable this option you will allow object with an unexpected result
+# Content scanning primarily is AV scanning (if enabled) but could include
+# other types.
+# With "on" you can allow INFECTED objects
+# (on|off) default = off. (default and highly recommended)
+
+#contentscanexceptions = off
+#
+# If 'on' exception sites, urls, users etc will be scanned
+# This is probably not desirable behavour as exceptions are
+# supposed to be trusted and will increase load.
+# Correct use of grey lists are a better idea.
+# (on|off) default = off
+
+#Virus checking exceptions - matched urls will not be virus checked
+#Note that you also need to amend site.story in order for this to work.
+#mimelist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirusmimetypelist'
+#fileextlist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirusextensionlist'
+#sitelist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirussitelist'
+#ipsitelist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirussiteiplist'
+#urllist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirusurllist'
+
+###
+### END of AV_SCANNERS section 
+
+
+### HEADER section
+###
+
+# Outgoing HTTP request header rules:
+# Lists for blocking based on, and modification of, outgoing HTTP
+# request headers.  Format for headerregexplist is one modification rule per
+# line, similar to content/URL modifications.  Format for
+# bannedregexpheaderlist is one regular expression per line, with matching
+# headers causing a request to be blocked.
+# Headers are matched/replaced on a line-by-line basis, not as a contiguous
+# block.
+# Use for example, to remove cookies or prevent certain user-agents.
+regexpreplacelist = 'name=headermods,path=__LISTDIR__/headerregexplist'
+regexpboollist = 'name=bannedheader,path=__LISTDIR__/bannedregexpheaderlist'
+regexpboollist = 'name=exceptionheader,path=__LISTDIR__/exceptionregexpheaderlist'
+# add cookies etc
+regexpreplacelist = 'name=addheader,path=__LISTDIR__/addheaderregexplist'
+
+# Response HTTP header rules:
+# Lists for modification or removal of HTTP response headers.
+# Format for reponseheaderregexplist is one rule per line, similar to
+# content/URL modifications.
+# Headers are matched/replaced on a line-by-line basis, not as a contiguous
+# block.
+# Use for example, to remove protocol upgrade requests.
+regexpreplacelist = 'name=reponseheadermods,path=__LISTDIR__/responseheaderregexplist'
+
+###
+### END of HEADER section 
+
+
+### BLOCK_PAGE section
+###
+
+#reportinglevel = 3
+#
+#
+# -1 = log, but do not block - Stealth mode
+#  0 = just say 'Access Denied'
+#  1 = report why but not what denied phrase
+#  2 = report fully
+#  3 = use HTML template file (accessdeniedaddress ignored) - recommended
+#
+# If defined, this overrides the global setting in e2guardian.conf for
+# members of this filter group.
+
+#accessdeniedaddress = 'http://YOURSERVER.YOURDOMAIN/cgi-bin/e2guardian.pl'
+#
+# accessdeniedaddress is the address of your web server to which the cgi
+# e2guardian reporting script was copied. Only used in reporting levels
+# 1 and 2.
+#
+# This webserver must be either:
+#  1. Non-proxied. Either a machine on the local network, or listed as an
+#     exception in your browser's proxy configuration.
+#  2. Added to the exceptionsitelist. Option 1 is preferable; this option is
+#     only for users using both transparent proxying and a non-local server
+#     to host this script.
+#
+
+#nonstandarddelimiter = off
+#
+# Non standard delimiter (only used with accessdeniedaddress)
+# To help preserve the full banned URL, including parameters, the variables
+# passed into the access denied CGI are separated using non-standard
+# delimiters. This can be useful to ensure correct operation of the filter
+# bypass modes. Parameters are split using "::" in place of "&", and "==" in
+# place of "=".
+# Default is enabled, but to go back to the standard mode, disable it.
+
+#htmltemplate = 'custom.html'
+#
+# HTML Template override
+# If defined, this specifies a custom HTML template file for members of this
+# filter group, overriding the global setting in e2guardian.conf. This is
+# only used in reporting level 3.
+#
+# The default template file path is <languagedir>/<language>/template.html
+# e.g. /usr/share/e2guardian/languages/ukenglish/template.html when using 'ukenglish'
+# language.
+#
+# This option generates a file path of the form:
+# <languagedir>/<language>/<htmltemplate>
+# e.g. /usr/share/e2guardian/languages/ukenglish/custom.html
+
+#neterrtemplate = 'custom_neterr_template.html' 
+#
+#Template for use to report network issues and sites which are not responding
+# The default template file path is <languagedir>/<language>/neterr_template.html
+# e.g. /usr/share/e2guardian/languages/ukenglish/neterr_template.html when using 
+# 'ukenglish' language.
+
+
+
+###
+### END of BLOCK_PAGE section 
+
+
+### BYPASS section
+###
+
+#bypass = 0
+#
+# Temporary Denied Page Bypass
+# This provides a link on the denied page to bypass the ban for a few minutes.  To be
+# secure it uses a random hashed secret generated at daemon startup.  You define the
+# number of seconds the bypass will function for before the deny will appear again.
+# To allow the link on the denied page to appear you will need to edit the template.html
+# or e2guardian.pl file for your language.
+# 300 = enable for 5 minutes
+# 0 = disable ( defaults to 0 )
+# -1 - depreciated - for backward compatability enables cgibypass with bypassversion 1
+
+bypassversion = 2
+#
+# Byapss version 2 provides a secure cgi communication (see notes/cgi_bypass documentation)
+#
+# Bypass version
+# can be 1 or 2
+# Always use v2 unless you have old style cgi hash generation in use
+# Default is 1
+
+# cgibypass = 'off'
+#
+# cgibypass - Use a separate program/CGI to (in v1 generate) or (in v2 validate) link
+# 'on' or 'off' (default)
+
+#bypasskey = ''
+#
+# Temporary Denied Page Bypass Secret Key
+# Rather than generating a random key you can specify one.  It must be more than 8 chars.
+# '' = generate a random one (recommended and default)
+# 'Mary had a little lamb.' = an example
+# '76b42abc1cd0fdcaf6e943dcbc93b826' = an example
+
+cgikey = 'you must change this text in order to be secure'
+# magic key for cgi bypass v2 - used to sign communications between e2g and cgi
+# default is blank
+
+
+# Users will not be able to bypass sites/urls in these lists
+sitelist = 'name=bannedbypass,messageno=500,path=__LISTDIR__/domainsnobypass'
+#ipsitelist = 'name=bannedbypass,messageno=500,path=__LISTDIR__/ipnobypass'
+#urllist = 'name=bannedbypass,messageno=501,path=__LISTDIR__/urlnobypass'
+
+#infectionbypass = 0
+#
+# Infection/Scan Error Bypass
+# Similar to the 'bypass' setting, but specifically for bypassing files scanned and found
+# to be infected, or files that trigger scanner errors - for example, archive types with
+# recognised but unsupported compression schemes, or corrupt archives.
+# The option specifies the number of seconds for which the bypass link will be valid.
+# 300 = enable for 5 minutes
+# 0 = disable (default)
+# -1 - depreciated - for backward compatability enables cgiinfectionbypass with bypassversion 1
+
+# cgiinfectionbypass = 'off'
+#
+# cgiinfectionbypass - Use a separate program/CGI to (v1 generate) or (v2 validate) link
+# 'on' or 'off' (default)
+
+#infectionbypasskey = ''
+#
+# Infection/Scan Error Bypass Secret Key
+# Same as the 'bypasskey' option, but used for infection bypass mode.
+
+#infectionbypasserrorsonly = on
+#
+# Infection/Scan Error Bypass on Scan Errors Only
+# Enable this option to allow infectionbypass links only when virus scanning fails,
+# not when a file is found to contain a virus.
+# on = enable (default and highly recommended)
+# off = disable
+
+
+###
+### END of BYPASS section 
+
+
+### EMAILER section
+###
+### Note this is experimental in v5 - not supported by maintainers
+
+# Email reporting - original patch by J. Gauthier
+
+#usesmtp = off   #NOT YET TESTED
+#
+# If on, will enable system wide events to be reported by email.
+# need to configure mail program (see 'mailer' in global config)
+# and email recipients
+# default usesmtp = off
+
+#mailfrom = ''
+#
+# who the email would come from
+# example: mailfrom = 'e2guardian@mycompany.com'
+
+#avadmin = ''
+#
+# who the virus emails go to (if notify av is on)
+# example: avadmin = 'admin@mycompany.com'
+
+#contentadmin = ''
+#
+# who the content emails go to (when thresholds are exceeded)
+# and contentnotify is on
+# example: contentadmin = 'admin@mycompany.com'
+
+#avsubject = 'e2guardian virus block'
+#
+# Subject of the email sent when a virus is caught.
+# only applicable if notifyav is on
+# default avsubject = 'e2guardian virus block'
+
+#contentsubject = 'e2guardian violation'
+#
+# Subject of the email sent when violation thresholds are exceeded
+# default contentsubject = 'e2guardian violation'
+
+#notifyav = off
+#
+# This will send a notification, if usesmtp/notifyav is on, any time an
+# infection is found.
+# Important: If this option is off, viruses will still be recorded like a
+# content infraction.
+
+#notifycontent = off
+#
+# This will send a notification, if usesmtp is on, based on thresholds
+# below
+
+#thresholdbyuser = off
+#
+# results are only predictable with user authenticated configs
+# if enabled the violation/threshold count is kept track of by the user
+
+#violations = 0
+#
+# number of violations before notification
+# setting to 0 will never trigger a notification
+
+#threshold = 0
+#
+# this is in seconds. If 'violations' occur in 'threshold' seconds, then
+# a notification is made.
+# if this is set to 0, then whenever the set number of violations are made a 
+# notifaction will be sent.
+
+###
+### END of EMAILER section 
+
+
+### OBSOLETE section
+###
+
+# groupmode = 1 #DISABLED
+# Filter group mode IS NOT LONGER SUPPORTED
+# Unauthenticated users are treated as being in the default filter group.
+
+# ssllegacylogic = off
+# Enable legacy (E2) ssl logic
+# The option is replaced by storyboard logic
+
+#sslcertcheck = off - NOT implimented in V5 yet
+#SSL certificate checking
+# Check that ssl certificates for servers on https connections are valid
+# and signed by a ca in the configured path
+# ONLY for connections that are NOT MITM
+
+# bannedregexwithblanketblock = off
+# option is replaced by storyboard logic
+
+#blockdownloads = off
+# option is replaced by storyboard logic
+
+#embeddedurlweight = 0
+#  - NOT implimented in v5
+# Embedded URL weighting
+# When set to something greater than zero, this option causes URLs embedded within a
+# page's HTML (from links, image tags, etc.) to be extracted and checked against the
+# bannedsitelist and bannedurllist. Each link to a banned page causes the amount set
+# here to be added to the page's weighting.
+# The behaviour of this option with regards to multiple occurrences of a site/URL is
+# affected by the weightedphrasemode setting.
+#
+# NB: Currently, this feature uses regular expressions that require the PCRE library.
+# As such, it is only available if you compiled e2guardian with '--enable-pcre=yes'.
+# You can check compile-time options by running 'e2guardian -v'.
+#
+# Set to 0 to disable.
+# Defaults to 0.
+# WARNING: This option is highly CPU intensive!
+
+#onlymitmsslgrey = off  - ignored in V5
+#Limit SSL MITM to sites in greysslsitelist(s)
+# ignored if  sslmitm is off
+# SSL sites not matching greysslsitelist will be treat as if sslmitm is off.
+# The option is replaced by storyboard logic
+
+#contentregexplist = '__LISTDIR__/contentregexplist'
+#
+# not yet implemented in v5
+
+###
+### END of OBSOLETE section 
+
+
+
+### INFO section
+###
+### No settings just info on new features etc
+
+# New in v5.4.2:- relative paths
+# Relative paths can used in .Include<> and list files.
+#       The directory of current file will be insert where the file name
+#       does not start with '/'
+
+
+# Also NEW in v5.4.2 - LISTDIR 'variable' definition
+# LISTDIR can be defined in .conf files.
+# This allows for more readable configuration and for templating.
+# This works similarly to a shell environment variable
+# The text between <> will replace occurances of __LISTDIR__ in .conf and
+#       list files.
+# Note: Currently only LISTDIR may be defined.
+#
+# The mapping is actioned as the file is read and is valid until another LISTDIR
+#       is defined later in the file, or in an included .conf file.
+#
+# The scope of LISTDIR is in the rest of file it is defined in and all
+# .Include<> files or list files in that portion of the file.
+
+###
+### END of INFO section

compose/e2guardian/examplef1.story

@@ -0,0 +1,66 @@
+.Include</etc/e2guardian/common.story>
+.Include</etc/e2guardian/site.story>
+
+# Add any altered functions for this filtergroup here
+# They will overwrite library or site level definitions
+
+# To allow unfiltered access to this group 
+# uncomment next 4 lines
+#function(checkrequest)
+#if(true) return setexception
+#function(thttps-checkrequest)
+#if(true) return setexception
+
+# To block all access to this group 
+# uncomment next 4 lines
+#function(checkrequest)
+#if(true,,105) return setblock
+#function(sslexceptioncheck)
+#function(localsslcheckrequest)
+
+# To block all access to this group at certain times
+# define times in bannedtimelist,
+# uncomment the list definition for 'bannedtimes' in e2guardianfn.conf,
+# and uncomment the next 2 lines 
+#function(checktimesblocked)
+#if(timein,bannedtimes) return true
+
+# Note: Blanket blocks are checked after exceptions
+# and can be used to make a 'walled garden' filtergroup
+
+# To create blanket block for http (and MITM https)
+# uncomment next line and one condition line.
+#function(checkblanketblock)
+#if(true,,502) return setblock  # = ** total blanket
+#if(siteisip,,505) return setblock  # = *ip ip blanket
+
+# To use timed blanket block 
+# define times in blankettimelist,
+# uncomment the list definition for 'blankettimes' in e2guardianfn.conf,
+# and uncomment the next line 
+#if(timein,blankettimes) return setblock
+
+# To create blanket block for SSL 
+# uncomment next line and one condition line.
+#function(sslcheckblanketblock)
+#if(true,,506) return setblock  # = **s total blanket
+#if(siteisip,,507) return setblock  # = **ips ip blanket
+
+# To limit MITM to sslgreylist
+# replaces onlymitmsslgrey e2guardianf1.conf option
+# uncomment the next 2 lines
+#function(sslcheckmitm)
+#if(true) return sslcheckmitmgreyonly
+
+# SNI checking - overrides default action when no SNI or TSL is present on a 
+#    THTTPS connection
+# To allow (tunnell) non-tls and/or non-sni connections uncomment the next 3 lines
+#function(checksni)
+#ifnot(tls,,511) return setexception  # change to setblock to block only non-tls
+#ifnot(hassniset,,512) return setexception
+
+# automitm - overrides default action when thttps
+# To disable automitm for trans https uncomment the next 2 lines
+# function(thttps_automitm)
+# if(true) unsetautomitm
+

compose/e2guardian/lists/README

@@ -0,0 +1,24 @@
+README for lists directory
+
+All lists have now been moved into sub-directories
+
+As before plugins have their own directories for lists and mappings
+used by plugins
+
+Sub-directories:
+
+authplugins      - lists/maps used by authplugins
+blacklists	 - placeholder for 3rd party url lists
+common           - lists used by e2guardian.conf and common lists for groups
+contentscanners  - lists used by content/AV scanners
+downloadmanagers - lists used by downloadmanagers
+example.group	 - example lists for group use used by e2guardianf1.conf
+group1		 - lists for group 1
+group2		 - lists for group 2
+...
+groupn		 - lists for group n
+oldphraselists	 - old style format phraselists
+phraselists	 - lists of phrases
+rooms      	 - location (ip) based block/allow
+
+

compose/e2guardian/lists/authplugins/filtergroupslist

@@ -0,0 +1,10 @@
+# Filter Groups List file for e2guardian
+#
+# Format is <user>=<1-99> where 1-99 are the groups
+# Legacy format is also recognised: <user>=filter<1-99> where 1-99 are the groups
+#
+# Eg:
+# daniel=2
+#
+# This file is only of use if you have more than 1 filter group
+#

compose/e2guardian/lists/authplugins/ipgroups

@@ -0,0 +1,11 @@
+# IP-Group list
+# Used by the IP-based auth plugin to assign IP addresses to filter groups.
+#
+# Examples:
+# Straight IP matching:
+#192.168.0.1 = filter1
+# Subnet matching:
+#192.168.1.0/255.255.255.0 = filter1
+# Range matching:
+#192.168.1.0-192.168.1.255 = filter1
+

compose/e2guardian/lists/authplugins/portgroups

@@ -0,0 +1,8 @@
+# Port-Group list
+# Used by the Port-based auth plugin to assign Ports to filter groups.
+#
+# Note that ports MUST be entered in ascending order
+#
+# Examples:
+#8080 = filter1
+#8081 = filter2

compose/e2guardian/lists/common/README

@@ -0,0 +1,73 @@
+README for lists/common directory
+
+### Lists held in this directory:-
+
+## Lists defined in e2guardian.conf
+
+# Sites that are impossible or undesirable to MITM
+#
+nomitmsitelist
+nomitmsiteiplist
+
+
+# Banned clients
+#
+bannediplist
+# ONLY for banned client IP
+#
+exceptioniplist
+# ONLY for exception client IP
+#
+bannedclientlist
+# Put client dns names in bannedclientlist if required
+exceptionclientlist
+# Put client dns names in exceptionclientlist if required
+
+# Auth exceptions
+# Target Sites/Urls allowed before authentication
+# to allow for machines to update without user authentication
+#
+authexceptioniplist
+authexceptionsitelist
+authexceptionurllist
+
+browserregexpboollist
+#
+# List of regexp that match match User-agent of browsers
+# Used to determine if client is a browser
+# and decide whether to send a block page or go MITM
+
+
+## Lists common to all groups (defined in e2guardianfn.conf)
+
+
+# Embeded referer
+# Some sites have the referering url in their url. Put these url in these
+# lists and e2g will extract the embeded url and then check this againist
+# the refererexception lists.
+# For best results be as specific as possible
+embededreferersitelist
+embededreferersiteiplist
+embededrefererurllist
+
+# Nolog lists
+# Do not log sites/urls/ext
+# Useful to prevent requests not made by user directly being logged
+# Makes logs more readable
+nologsitelist
+nologsiteiplist
+nologurllist
+nologregexpurllist
+nologextensionlist
+
+# Search engine regular expression list 
+# List of regular expressions for matching search engine URLs.  It is assumed
+# that the search terms themselves will be contained in the
+# of output of each expression.
+searchregexplist
+#
+# search engine regexp exception (overide) list
+# Used to prevent urls such os completetion suggestion requests from being detected
+# as search requests
+searchexceptionregexplist
+

compose/e2guardian/lists/common/authexceptioniplist

@@ -0,0 +1,9 @@
+#Access allowed prior to authentication
+# IP site addresses 
+#
+# Single IPs, ranges and subnets can be used,
+# e.g.
+# 192.168.0.1
+# 10.0.0.1-10.0.0.3
+# 10.0.0.0/24
+#

compose/e2guardian/lists/common/authexceptionsitelist

@@ -0,0 +1 @@
+#Access allowed prior to authentication

compose/e2guardian/lists/common/authexceptionurllist

@@ -0,0 +1 @@
+#Access allowed prior to authentication

compose/e2guardian/lists/common/bannedclientlist

@@ -0,0 +1,6 @@
+# Domain names of client machines to
+# disallow web access to.
+#
+# This is not the the domains of web servers
+# you want to filter.
+

compose/e2guardian/lists/common/bannediplist

@@ -0,0 +1,12 @@
+# IP addresses of client machines to
+# disallow web access to.
+#
+# This is not the IP of web servers
+# you want to filter.
+
+# Single IPs, ranges and subnets can be used,
+# e.g.
+# 192.168.0.1
+# 10.0.0.1-10.0.0.3
+# 10.0.0.0/24
+#

compose/e2guardian/lists/common/browserregexplist

@@ -0,0 +1,15 @@
+# Reg Exp to check user-agent shows request is from a browser
+#
+# The format is: "extended regular expression"
+
+(Firefox/)
+(Chrome/)
+(MSIE/)
+(Opera/)
+(Safari/)
+(Edge/)
+
+# curl and wget are not browsers - but are often used for testing
+# so are included below
+(curl/)
+(wget/)

compose/e2guardian/lists/common/embededreferersiteiplist

@@ -0,0 +1,10 @@
+# Embeded referer IP sites
+#  sites which may contain embeded exception referer sites in the url
+# IP site addresses 
+#
+# Single IPs, ranges and subnets can be used,
+# e.g.
+# 192.168.0.1
+# 10.0.0.1-10.0.0.3
+# 10.0.0.0/24
+#

compose/e2guardian/lists/common/embededreferersitelist

@@ -0,0 +1,2 @@
+# Embeded referer sites
+#  sites which may contain embeded exception referer sites in the url

compose/e2guardian/lists/common/embededrefererurllist

@@ -0,0 +1,5 @@
+# Embeded referer urls
+#  urls which may contain embeded exception referer sites in the url
+
+# e.g. to allow youtube video when embeded in a trusted referer site/urls
+# www.youtube.com/get_video_info

compose/e2guardian/lists/common/exceptionclientlist

@@ -0,0 +1,16 @@
+# Doamin names of computers from which
+# web access should not be filtered.
+#
+# These would be servers which
+# need unfiltered access for
+# updates.  Also administrator
+# workstations which need to
+# download programs and check
+# out blocked sites should be
+# put here.
+#
+# To work you must 
+# cater for reverse DNS lookups
+# on your LAN and enable the
+# "reverseclientiplookups" option in
+# e2guardian.conf

compose/e2guardian/lists/common/exceptioniplist

@@ -0,0 +1,27 @@
+# IP addresses of computers from which
+# web access should not be filtered.
+#
+# These would be servers which
+# need unfiltered access for
+# updates.  Also administrator
+# workstations which need to
+# download programs and check
+# out blocked sites should be
+# put here.
+#
+# Hostnames are NOT allowed here, 
+# put these in exceptionclientlist and
+# enable the reverseclientlookups option.
+#
+# This is not the IP of web servers
+# you don't want to filter.
+
+#192.168.0.1
+#192.168.0.2
+#192.168.42.2
+
+# Ranges and subnets can also be used,
+# e.g.
+# 10.0.0.1-10.0.0.3
+# 10.0.0.0/24
+#

compose/e2guardian/lists/common/nologextensionlist

@@ -0,0 +1,31 @@
+# No Log file extension list
+
+# requests with extensions in this list will not be logged
+
+# Text/web document types
+
+.css
+
+# Image types
+
+#.bmp
+#.cod
+#.gif
+#.ief
+#.jpe
+#.jpeg
+#.jpg
+#.jfif
+#.tif
+#.tiff
+#.ras
+#.cmx
+#.ico
+#.pnm
+#.pbm
+#.pgm
+#.ppm
+#.rgb
+#.xbm
+#.xpm
+#.xwd

compose/e2guardian/lists/common/nologregexpurllist

@@ -0,0 +1,4 @@
+# No Log regular expression URL list
+#
+# This acts as a list of URL regexes which, if matched, will 
+# not be logged

compose/e2guardian/lists/common/nologsiteiplist

@@ -0,0 +1,13 @@
+# No Log IP site list
+#
+# This acts as a list of IP sites which, when found, 
+# will not be logged
+
+# IP site addresses 
+#
+# Single IPs, ranges and subnets can be used,
+# e.g.
+# 192.168.0.1
+# 10.0.0.1-10.0.0.3
+# 10.0.0.0/24
+#

compose/e2guardian/lists/common/nologsitelist

@@ -0,0 +1,4 @@
+# No Log site list
+#
+# This acts as a list of domains which, when found, 
+# will not be logged.

compose/e2guardian/lists/common/nologurllist

@@ -0,0 +1,9 @@
+# No Log URL list
+#
+# This acts as a list of URLs which, when found, will 
+# not be logged
+
+www.google.com/complete
+www.google.co.uk/complete
+
+

compose/e2guardian/lists/common/nomitmsiteiplist

@@ -0,0 +1,9 @@
+#IP in nomitmsiteiplist 
+
+#This list is to stop any attempt to mitm these sites,
+# including trying to MITM to client to deliver an error message
+
+#Only put IP sites which cannot be MITM in this list
+#This applies to sites which are only used by apps
+#Sites not using http(s) but connecting via https or CONNECT
+

compose/e2guardian/lists/common/nomitmsitelist

@@ -0,0 +1,14 @@
+#domains in nomitmsitelist 
+#Don't bother with the www. or the http://
+
+#This list is to stop any attempt to mitm these sites,
+# including trying to MITM to client to deliver an error message
+
+#Only put sites which cannot be MITM in this list
+#This applies to sites which are only used by apps
+#Sites not using http(s) but connecting via https or CONNECT
+
+#NOTE: Sites using just IP should be put into nomitmsiteiplist
+
+reports.crashlytics.com   # google app crash tool
+

compose/e2guardian/lists/common/searchexceptionregexplist

@@ -0,0 +1,11 @@
+# This defines urls which will be not search term checked
+# Overrides searchregexplist
+#
+# The format is: "extended regular expression"
+# 
+
+#"^http://[0-9a-z]+\.google\.[a-z]+[-%.0-9a-z]*/complete"
+"^http://www.google.com/complete"
+"^http://www.google.co.uk/complete"
+
+

compose/e2guardian/lists/common/searchregexplist

@@ -0,0 +1,37 @@
+# This defines sites which will be search term checked
+#
+# The format is: "extended regular expression"->"search words"
+# 
+#   left is the site matching pattern
+#   right is the search words
+
+"^http://[0-9a-z]+\.google\.[a-z]+[-/%.0-9a-z]*\?q=([^&]*)\&.*"->"\1"
+"^http://[0-9a-z]+\.google\.[a-z]+[-/%.0-9a-z]*/.*\&q=([^&]*).*"->"\1"
+"^http://[0-9a-z]+\.google\.[a-z]+[-/%.0-9a-z]*\?q=([^&]*)"->"\1"
+"^http://[0-9a-z]+\.google\.[a-z]+[-/%.0-9a-z]*/.*\&q=([^&]*)"->"\1"
+
+"^http://www\.qwant\.com/.*\?q=([^&]*)\&.*"->"\1"
+"^http://www\.qwant\.com/.*\&q=([^&]*).*"->"\1"
+"^http://www\.qwant\.com/.*\?q=([^&]*)"->"\1"
+"^http://www\.qwant\.com/.*\&q=([^&]*)"->"\1"
+"^http://api\.qwant\.com/.*\?q=([^&]*)\&.*"->"\1"
+"^http://api\.qwant\.com/.*\&q=([^&]*).*"->"\1"
+"^http://api\.qwant\.com/.*\?q=([^&]*)"->"\1"
+"^http://api\.qwant\.com/.*\&q=([^&]*)"->"\1"
+
+"^http://duckduckgo.com/\?q=([^&]*)\&.*"->"\1"
+"^http://duckduckgo.com/.*\&q=([^&]*).*"->"\1"
+"^http://duckduckgo.com/\?q=([^&]*)"->"\1"
+"^http://duckduckgo.com/.*\&q=([^&]*)"->"\1"
+
+"^http://[0-9a-z]+\.youtube\.[a-z]+[-/%.0-9a-z]*\?search_query=([^&]*).*"->"\1"
+
+"^http://[0-9a-z]+\.yahoo\.[a-z]+[-/%.0-9a-z]*/search[^?]*\?p=([^&]*).*"->"\1"
+"^http://[0-9a-z]+\.yahoo\.[a-z]+[-/%.0-9a-z]*/search[^?]*.*\&p=([^&]*).*"->"\1"
+
+"^http://[0-9a-z]+\.answers\.[a-z]+[-/%.0-9a-z]*\?s=([^&]*)\&.*"->"\1"
+"^http://www\.answers\.[a-z]+[-%.0-9a-z]*/([^&]*).*"->"\1"
+
+"^http://[0-9a-z]+\.bing\.com[-/%.0-9a-z]*/search\?q=([^&]*).*"->"\1"
+"^http://[0-9a-z]+\.bing\.com[-/%.0-9a-z]*\&q=([^&]*).*"->"\1"
+

compose/e2guardian/lists/contentscanners/exceptionvirusextensionlist

@@ -0,0 +1,35 @@
+#Exception Virus extension list
+
+#This file originally from:
+#http://dgav.sourceforge.net
+
+# The Virus scanning code will ignore files with these extensions.
+
+# File extensions with executable code 
+
+
+# Files which one normally things as non-executable but
+# can contain harmful macros and viruses
+
+
+# Other files which may contain files with executable code
+
+
+# Time/bandwidth wasting files
+
+.mp3  # Music file
+.mpeg # Movie file
+.mpg  # Movie file
+.avi  # Movie file
+.ra   # Real Audio
+.ram  #  "
+.rm   #  "
+
+# Image files not to scan
+.gif
+.png
+.tiff
+.ico
+# http://www.kb.cert.org/vuls/id/297462
+#.jpg
+#.jpeg

compose/e2guardian/lists/contentscanners/exceptionvirusmimetypelist

@@ -0,0 +1,28 @@
+# MIME types the virus scanning code ignores.
+
+#This file originally from:
+#http://dgav.sourceforge.net
+
+audio/mpeg
+audio/x-mpeg
+audio/x-pn-realaudio
+audio/x-wav
+audio/x-realaudio
+audio/x-pn-realaudio
+audio/vnd.rn-realaudio
+application/ogg
+video/mpeg
+video/x-mpeg2
+video/acorn-replay
+video/quicktime
+video/x-msvideo
+video/msvideo
+video/vnd.rn-realvideo
+
+image/png
+image/gif
+image/tiff
+# http://www.kb.cert.org/vuls/id/297462
+# image/jpeg
+
+# text/html

compose/e2guardian/lists/contentscanners/exceptionvirussitelist

@@ -0,0 +1,12 @@
+#Sites in virus exception list will not be virus scanned
+#Don't bother with the www. or
+#the http://
+#
+#These are specifically domains and are not URLs.
+#For example 'foo.bar/porn/' is no good, you need
+#to just have 'foo.bar'.
+#
+#You can also match IPs here too.
+#
+
+example.com

compose/e2guardian/lists/contentscanners/exceptionvirusurllist

@@ -0,0 +1,15 @@
+#URLs in exception virus list will not be virus scanned
+#Don't bother with the www. or
+#the http://
+#
+#These are parts of sites that filtering should
+#be switched off for.
+#
+#These should not be domains, i.e. entire sites,
+#they should be a domain with a path.
+#
+#For example 'foo.bar' is no good, you need
+#to just have 'foo.bar/porn'.
+#
+#Another example:
+#generallybadsite.tld/partthatsok

compose/e2guardian/lists/downloadmanagers/managedextensionlist

@@ -0,0 +1,42 @@
+# Managed extension list
+# For use as the 'managedextensionlist' option in the configuration of
+# download managers supporting this feature.
+#
+# When enabled, only content matching the extensions given in this list will
+# be handled by the download manager.
+# If a managedmimetypelist is also enabled, then only content matching both
+# a mimetype and an extension in the lists will be handled.
+
+.bat
+.cab
+.com
+.crt
+.exe
+.hlp
+.ini
+.hta
+.inf
+.lnk
+.mdb
+.pcd
+.sh
+.vbs
+.doc
+.xls
+.gz
+.tar
+.bz2
+.sit
+.bin
+.hqx
+.zip
+.sxw
+.doc
+.iso
+.pdf
+.rar
+.ace
+.arj
+.dll
+.mda
+.mde

compose/e2guardian/lists/downloadmanagers/managedmimetypelist

@@ -0,0 +1,174 @@
+# Managed mime type list
+# For use as the 'managedmimetypelist' option in the configuration of
+# download managers supporting this feature.
+#
+# When enabled, only content matching the mime types given in this list will
+# be handled by the download manager.
+# If a managedextensionlist is also enabled, then only content matching both
+# a mimetype and an extension in the lists will be handled.
+
+# List originally by David Chewning <david.chewning@onedatacentral.com>
+
+# MIME Types Researched at http://filext.com/
+# bat
+application/bat
+application/x-bat
+# cab
+application/cab
+zz-application/zz-winassoc-cab
+# com
+application/com
+application/x-com
+# crt
+application/x-x509-ca-cert
+application/pkix-cert
+application/keychain_access
+# exe
+application/octet-stream
+application/exe
+application/x-exe
+application/dos-exe
+vms/exe
+application/x-winexe
+application/msdos-windows
+# hlp
+application/winhlp
+application/x-helpfile
+application/x-winhelp
+zz-application/zz-winassoc-hlp
+# ini
+zz-application/zz-winassoc-ini
+# hta
+application/hta
+# inf
+text/inf
+application/x-setupscript
+# lnk
+application/x-ms-shortcut
+# mdb
+application/x-msaccess
+application/vnd.msaccess
+application/mdb
+application/x-mdb
+zz-application/zz-winassoc-mdb
+# pcd
+image/pcd
+image/x-photo-cd
+# sh
+application/x-sh
+application/x-shar
+# vbs
+application/x-vbs
+text/vbs
+text/vbscript
+# doc
+application/msword
+application/doc
+application/vnd.msword
+application/vnd.ms-word
+application/winword
+application/word
+application/x-msw6
+application/x-msword
+zz-application/zz-winassoc-doc
+# xls
+application/msexcel
+application/x-msexcel
+application/x-ms-excel
+application/vnd.ms-excel
+application/x-excel
+application/x-dos_ms_excel
+application/xls
+application/x-xls
+zz-application/zz-winassoc-xls
+# gz
+application/gzip
+application/x-gunzip
+application/gzipped
+application/gzip-compressed
+gzip/document
+# tar
+application/tar
+applicaton/x-gtar
+multipart/x-tar
+# bz2
+application/bzip2
+application/x-bz2
+application/x-bzip
+# sit
+application/stuffit
+application/x-sit
+# bin
+application/macbinary
+application/x-macbinary
+application/bin
+application/binary
+# hqx
+application/binhex
+application/mac-binhex
+application/mac-binhex40
+application/x-winzip
+# zip
+application/zip
+application/x-zip
+multipart/x-zip
+
+# Audio/video types commented out to prevent breakage of streaming apps
+# mp3
+#audio/mpeg
+#audio/x-mpeg
+#audio/mp3
+#audio/x-mp3
+#audio/mpeg3
+#audio/x-mpeg3
+#audio/mpg
+#audio/x-mpg
+#audio/x-mpegaudio
+# mpeg
+#video/mpeg
+# avi
+#video/avi
+#video/msvideo
+#video/x-msvideo
+#image/avi
+#video/xmpg2
+#application/x-troff-msvideo
+#audio/aiff
+#audio/avi
+# asf
+#audio/asf
+#application/asx
+#video/x-ms-asf-plugin
+#application/x-mplayer2
+#video/x-ms-asf
+#application/vnd.ms-asf
+#video/x-ms-asf-plugin
+#video/x-ms-wm
+#video/x-ms-wmx
+# ogg
+#audio/x-ogg
+#application/x-ogg
+
+# Multiple extensions
+# bat, com, dll, exe
+application/x-msdos-program
+# cab, gz, tar, zip
+application/x-compress
+# cab, gz, tar, bz2, zip
+application/x-compressed
+# com, dll, exe, bin
+application/x-msdownload
+# mda, mdb, mde
+application/msaccess
+application/vnd.ms-access
+# sct, wsc
+text/scriptlet
+# sit, bin, hqx
+application/x-stuffit
+# gz, hqx
+application/x-gzip
+# tar, hqx
+application/x-tar
+# hqx, zip
+application/x-zip-compressed
+

compose/e2guardian/lists/example.group/README

@@ -0,0 +1,185 @@
+
+### Lists in this directory relate to a single filter group
+### each filter group has it's own directory
+
+###
+### Many of the exception/grey/banned site/ipsite/url lists are used for
+### switching on/off standard list categories
+###
+### Where available it is best to use the LOCAL lists for your own lists of
+### sites/urls as these override the main ones.
+
+## Order of checking is broadly as follows:-
+##
+## 1. If in Local Exception lists - allow with no further checking
+## 2. If in Local Grey lists - retrieve page and content-check
+## 3. If in Local Banned lists - block with no further checking
+## 4. If in Main Exception lists - allow with no further checking
+## 5. If in Main Grey lists - retrieve page and content-check
+## 6. If in Main Banned lists (or blanket blocked) - block with no further checking
+## 7. If gets here  - retrieve page and content-check
+## 8. Check blocked/exception file/mime types.
+## 9. Content-check page
+
+## Lists in this directory:-
+
+# Nocheckcert lists
+# Do not check ssl certificates for sites listed
+# Can be used to allow sites with self-signed or invalid certificates
+# or to reduced CPU load by not checking certs on heavily used sites (e.g. Google, Bing)
+# Use with caution!
+# Ignored if mitmcheckcert is 'off'
+#
+nocheckcertsitelist
+nocheckcertsiteiplist
+
+# greyssl lists only used in onlymitmsslgrey mode to define sites that
+# will be MITM
+greysslsitelist
+greysslsiteiplist
+localgreysslsitelist
+localgreysslsiteiplist
+
+## Exception lists
+##  Put sites you trust in these lists
+##  they override Grey and Banned entries
+exceptionsitelist
+exceptionsiteiplist
+exceptionurllist
+exceptionregexpurllist
+
+## Grey (i.e. content check) lists
+##  Put sites you want content-checked in these lists
+##  they override Banned entries
+greysitelist
+greysiteiplist
+greyurllist
+
+## Banned sites/urls
+bannedsitelist
+bannedsiteiplist
+bannedurllist
+bannedregexpurllist
+
+# 'bannedssl' lists are not currently used
+bannedsslsitelist
+bannedsslsiteiplist
+
+## Local Exception lists
+localexceptionsitelist
+localexceptionsiteiplist
+localexceptionurllist
+
+## Local Grey lists
+localgreysitelist
+localgreysiteiplist
+localgreyurllist
+
+## Local Banned lists
+localbannedsitelist
+localbannedsiteiplist
+localbannedurllist
+
+## Bannedssl lists are not currently used
+localbannedsslsitelist
+localbannedsslsiteiplist
+
+
+# File type/extensions
+exceptionextensionlist
+exceptionmimetypelist
+
+
+# Use the following lists to block specific kinds of file downloads.
+bannedextensionlist
+bannedmimetypelist
+
+# In either file filtering mode, the following lists can be used to override
+# MIME type & extension blocks for particular domains & URLs (trusted download sites).
+#
+exceptionfilesitelist
+exceptionfilesiteiplist
+exceptionfileurllist
+
+# NEW in v5.4 bannedtimelist - times when no access is allowed
+# To activate a storyboard change is required - see examplef1.story
+bannedtimelist
+
+# NEW in v5.4 blankettimelist - times when blanket block is applied
+# To activate a storyboard change is required - see examplef1.story
+blankettimelist
+
+
+### These lists are useful for allowing/blocking apps or browsers based 
+### on the user-agent
+bannedregexpuseragentlist
+exceptionregexpuseragentlist
+
+# refererexception lists are used to make a request an exception based on the
+# Referer header.
+refererexceptionsitelist
+refererexceptionsiteiplist
+refererexceptionurllist
+
+# Used to modify url on the fly
+# use to enforce safe search etc.
+# Do not try and change target site - use redirect for this.
+urlregexplist
+
+# Replace target connection site for a ssl connection request
+# Note: this does not change the url in any way. It just changes
+# where the request is sent upstream and the new target must accept 
+# the original url. 
+sslsiteregexplist
+
+# Used to redirect browser to different site and or url
+urlredirectregexplist
+
+# Categorise without blocking:
+# Supply categorised lists here and the category string shall be logged against
+# matching requests, but matching these lists does not perform any filtering
+# action.
+logsitelist
+logsiteiplist
+logurllist
+logregexpurllist
+
+# Phrase lists
+bannedphraselist
+weightedphraselist
+exceptionphraselist
+
+oldbannedphraselist
+oldweightedphraselist
+oldexceptionphraselist
+
+# Search Term list(s) for option 1
+bannedsearchlist
+bannedsearchoveridelist
+
+localbannedsearchlist
+
+# Outgoing HTTP request header rules:
+# Lists for blocking based on, and modification of, outgoing HTTP
+# request headers.  Format for headerregexplist is one modification rule per
+# line, similar to content/URL modifications.  Format for
+# bannedregexpheaderlist is one regular expression per line, with matching
+# headers causing a request to be blocked.
+# Headers are matched/replaced on a line-by-line basis, not as a contiguous
+# block.
+# Use for example, to remove cookies or prevent certain user-agents.
+headerregexplist
+bannedregexpheaderlist
+exceptionregexpheaderlist
+
+# add cookies or other headers etc to matched urls
+addheaderregexplist
+
+# Response HTTP header rules:
+# Lists for modification or removal of HTTP response headers.
+# Format for reponseheaderregexplist is one rule per line, similar to
+# content/URL modifications.
+# Headers are matched/replaced on a line-by-line basis, not as a contiguous
+# block.
+# Use for example, to remove protocol upgrade requests.
+responseheaderregexplist

compose/e2guardian/lists/example.group/addheaderregexplist

@@ -0,0 +1,13 @@
+#Add header where url matches
+#
+## to enable restricted YouTube 
+#"(^http://www\.youtube\.com/.*$)"->"YouTube-Restrict: Strict" 
+#"(^http://m\.youtube\.com/.*$)"->"YouTube-Restrict: Strict" 
+#"(^http://youtubei\.googleapis\.com/.*$)"->"YouTube-Restrict: Strict" 
+#"(^http://youtube\.googleapis\.com/.*$)"->"YouTube-Restrict: Strict" 
+#"(^http://www\.youtube-nocookie\.com/.*$)"->"YouTube-Restrict: Strict" 
+#"(^http://www\.youtube\.com$)"->"YouTube-Restrict: Strict" 
+#"(^http://m\.youtube\.com$)"->"YouTube-Restrict: Strict" 
+#"(^http://youtubei\.googleapis\.com$)"->"YouTube-Restrict: Strict" 
+#"(^http://youtube\.googleapis\.com$)"->"YouTube-Restrict: Strict" 
+#"(^http://www\.youtube-nocookie\.com$)"->"YouTube-Restrict: Strict" 

compose/e2guardian/lists/example.group/bannedextensionlist

@@ -0,0 +1,211 @@
+#Banned extension list
+
+# File extensions with executable code 
+
+# The following file extensions can contain executable code.
+# This means they can potentially carry a virus to infect your computer.
+
+.ade  # Microsoft Access project extension
+.adp  # Microsoft Access project
+.asx  # Windows Media Audio / Video
+.bas  # Microsoft Visual Basic class module
+.bat  # Batch file
+.cab  # Windows setup file
+.chm  # Compiled HTML Help file
+.cmd  # Microsoft Windows NT Command script
+.com  # Microsoft MS-DOS program
+.cpl  # Control Panel extension
+.crt  # Security certificate 
+.dll  # Windows system file
+.exe  # Program
+.hlp  # Help file
+.ini  # Windows system file
+.hta  # HTML program
+.inf  # Setup Information
+.ins  # Internet Naming Service
+.isp  # Internet Communication settings
+# .js   # JScript file - often needed in web pages
+# .jse  # Jscript Encoded Script file - often needed in web pages
+.lnk  # Windows Shortcut
+.mda  # Microsoft Access add-in program 
+.mdb  # Microsoft Access program
+.mde  # Microsoft Access MDE database
+.mdt  # Microsoft Access workgroup information 
+.mdw  # Microsoft Access workgroup information 
+.mdz  # Microsoft Access wizard program 
+.msc  # Microsoft Common Console document
+.msi  # Microsoft Windows Installer package
+.msp  # Microsoft Windows Installer patch
+.mst  # Microsoft Visual Test source files
+.pcd  # Photo CD image, Microsoft Visual compiled script
+.pif  # Shortcut to MS-DOS program
+.prf  # Microsoft Outlook profile settings
+.reg  # Windows registry entries
+.scf  # Windows Explorer command
+.scr  # Screen saver
+.sct  # Windows Script Component
+.sh   # Shell script
+.shs  # Shell Scrap object
+.shb  # Shell Scrap object
+.sys  # Windows system file
+.url  # Internet shortcut
+.vb   # VBScript file
+.vbe  # VBScript Encoded script file
+.vbs  # VBScript file
+.vxd  # Windows system file
+.wsc  # Windows Script Component
+.wsf  # Windows Script file
+.wsh  # Windows Script Host Settings file
+.otf  # Font file - can be used to instant reboot 2k and xp
+.ops  # Office XP settings 
+
+
+
+# Files which one normally things as non-executable but
+# can contain harmful macros and viruses
+
+.doc  # Word document
+.xls  # Excel document
+.pps
+
+
+# Other files which may contain files with executable code
+
+.gz   # Gziped file
+.tar  # Tape ARchive file
+.zip  # Windows compressed file
+.tgz  # Unix compressed file
+.bz2  # Unix compressed file
+.cdr  # Mac disk image
+.dmg  # Mac disk image
+.smi  # Mac self mounting disk image
+.sit  # Mac compressed file
+.sea  # Mac compressed file, self extracting
+.bin  # Mac binary compressed file
+.hqx  # Mac binhex encoded file
+.rar  # Similar to zip
+
+
+# Time/bandwidth wasting files
+
+.mp3  # Music file
+.mpeg # Movie file
+.mpg  # Movie file
+.avi  # Movie file
+.asf  # this can also exploit a security hole allowing virus infection
+.iso  # CD ISO image
+.ogg  # Music file
+.wmf  # Movie file
+.bin # CD ISO image
+.cue # CD ISO image
+
+# Banned Media extension list (Audio , Video , Streaming)
+# Arrange Alphabetically
+# Some have no Description
+#.3g2    #
+#.3gp      # Nokia Movie File
+#.3gp2
+#.3gpp
+#.3gpp2
+#.aac    # AAC Audio
+#.acp    # AAC for SD Media
+#.adts
+#.aif
+#.aifc
+#.aiff    # AIFF Audio
+#.amc    # AMC Media
+#.amr    # narrow-Band Content
+#.asf      # Media / this can also exploit a security hole allowing virus infection
+#.asx      # Windows Media Audio / Video
+#.au    # uLaw/AU Audio
+#.avi      # Movie file
+#.awb    # AMR Wide-Band Content
+#.bwf
+#.caf    # CAF Audio
+#.cda    # Audio CD File
+#.cdda    # Audio CD File
+#.cel
+#.cue     # CD ISO image
+#.dif
+#.divx    # Compress Movie
+#.dv    # Video Format used in Portable Camera
+#.flc      # Autodesk Animator
+#.fli
+#.flv      # Internet Movies
+#.gsm
+#.ivf
+#.kar    # Karaoke Media Files
+#.m15
+#.m1a
+#.m1s
+#.m1v
+#.m2v
+#.m3u    # MP3 Playlist
+#.m4a    # AAC Audio
+#.m4b
+#.m4e
+#.m4p    # AAC Audio (Protected)
+#.m4v    # Video (Protected)
+#.m75
+#.mid    # Midi Audio Files
+#.midi    # Midi Audio Files
+#.mjpg
+#.mov    # Movie Files
+#.mp1
+#.mp2
+#.mp3      # Music file
+#.mp4    # Mpeg-4 Media
+#.mpa
+#.mpe
+#.mpeg     # Movie file
+#.mpg      # Movie file
+#.mpga
+#.mpm
+#.mps
+#.mpv
+#.mpv2
+#.mqv      # Quicktime Movies
+#.mv
+#.ogg      # Music file
+#.ogm      # Ogg Based Movie Files
+#.pls      # Shoutcast type of radio
+#.qcp    # Qualcomm Purevoice Audio
+#.qt    # Quicktime File
+#.qtc
+#.qtl      # Quicktime Movies
+#.ra    # Real Audio
+#.ram    # Real Audio Media
+#.rm       # Real Media Files
+#.rmi
+#.rmm
+#.rmp
+#.rmvb    # Real Media Video
+#.rnx
+#.rp    # Real Player Files
+#.rt
+#.rts
+#.rtsp
+#.rv
+#.sd2    # Sound Designer II
+#.sdp      # Stream Descriptor
+#.sdv    # SD Video
+#.sf
+#.smf
+#.smi    #
+#.smil     # SMIL Multimedia Presentation (Video and Audio Presentation
+#.snd
+#.ssm      # Streaming Media Metafile
+#.swa    # MP3 Audio
+#.swf      # Shockwave Streaming files
+#.ulw
+#.vfw       # Video for Windows
+#.wav
+#.wax
+#.wm
+#.wma
+#.wmf      # Movie file
+#.wmp
+#.wmv     # Windows Media Video
+#.wmx
+#.wvx
+#.xpl

compose/e2guardian/lists/example.group/bannedmimetypelist

@@ -0,0 +1,18 @@
+# banned MIME types
+
+audio/mpeg
+audio/x-mpeg
+audio/x-pn-realaudio
+audio/x-wav
+video/mpeg
+video/x-mpeg2
+video/acorn-replay
+video/quicktime
+video/x-msvideo
+video/msvideo
+application/gzip
+application/x-gzip
+application/zip
+application/compress
+application/x-compress
+application/java-vm

compose/e2guardian/lists/example.group/bannedphraselist

@@ -0,0 +1,47 @@
+# BANNEDPHRASELIST - INSTRUCTIONS FOR USE
+#
+# To block any page with the word "sex".
+# < sex >
+#
+# To block any page with words that contain the string "sex". (ie. sexual)
+# <sex>
+#
+# To block any page with the string "sex magazine".
+# <sex magazine>
+#
+# To block any page containing the words/strings "sex" and "fetish".
+# <sex>,<fetish>
+#
+# < test> will match any word with the string 'test' at the beginning
+# <test > will match any word with the string 'test' at the end
+# <test> will match any word with the string 'test' at any point in the word
+# < test > will match only the word 'test'
+# <this is a test phrase> will match that exact phrase
+# <test>,<secondtest> will match if both words are found in the page
+# A combination of the above can also be used eg < test>,<secondtest>
+#
+# All phrases need to be within < and > to work, othewise they will be
+# ignored.
+
+# Note: Use these sparingly - banned phrases tend to overblock
+
+
+#listcategory: "Banned Phrases"
+
+
+# The following banned phraselists are included in the default e2g distribution.
+
+.Include</etc/e2guardian/lists/phraselists/ukenglish/pornography/banned>
+
+#.Include</etc/e2guardian/lists/phraselists/ukenglish/gambling/banned>
+#.Include</etc/e2guardian/lists/phraselists/ukenglish/badwords/banned>
+
+#.Include</etc/e2guardian/lists/phraselists/portuguese/gambling/banned>
+#.Include</etc/e2guardian/lists/phraselists/portuguese/intolerance/banned>
+#.Include</etc/e2guardian/lists/phraselists/portuguese/personals/banned>
+
+#.Include</etc/e2guardian/lists/phraselists/ukenglish/gambling/banned>
+#.Include</etc/e2guardian/lists/phraselists/portuguese/gambling/banned>
+
+
+

compose/e2guardian/lists/example.group/bannedregexpheaderlist

@@ -0,0 +1,9 @@
+#Banned outgoing HTTP headers based on regular expressions
+#
+# E.g. 'User-Agent: .*MSIE' would block several versions of Internet Explorer
+# (assuming the user-agent is not being spoofed by the client)
+#
+# Headers are matched line-by-line, not as a single block.
+
+#listcategory: "Banned Regular Expression HTTP Headers"
+

compose/e2guardian/lists/example.group/bannedregexpurllist

@@ -0,0 +1,122 @@
+#Banned URLs based on Regular Expressions
+#
+# E.g. 'sex' would block sex.com and middlesex.com etc
+
+#listcategory: "Banned Regular Expression URLs"
+
+#Banned URLs based on Regular Expressions
+
+#These examples should be used with extreme caution 
+# as most regexp url patterns tend to overblock
+# Be as specific as possible as this helps avoid this
+
+######################################################
+# Pornography, Modelling and Adult Sites
+######################################################
+
+#\b(big|cyber|hard|huge|mega|small|soft|super|tiny|bare|naked|nude|anal|oral|topp?les|sex|phone)+\b.*\b(anal|babe|bharath|boob|breast|busen|busty|clit|cum|cunt|dick|fetish|fuck|girl|hooter|lez|lust|naked|nude|oral|orgy|penis|porn|porno|pupper|pussy|rotten|sex|shit|smutpump|teen|tit|topp?les|xxx)s\b?
+#\b(anal|babe|bharath|boob|breast|busen|busty|clit|cum|cunt|dick|fetish|fuck|girl|hooter|lez|lust|naked|nude|oral|orgy|penis|porn|porno|pupper|pussy|rotten|sex|shit|smutpump|teen|tit|topp?les|xxx)+\b.*\b(big|cyber|hard|huge|mega|small|soft|super|tiny|bare|naked|nude|anal|oral|topp?les|sex)\b+
+
+#HardCore phrases
+#(adultsight|adultsite|adultsonly|adultweb|blowjob|bondage|centerfold|cumshot|cyberlust|cybercore|hardcore|masturbat)
+#(bangbros|pussylip|playmate|pornstar|sexdream|showgirl|softcore|striptease)
+
+#SoftCore phrases - more likely to overblock - possibly on news sites
+#(incest|obscene|pedophil|pedofil)
+
+#Photo Modeling - supplied by David Burkholder
+#(male|m[ae]n|boy|girl|beaut|agen[ct]|glam)+.*(model|talent)
+
+# The following will help to block explicit media files (images and video)
+#(sex|fuck|boob|cunt|fetish|tits|anal|hooter|asses|shemale|submission|porn|xxx|busty|knockers|slut|nude|naked|pussy)+.*(\.jpg|\.wmv|\.mpg|\.mpeg|\.gif|\.mov)
+#(girls|babes|bikini|model)+.*(\.jpg|\.wmv|\.mpg|\.mpeg|\.gif|\.mov)
+
+#Block Naturism and Nudist sites
+#(naturism|naturist|nude|nudist|nudism|nekkid|nakt|naakt)
+
+
+######################################################
+# Search Engine and Related
+######################################################
+
+#Block unfiltered options on various search engines
+#(^|[\?+=&/])(.*\.google\..*/.*\?.*safe=off)([\?+=&/]|$)
+#(^|[\?+=&/])(.*\.alltheweb.com/customize\?.*copt_offensive=off)([\?+=&/]|$)
+
+#Block images and video on altavista, alltheweb, yahoo etc - as they are anonomised
+#(yahoo.com\/image\/)
+#(yimg.com\/image\/)
+#(altavista.com\/image\/)
+#(altavista.com\/video\/)
+#(picsearch.com\/is)
+
+#Block images and video on google
+#(images.google)+.*(\.jpg|\.wmv|\.mpg|\.mpeg|\.gif|\.mov) 
+#(google.com\/video) #block all video
+#(google.com\/ThumbnailServer) #block video thumbnails
+#(google.com\/videoplay) #block only playing the video
+
+
+######################################################
+# Proxy Sites
+######################################################
+
+#Block Cgiproxy, Poxy, PHProxy and other Web-based proxies
+#(cecid.php|nph-webpr|nph-pro|/dmirror|cgiproxy|phpwebproxy|__proxy_url|proxy.php)
+
+#Block websites containing proxy lists
+#(anonymizer|proxify|megaproxy)
+
+#AGRESSIVE blocking of all URLs containing proxy - WARNING - this WILL overblock!!
+#(proxy)
+
+
+######################################################
+# Gambling - supplied by David Burkholder
+######################################################
+#(casino|bet(ting|s)|lott(ery|o)|gam(e[rs]|ing|bl(e|ing))|sweepstake|poker)
+
+
+######################################################
+# Sport - supplied by David Burkholder
+######################################################
+#(bowling|badminton|box(e[dr]|ing)|skat(e[rs]|ing)|hockey|soccer|nascar|wrest|rugby|tennis|sports|cheerlead|rodeo|cricket|badminton|stadium|derby)
+#((paint|volley|bas(e|ket)|foot|quet)ball|/players[/\.]?|(carn|fest)ival)
+
+#Racing - supplied by David Burkholder
+#(speed(st|wa|y)|corvette|rac[eiy]|wrest|harley|motorcycle|nascar)
+
+
+######################################################
+# News sites - supplied by David Burkholder
+######################################################
+#(news(watch|pap|cast)|herald|sentinel|courier|gazet|tribune|chronicle|daily|ning)news)
+
+
+######################################################
+# Dating Sites - supplied by David Burkholder
+######################################################
+#(meet|hook|mailord|latin|(asi|mexic|dominic|russi|kore|colombi|balk)an|brazil|filip|french|chinese|ukrain|thai|tour|foreign|date)+.*(dar?[lt]ing|(sing|coup)le|m[ae]n|girl|boy|guy|mat(e|ing)|l[ou]ve?|partner|meet)
+#(marr(y|i[ae])|roman(ce|tic)|fiance|bachelo|dating|affair|personals)
+
+
+######################################################
+# Miscellaneous - Productivity etc.
+######################################################
+
+#Use this to block web counters:
+#(adlog.php|cnt.cgi|count.cgi|count.dat|count.jsp|count.pl|count.php|counter.cgi|counter.js|counter.pl|countlink.cgi|fpcount.exe|logitpro.cgi|rcounter.dll|track.pl|w_counter.js)
+#Contributed by proxy@barendse.to
+
+#Free stuff - supplied by David Burkholder
+#(free|phone|mobile)+.*(love|music|movie|dvd|video|stuff|site|arcade|wallpaper|mp3)
+#((ring|real)tone)
+
+#Music - supplied by David Burkholder
+#(rock|pop|jazz|rap|punk)+.*(cult|roll|geek|drum|music|history|band)
+
+# WARNING: This is part of the URL for the e2guardian.org sample virus archive.
+# You probably don't want to go there unintentionally.
+(Variants/AVTest)
+
+

compose/e2guardian/lists/example.group/bannedregexpuseragentlist

@@ -0,0 +1,12 @@
+#Banned User-Agents based on regular expressions
+#
+# E.g. ' .*MSIE' would block several versions of Internet Explorer
+# (assuming the user-agent is not being spoofed by the client)
+#
+#listcategory: "user-agent"
+#
+# This is useful for blocking apps
+# e.g. to block Kindle app
+#kindle
+#Kindle
+

compose/e2guardian/lists/example.group/bannedsearchlist

@@ -0,0 +1,9 @@
+#Banned Search Words
+#
+#Words must be in alphabetic order within a single line
+# and separated by a '+' sign.
+#All combinations of the words will be blocked
+# e.g.   girl+naughty
+#     will block  naughty+girl as well as girl+naughty
+
+

compose/e2guardian/lists/example.group/bannedsiteiplist

@@ -0,0 +1,12 @@
+# IP sites in banned list
+
+#The bannedsiteiplist is for blocking ALL of an IP site
+
+# IP site addresses 
+#
+# Single IPs, ranges and subnets can be used,
+# e.g.
+# 192.168.0.1
+# 10.0.0.1-10.0.0.3
+# 10.0.0.0/24
+#

compose/e2guardian/lists/example.group/bannedsitelist

@@ -0,0 +1,98 @@
+#domains in banned list
+#Don't bother with the www. or the http://
+
+#The bannedurllist is for blocking PART of a site
+#The bannedsitelist is for blocking ALL of a site
+
+#NOTE: Sites using just IP should be put into bannedsiteiplist
+
+#You can include
+#.tld so for example you can match .gov for example
+
+#The 'grey' lists override the 'banned' lists.
+#The 'exception' lists override the 'banned' lists also.
+#The difference is that the 'exception' lists completely switch
+#off *all* other filtering for the match.  'grey' lists only
+#stop the URL filtering and allow the normal filtering to work.
+
+#An example of grey list use is when in Blanket Block (whitelist)
+#mode and you want to allow some sites but still filter as normal
+#on their content
+
+#Another example of grey list use is when you ban a site but want
+#to allow part of it.
+
+#To include additional files in this list use this example:
+#.Include</etc/e2guardian/anotherbannedurllist>
+
+#You can have multiple .Includes.
+
+# Time limiting syntax:
+# #time: <start hour> <start minute> <end hour> <end minute> <days>
+# Example:
+##time: 9 0 17 0 01234
+# Remove the first # from the line above to enable this list only from
+# 9am to 5pm, Monday to Friday.
+
+# List categorisation
+#listcategory: "Banned Sites"
+
+#List other sites to block:
+
+# badboys.com
+
+# NOTE: From v5 Blanket blocks are now implimented using Storyboarding 
+# WARNING: Old style Blanket blocks in this file will be silently ignored
+
+
+# The squidGuard advert domain/URL lists are now included by default.
+# To work with advanced ad blocking & the logadblocks option, advert
+# phrase/site/URL lists should have the string "ADs" in their listcategory.
+# .Include</etc/e2guardian/lists/blacklists/ads/domains>
+
+#Remove the # from the following and edit as needed to use a stock
+#squidGuard/urlblacklists collection.
+#.Include</etc/e2guardian/lists/blacklists/adult/domains>
+#.Include</etc/e2guardian/lists/blacklists/aggressive/domains>
+#.Include</etc/e2guardian/lists/blacklists/artnudes/domains>
+#.Include</etc/e2guardian/lists/blacklists/audio-video/domains>
+#.Include</etc/e2guardian/lists/blacklists/beerliquorinfo/domains>
+#.Include</etc/e2guardian/lists/blacklists/beerliquorsale/domains>
+#.Include</etc/e2guardian/lists/blacklists/chat/domains>
+#.Include</etc/e2guardian/lists/blacklists/childcare/domains>
+#.Include</etc/e2guardian/lists/blacklists/clothing/domains>
+#.Include</etc/e2guardian/lists/blacklists/culinary/domains>
+#.Include</etc/e2guardian/lists/blacklists/dialers/domains>
+#.Include</etc/e2guardian/lists/blacklists/drugs/domains>
+#.Include</etc/e2guardian/lists/blacklists/entertainment/domains>
+#.Include</etc/e2guardian/lists/blacklists/forums/domains>
+#.Include</etc/e2guardian/lists/blacklists/frencheducation/domains>
+#.Include</etc/e2guardian/lists/blacklists/gambling/domains>
+#.Include</etc/e2guardian/lists/blacklists/government/domains>
+#.Include</etc/e2guardian/lists/blacklists/hacking/domains>
+#.Include</etc/e2guardian/lists/blacklists/homerepair/domains>
+#.Include</etc/e2guardian/lists/blacklists/hygiene/domains>
+#.Include</etc/e2guardian/lists/blacklists/jewelry/domains>
+#.Include</etc/e2guardian/lists/blacklists/jobsearch/domains>
+#.Include</etc/e2guardian/lists/blacklists/kidstimewasting/domains>
+#.Include</etc/e2guardian/lists/blacklists/mail/domains>
+#.Include</etc/e2guardian/lists/blacklists/news/domains>
+#.Include</etc/e2guardian/lists/blacklists/onlineauctions/domains>
+#.Include</etc/e2guardian/lists/blacklists/onlinegames/domains>
+#.Include</etc/e2guardian/lists/blacklists/onlinepayment/domains>
+#.Include</etc/e2guardian/lists/blacklists/personalfinance/domains>
+#.Include</etc/e2guardian/lists/blacklists/pets/domains>
+#.Include</etc/e2guardian/lists/blacklists/porn/domains>
+#.Include</etc/e2guardian/lists/blacklists/proxy/domains>
+#.Include</etc/e2guardian/lists/blacklists/publicite/domains>
+#.Include</etc/e2guardian/lists/blacklists/redirector/domains>
+#.Include</etc/e2guardian/lists/blacklists/ringtones/domains>
+#.Include</etc/e2guardian/lists/blacklists/sportnews/domains>
+#.Include</etc/e2guardian/lists/blacklists/sports/domains>
+#.Include</etc/e2guardian/lists/blacklists/vacation/domains>
+#.Include</etc/e2guardian/lists/blacklists/violence/domains>
+#.Include</etc/e2guardian/lists/blacklists/virusinfected/domains>
+#.Include</etc/e2guardian/lists/blacklists/warez/domains>
+
+# You will need to edit to add and remove categories you want
+toto.fr

compose/e2guardian/lists/example.group/bannedsslsiteiplist

@@ -0,0 +1,15 @@
+#IP sites in banned ssl list
+#This list is only used for SSL (or CONNECT) requests
+#Unlike the bannedsitelist it overides all other lists
+# so can be used ban an https site white the http is allowed or made an exception
+# 
+#Only list sites where you only want the https site blocked
+#Use bannedsiteiplist for sites where you want both http & https blocked
+# IP site addresses 
+#
+# Single IPs, ranges and subnets can be used,
+# e.g.
+# 192.168.0.1
+# 10.0.0.1-10.0.0.3
+# 10.0.0.0/24
+#

compose/e2guardian/lists/example.group/bannedsslsitelist

@@ -0,0 +1,9 @@
+#domains in banned ssl list
+#Don't bother with the www. or the https://
+#This list is only used for SSL (or CONNECT) requests
+# and will not have any effect when MITM is enabled.
+#Unlike the bannedsitelist it overides all other lists
+# so can be used ban an https site white the http is allowed or made an exception
+# 
+#Only list sites where you only want the https site blocked
+#Use bannedsitelist for sites where you want both http & https blocked

compose/e2guardian/lists/example.group/bannedtimelist

@@ -0,0 +1,13 @@
+#timebands when internet blocked
+
+#You can have multiple .Includes.
+
+# Tiime banding syntax:
+# <start hour> <start minute> <end hour> <end minute> <days>
+# Note figures are 0 based - hours (0-23) mins (0-59) days (0-6)
+# Example:
+# 22 0 23 59 01234
+# 0  0 07 0 01234
+
+# Uncomment the lines above to block access from
+# 0am to 5am and 10pm to 11:59pm, Monday to Friday.

compose/e2guardian/lists/example.group/bannedurllist

@@ -0,0 +1,59 @@
+#URLs in banned list
+#Don't bother with the http:// or the www
+
+#The bannedurllist is for blocking PART of a site
+#The bannedsitelist is for blocking ALL of a site
+
+#The 'grey' lists override the 'banned' lists.
+#The 'exception' lists override the 'banned' lists also.
+#The difference is that the 'exception' lists completely switch
+#off *all* other filtering for the match.  'grey' lists only
+#stop the URL filtering and allow the normal filtering to work.
+
+#An example of grey list use is when in Blanket Block (whitelist)
+#mode and you want to allow some sites but still filter as normal
+#on their content
+
+#Another example of grey list use is when you ban a site but want
+#to allow part of it.
+
+#To include additional files in this list use this example:
+#.Include</etc/e2guardian/anotherbannedurllist>
+
+#You can have multiple .Includes.
+
+#listcategory: "Banned URLs"
+
+#List other URLs to block:
+
+# members.home.net/uporn
+
+# The squidGuard advert domain/URL lists are now included by default.
+# To work with advanced ad blocking & the logadblocks option, advert
+# phrase/site/URL lists should have the string "ADs" in their listcategory.
+#.Include</etc/e2guardian/lists/blacklists/ads/urls>
+
+#Remove the # from the following and edit as needed to use a stock
+#squidGuard/urlblacklist blacklists collection.
+#.Include</etc/e2guardian/lists/blacklists/adult/urls>
+#.Include</etc/e2guardian/lists/blacklists/aggressive/urls>
+#.Include</etc/e2guardian/lists/blacklists/audio-video/urls>
+#.Include</etc/e2guardian/lists/blacklists/chat/urls>
+#.Include</etc/e2guardian/lists/blacklists/drugs/urls>
+#.Include</etc/e2guardian/lists/blacklists/entertainment/urls>
+#.Include</etc/e2guardian/lists/blacklists/frencheducation/urls>
+#.Include</etc/e2guardian/lists/blacklists/gambling/urls>
+#.Include</etc/e2guardian/lists/blacklists/government/urls>
+#.Include</etc/e2guardian/lists/blacklists/hacking/urls>
+#.Include</etc/e2guardian/lists/blacklists/jobsearch/urls>
+#.Include</etc/e2guardian/lists/blacklists/kidstimewasting/urls>
+#.Include</etc/e2guardian/lists/blacklists/mail/urls>
+#.Include</etc/e2guardian/lists/blacklists/news/urls>
+#.Include</etc/e2guardian/lists/blacklists/porn/urls>
+#.Include</etc/e2guardian/lists/blacklists/proxy/urls>
+#.Include</etc/e2guardian/lists/blacklists/publicite/urls>
+#.Include</etc/e2guardian/lists/blacklists/redirector/urls>
+#.Include</etc/e2guardian/lists/blacklists/violence/urls>
+#.Include</etc/e2guardian/lists/blacklists/virusinfected/urls>
+#.Include</etc/e2guardian/lists/blacklists/warez/urls>
+# You will need to edit to add and remove categories you want

compose/e2guardian/lists/example.group/blankettimelist

@@ -0,0 +1,16 @@
+#timebands when blanket block is applied
+# (only exception sites will be allowed)
+# To enable this list edit e2guardianfn.conf and filter group i
+# storyboard fn.story - see examplef1.story
+
+#You can have multiple .Includes.
+
+# Tiime banding syntax:
+# <start hour> <start minute> <end hour> <end minute> <days>
+# Note figures are 0 based - hours (0-23) mins (0-59) days (0-6)
+# Example:
+# 22 0 23 59 01234
+# 0  0 07 0 01234
+
+# Uncomment the lines above to blanket block from
+# 0am to 5am and 10pm to 11:59pm, Monday to Friday.

compose/e2guardian/lists/example.group/contentregexplist

@@ -0,0 +1,93 @@
+#Content modifying Regular Expressions
+#
+# The format is: "extended regular expression"->"replacement straight string"
+# E.g. "shit"->"censored" would replace all occurances of shit in any case.
+# Far more complicated matches are possible.  See other sources for examples
+# of extended regular expressions.
+
+# These are just some examples.  If you write any, for example, to
+# remove popups etc, please send them to author at e2guardian.org.
+#
+#"<script language.*open\(.*script>"->"<!-- its gone -->"
+#"fuck|cunt|shit"->"**censored**"
+#
+# For ALL of these to work it requires e2guardian to be built with PCRE support,
+# but some may work with the default C library regular expression support.
+#
+# Some of these are based on regular expressions from Privoxy.
+
+#remove popups by AFN 2004/2/28
+#"<html>"->"<script language='javascript'>fwo=window.open;function NO(url,nam,atr){return(this.window);}window.open=NO;</script><html>"
+#"=[ ]*?window\.open[ ]*?\("->"=fwo("
+#"<html>"->"<script language='javascript'>function NO(url,nam,atr){return(this.window);}window.open=NO;</script><html>"
+
+# Fix Firefox <= 1.0.7 DoS
+# http://www.whitedust.net/speaks/1432/
+#"((<source)|(</source))text>"->"$1dosremovedtext"
+
+# Disable ActiveX objects.
+#"<object [^>]*application\/x-oleobject[^>]*>.*?<\/object>"->"<!-- Guardian Removed ActiveX Object -->"
+#"<embed [^>]*(application/x-oleobject).*?>(.*?</embed>)?"->"<!-- Guardian Removed ActiveX Embed -->"
+
+# Warn about address bar spoofing.
+#"(<a[^>]*href[^>]*)(\x01|\x02|\x03|%0[012])"->"$1MALICIOUS-LINK"
+
+# Disable all popups in JavaScript and HTML.  It may cause unavoidable
+# Javascript warnings or errors.  Do not enable at the same time as other
+# popup removing lines.
+#"((\W\s*)(window|this|parent)\.)open\s*\\?\("->"$1concat("
+#"\starget\s*=\s*(['"]?)_?(blank|new)\1?"->" notarget"
+
+# Removes the APPLET tag which is generally used Java applets.
+#"<applet[^>]*>.*?<\/applet>"->""
+
+# Disable the BLINK and MARQUEE tags.
+#"</?(blink|marquee)[^>]*>"->""
+
+# Warn about potential cross-site-scripting vulnerability described here:
+# http://online.securityfocus.com/archive/1/298748/2002-11-02/2002-11-08/2
+#"f\("javascript:location.replace\('mk:@MSITStore:C:'\)"\);"->"alert\("This page looks like it tries to use a vulnerability described here:\n http://online.securityfocus.com/archive/1/298748/2002-11-02/2002-11-08/2"\);"
+
+# Removes the SCRIPT tag with JavaScript.  This will likely break sites that are
+# badly written and thus rely on JavaScript.  This should not be used at the same
+# time as the 'script' category.
+#"<script [^>]*javascript[^>]*>.*?<\/script>"->""
+
+# Removes href=javascript: onmouseover=javascript: and other javascript actions.
+# This is a good category to tick if using 'script' or 'javascript' categories.
+# Beware that there are likely going to be a large number of matches and will
+# require more CPU.  Also this will break badly written sites that require
+# JavaScript for navigation.
+#"(onclick|ondblclick|onmousedown|onmouseup|onmouseover|onmousemove|onmouseout|onkeypress|onkeydown|onkeyup|href)(=("|')?)javascript:"->"guardianremoved$2none:"
+
+# Remove cookies set by JavaScript and HTML.
+#"(\w+\.)+cookie(?=[ \t\r\n]*=)(?!='aab)"->"GuardianRemovedCookie"
+#"<meta\s+http-equiv=['"]?set-cookie.*>"->"<!-- GuardianRemovedCookie -->"
+
+# Attempt to detect and stop Nimda infected servers's web pages. This is rare
+# and generally should be left unused.
+#"<script language="JavaScript">(window\.open|1;''\.concat)\("readme\.eml", null, "resizable=no,top=6000,left=6000"\)</script>"->"<br><font size="7"> WARNING: This Server is infected with <a href="http://www.cert.org/advisories/CA-2001-26.html">Nimda</a>!</font>"
+
+# Disable onunload (page close) popups.
+#"(<body\s+[^>]*)onunload"->"$1never"
+#"(<script.*)window\.onunload(?=.*</script>)"->"$1never"
+
+# Removes the SCRIPT tag which could include JavaScript, perlscript and vbscript.
+# This will likely break sites that are badly written and thus rely on client
+# side scripts.  This should not be used at the same time as the 'javascript' line.
+#"<script[^>]*>.*?<\/script>"->""
+
+# Disable Sockwave Flash objects.
+#"<object [^>]*macromedia[^>]*>.*?<\/object>"->"<!-- Guardian Removed Shockwave Object -->"
+#"<embed [^>]*(application/x-shockwave-flash\|\.swf).*?>(.*?</embed>)?"->"<!-- Guardian Removed Shockwave Flash Embed -->"
+
+# Disable unsolicited popups.
+#"([^'"]\s*<head.*>)(?=\s*[^'"])"->"$1<script>function SWGuardianWindowOpen(){return(null);}</script>"
+#"([^\w\s.]\s*)((window|this|parent)\.)?open\s*\("->"$1SWGuardianWindowOpen("
+#"([^'"]\s*</html>)(?!\s*(\\n|'|"))"->"$1<script>function PrivoxyWindowOpen(a, b, c){return(window.open(a, b, c));}</script>"
+
+# Remove 1x1 GIFs used for user tracking.
+#"<img\s+[^>]*(?:(width)|(height))\s*=\s*['"]?[01](?=\D)[^>]*(?:(width)|(height))\s*=\s*['"]?[01](?=\D)[^>]*?>"->""
+
+# Prevent windows from resizing and moving themselves.
+#"(?:window|this|self|top)\.(?:move|resize)(?:to|by)\("->"''.concat("

compose/e2guardian/lists/example.group/domainsnobypass

@@ -0,0 +1,63 @@
+# User are not allowed to bypass domains in this list
+
+#Don't bother with the www. or the http://
+
+#NOTE: Sites using just IP should be put into bannedsiteiplistwithbypass
+
+#You can include
+#.tld so for example you can match .gov for example
+
+#.Include</etc/e2guardian/anotherbannedurllist>
+
+#You can have multiple .Includes.
+
+# WARNING: Old style Blanket blocks in this file will be silently ignored
+
+
+# .Include</etc/e2guardian/lists/blacklists/ads/domains>
+
+#Remove the # from the following and edit as needed to use a stock
+#squidGuard/urlblacklists collection.
+#.Include</etc/e2guardian/lists/blacklists/adult/domains>
+#.Include</etc/e2guardian/lists/blacklists/aggressive/domains>
+#.Include</etc/e2guardian/lists/blacklists/artnudes/domains>
+#.Include</etc/e2guardian/lists/blacklists/audio-video/domains>
+#.Include</etc/e2guardian/lists/blacklists/beerliquorinfo/domains>
+#.Include</etc/e2guardian/lists/blacklists/beerliquorsale/domains>
+#.Include</etc/e2guardian/lists/blacklists/chat/domains>
+#.Include</etc/e2guardian/lists/blacklists/childcare/domains>
+#.Include</etc/e2guardian/lists/blacklists/clothing/domains>
+#.Include</etc/e2guardian/lists/blacklists/culinary/domains>
+#.Include</etc/e2guardian/lists/blacklists/dialers/domains>
+#.Include</etc/e2guardian/lists/blacklists/drugs/domains>
+#.Include</etc/e2guardian/lists/blacklists/entertainment/domains>
+#.Include</etc/e2guardian/lists/blacklists/forums/domains>
+#.Include</etc/e2guardian/lists/blacklists/frencheducation/domains>
+#.Include</etc/e2guardian/lists/blacklists/gambling/domains>
+#.Include</etc/e2guardian/lists/blacklists/government/domains>
+#.Include</etc/e2guardian/lists/blacklists/hacking/domains>
+#.Include</etc/e2guardian/lists/blacklists/homerepair/domains>
+#.Include</etc/e2guardian/lists/blacklists/hygiene/domains>
+#.Include</etc/e2guardian/lists/blacklists/jewelry/domains>
+#.Include</etc/e2guardian/lists/blacklists/jobsearch/domains>
+#.Include</etc/e2guardian/lists/blacklists/kidstimewasting/domains>
+#.Include</etc/e2guardian/lists/blacklists/mail/domains>
+#.Include</etc/e2guardian/lists/blacklists/news/domains>
+#.Include</etc/e2guardian/lists/blacklists/onlineauctions/domains>
+#.Include</etc/e2guardian/lists/blacklists/onlinegames/domains>
+#.Include</etc/e2guardian/lists/blacklists/onlinepayment/domains>
+#.Include</etc/e2guardian/lists/blacklists/personalfinance/domains>
+#.Include</etc/e2guardian/lists/blacklists/pets/domains>
+#.Include</etc/e2guardian/lists/blacklists/porn/domains>
+#.Include</etc/e2guardian/lists/blacklists/proxy/domains>
+#.Include</etc/e2guardian/lists/blacklists/publicite/domains>
+#.Include</etc/e2guardian/lists/blacklists/redirector/domains>
+#.Include</etc/e2guardian/lists/blacklists/ringtones/domains>
+#.Include</etc/e2guardian/lists/blacklists/sportnews/domains>
+#.Include</etc/e2guardian/lists/blacklists/sports/domains>
+#.Include</etc/e2guardian/lists/blacklists/vacation/domains>
+#.Include</etc/e2guardian/lists/blacklists/violence/domains>
+#.Include</etc/e2guardian/lists/blacklists/virusinfected/domains>
+#.Include</etc/e2guardian/lists/blacklists/warez/domains>
+
+# You will need to edit to add and remove categories you want

compose/e2guardian/lists/example.group/exceptionextensionlist

@@ -0,0 +1,49 @@
+# Exception file extension list
+# Use as a filter group's "exceptionextensionlist",
+# to override a blanket download block.
+# (blockdownloads = on)
+#
+# DOES NOT override content/virus scanning or site/URL bans. 
+#
+# Default list:
+# Unblock web pages & graphics
+
+# Text/web document types
+
+.css
+.html
+.shtml
+.htm
+.stm
+.asp
+.php
+.txt
+.rtx
+.xml
+.xsl
+.cgi
+.pl
+
+# Image types
+
+.bmp
+.cod
+.gif
+.ief
+.jpe
+.jpeg
+.jpg
+.jfif
+.tif
+.tiff
+.ras
+.cmx
+.ico
+.pnm
+.pbm
+.pgm
+.ppm
+.rgb
+.xbm
+.xpm
+.xwd

compose/e2guardian/lists/example.group/exceptionfilesiteiplist

@@ -0,0 +1,15 @@
+# Exception file site ip list
+# Use this list to define ip sites from which files can be downloaded,
+# overriding a blanket download block (blockdownloads = on) or the
+# banned MIME type and extension lists (blockdownloads = off).
+#
+# DOES NOT override content/virus scanning or site/URL bans.
+
+# IP site addresses 
+#
+# Single IPs, ranges and subnets can be used,
+# e.g.
+# 192.168.0.1
+# 10.0.0.1-10.0.0.3
+# 10.0.0.0/24
+#

compose/e2guardian/lists/example.group/exceptionfilesitelist

@@ -0,0 +1,30 @@
+# Exception file site list
+# Use this list to define sites from which files can be downloaded,
+# overriding a blanket download block (blockdownloads = on) or the
+# banned MIME type and extension lists (blockdownloads = off).
+#
+# DOES NOT override content/virus scanning or site/URL bans.
+
+# Don't bother with the www. or
+# the http://
+#
+# These are specifically domains and are not URLs.
+# For example 'foo.bar/porn/' is no good, you need
+# to just have 'foo.bar'.
+#
+# You can also match IPs here too.
+#
+# As of DansGuardian 2.7.3 you can now include
+# .tld so for example you can match .gov for example
+
+
+# Time limiting syntax:
+# #time: <start hour> <start minute> <end hour> <end minute> <days>
+# Example:
+##time: 9 0 17 0 01234
+# Remove the first # from the line above to enable this list only from
+# 9am to 5pm, Monday to Friday.
+
+windowsupdate.microsoft.com
+update.microsoft.com
+download.windowsupdate.com

compose/e2guardian/lists/example.group/exceptionfileurllist

@@ -0,0 +1,27 @@
+# Exception file URL list
+# Use this list to define URLs from which files can be downloaded,
+# overriding a blanket download block (blockdownloads = on) or the
+# banned MIME type and extension lists (blockdownloads = off).
+#
+# DOES NOT override content/virus scanning or site/URL bans.
+
+# Don't bother with the www. or
+# the http://
+#
+# These are specifically domains and are not URLs.
+# For example 'foo.bar/porn/' is no good, you need
+# to just have 'foo.bar'.
+#
+# You can also match IPs here too.
+#
+# As of DansGuardian 2.7.3 you can now include
+# .tld so for example you can match .gov for example
+
+
+# Time limiting syntax:
+# #time: <start hour> <start minute> <end hour> <end minute> <days>
+# Example:
+##time: 9 0 17 0 01234
+# Remove the first # from the line above to enable this list only from
+# 9am to 5pm, Monday to Friday.
+

compose/e2guardian/lists/example.group/exceptionmimetypelist

@@ -0,0 +1,40 @@
+# Exception MIME type list
+# Use as a filter group's "exceptionmimetypelist",
+# to override a blanket download block.
+# (blockdownloads = on)
+#
+# DOES NOT override content/virus scanning or site/URL bans.
+#
+# Default list:
+# Unblock web pages & graphics
+
+# Text/web document types
+
+text/plain
+text/html
+text/css
+text/xml
+text/xsl
+text/richtext
+
+# Image types
+
+image/bmp
+image/cis-cod
+image/gif
+image/ief
+image/jpeg
+image/pipeg
+image/png
+image/tiff
+image/x-cmu-raster
+image/x-cmx
+image/x-icon
+image/x-portable-anymap
+image/x-portable-bitmap
+image/x-portable-graymap
+image/x-portable-pixmap
+image/x-rgb
+image/x-xbitmap
+image/x-xpixmap
+image/x-xwindowdump

compose/e2guardian/lists/example.group/exceptionphraselist

@@ -0,0 +1,19 @@
+# EXCEPTIONPHRASELIST - INSTRUCTIONS FOR USE
+#
+# If any of the phrases listed below appear in a web page
+# then it will bypass the filtering and be allowed through
+# eg
+# < medical >
+#
+#
+# Combinations
+# Unblock the page if the following phrases are found on the same page.
+# Each line is a new combination.
+# eg
+#<education>,<biology>,<medical>
+#
+# See the bannedphraselist for more examples.
+
+# Use this sparingly as can easily make exceptions of unsuitable urls
+
+#.Include</etc/e2guardian/lists/phraselists/ukenglish/goodphrases/exception_email>

compose/e2guardian/lists/example.group/exceptionregexpheaderlist

@@ -0,0 +1,8 @@
+#Allowed outgoing HTTP headers based on regular expressions
+#
+# E.g. 'User-Agent: .*MSIE' would allow several versions of Internet Explorer
+# (assuming the user-agent is not being spoofed by the client)
+#
+# Headers are matched line-by-line, not as a single block.
+
+#listcategory: "Allowed Regular Expression HTTP Headers"

compose/e2guardian/lists/example.group/exceptionregexpurllist

@@ -0,0 +1,15 @@
+#Exception URLs based on Regular Expressions
+#
+# E.g. 'news' would unblock news.bbc.com etc
+
+# Example
+#news
+
+# Prevent content scanning of CSS and/or JavaScript files
+#^[^?]*\.css($|\?)
+#^[^?]*\.jsp?($|\?)
+
+# Allow Facebook plugin applications like
+# http://apps.facebook.com/neighborhoods/Setup.aspx and others.
+mock_ajax_proxy.php
+

compose/e2guardian/lists/example.group/exceptionregexpuseragentlist

@@ -0,0 +1,10 @@
+#Exception User-Agent based on regular expressions
+#
+# E.g. ' .*MSIE' would allow several versions of Internet Explorer
+# (assuming the user-agent is not being spoofed by the client)
+#
+# Usefull for allowing 'apps' to work
+# E.g. 'Kindle' would make kindle app an exception 
+
+#listcategory: "user-agent"
+

compose/e2guardian/lists/example.group/exceptionsiteiplist

@@ -0,0 +1,9 @@
+#IP Sites in exception list
+# IP site addresses 
+#
+# Single IPs, ranges and subnets can be used,
+# e.g.
+# 192.168.0.1
+# 10.0.0.1-10.0.0.3
+# 10.0.0.0/24
+#

compose/e2guardian/lists/example.group/exceptionsitelist

@@ -0,0 +1,24 @@
+#Sites in exception list
+#Don't bother with the www. or
+#the http://
+#
+#These are specifically domains and are not URLs.
+#For example 'foo.bar/porn/' is no good, you need
+#to just have 'foo.bar'.
+#
+# IP must be put in exceptionsiteiplist
+#
+#.tld so for example you can match .gov for example
+
+
+# Time limiting syntax:
+# #time: <start hour> <start minute> <end hour> <end minute> <days>
+# Example:
+##time: 9 0 17 0 01234
+# Remove the first # from the line above to enable this list only from
+# 9am to 5pm, Monday to Friday.
+
+# NOTE: From v5 Blanket exceptions are now implimented using Storyboarding 
+# WARNING: Old style Blanket blocks in this file will be silently ignored
+
+windowsupdate.microsoft.com

compose/e2guardian/lists/example.group/exceptionurllist

@@ -0,0 +1,15 @@
+#URLs in exception list
+#Don't bother with the www. or
+#the http://
+#
+#These are parts of sites that filtering should
+#be switched off for.
+#
+#These should not be domains, i.e. entire sites,
+#they should be a domain with a path.
+#
+#For example 'foo.bar' is no good, you need
+#to just have 'foo.bar/porn/'.
+#
+#Another example:
+#generallybadsite.tld/partthatsok/

compose/e2guardian/lists/example.group/exceptionvirusextensionlist

@@ -0,0 +1,45 @@
+# Exception file extension list
+# Use as a filter group's "exceptionvirusextensionlist",
+#
+# Default list:
+# Unblock web pages & graphics
+
+# Text/web document types
+
+.css
+.html
+.shtml
+.htm
+.stm
+.asp
+.php
+.txt
+.rtx
+.xml
+.xsl
+.cgi
+.pl
+
+# Image types
+
+.bmp
+.cod
+.gif
+.ief
+.jpe
+.jpeg
+.jpg
+.jfif
+.tif
+.tiff
+.ras
+.cmx
+.ico
+.pnm
+.pbm
+.pgm
+.ppm
+.rgb
+.xbm
+.xpm
+.xwd

compose/e2guardian/lists/example.group/exceptionvirussiteiplist

@@ -0,0 +1,12 @@
+# IP sites in exceptionvirussiteiplist 
+
+#The exceptionvirussiteiplist is for allowing ALL of an IP site
+
+# IP site addresses 
+#
+# Single IPs, ranges and subnets can be used,
+# e.g.
+# 192.168.0.1
+# 10.0.0.1-10.0.0.3
+# 10.0.0.0/24
+#

compose/e2guardian/lists/example.group/greysiteiplist

@@ -0,0 +1,16 @@
+# IP site in grey list
+
+#The 'grey' lists override the 'banned' lists.
+#The 'exception' lists override the 'banned' lists also.
+#The difference is that the 'exception' lists completely switch
+#off *all* other filtering for the match.  'grey' lists only
+#stop the URL filtering and allow the normal filtering to work.
+
+# IP site addresses 
+#
+# Single IPs, ranges and subnets can be used,
+# e.g.
+# 192.168.0.1
+# 10.0.0.1-10.0.0.3
+# 10.0.0.0/24
+#

compose/e2guardian/lists/example.group/greysitelist

@@ -0,0 +1,59 @@
+#domains in grey list
+#Don't bother with the www. or the http://
+
+#The 'grey' lists override the 'banned' lists.
+#The 'exception' lists override the 'banned' lists also.
+#The difference is that the 'exception' lists completely switch
+#off *all* other filtering for the match.  'grey' lists only
+#stop the URL filtering and allow the normal filtering to work.
+
+#An example of grey list use is when in Blanket Block (whitelist)
+#mode and you want to allow some sites but still filter as normal
+#on their content
+
+#Another example of grey list use is when you ban a site but want
+#to allow part of it.
+
+#The greyurllist is for partly unblocking PART of a site
+#The greysitelist is for partly unblocking ALL of a site
+
+#As of DansGuardian 2.7.3 you can now include
+#.tld so for example you can match .gov for example
+
+#To include additional files in this list use this example:
+#.Include</etc/e2guardian/anotherurllist>
+
+#You can have multiple .Includes.
+
+# Time limiting syntax:
+# #time: <start hour> <start minute> <end hour> <end minute> <days>
+# Example:
+##time: 9 0 17 0 01234
+# Remove the first # from the line above to enable this list only from
+# 9am to 5pm, Monday to Friday.
+
+
+# Blanket match.  To greylist all sites except those in the
+# exceptionsitelist and greysitelist files, remove
+# the # from the next line to leave only a '**':
+#**
+
+# Blanket SSL/CONNECT match.  To greylist all SSL 
+# and CONNECT tunnels except to addresses in the
+# exceptionsitelist and greysitelist files, remove
+# the # from the next line to leave only a '**s':
+#**s
+
+# Blanket IP match.  To greylist all sites specified only as an IP,
+# remove the # from the next line to leave only a '*ip':
+#*ip
+
+# Blanket SSL/CONNECT IP match.  To greylist all SSL and CONNECT
+# tunnels to sites specified only as an IP,
+# remove the # from the next line to leave only a '*ips':
+#*ips
+
+
+#List other sites to greylist:
+
+#www.bbc.co.uk

compose/e2guardian/lists/example.group/greysslsiteiplist

@@ -0,0 +1,10 @@
+# IP sites in SSL grey list
+
+# IP site addresses 
+#
+# Single IPs, ranges and subnets can be used,
+# e.g.
+# 192.168.0.1
+# 10.0.0.1-10.0.0.3
+# 10.0.0.0/24
+#

compose/e2guardian/lists/example.group/greysslsitelist

@@ -0,0 +1,4 @@
+#domains in SSL grey list
+#Don't bother with the www. or the https://
+
+#This 'grey' lists override the 'banned' lists for SSL only.

compose/e2guardian/lists/example.group/greyurllist

@@ -0,0 +1,27 @@
+#URLs in grey list
+#Don't bother with the http:// or the www
+
+#The greyurllist is for partly unblocking PART of a site
+#The greysitelist is for partly unblocking ALL of a site
+
+#The 'grey' lists override the 'banned' lists.
+#The 'exception' lists override the 'banned' lists also.
+#The difference is that the 'exception' lists completely switch
+#off *all* other filtering for the match.  'grey' lists only
+#stop the URL filtering and allow the normal filtering to work.
+
+#An example of grey list use is when in Blanket Block (whitelist)
+#mode and you want to allow some sites but still filter as normal
+#on their content
+
+#Another example of grey list use is when you ban a site but want
+#to allow part of it.
+
+#To include additional files in this list use this example:
+#.Include</etc/e2guardian/anotherurllist>
+
+#You can have multiple .Includes.
+
+#List other URLs to block:
+
+#members.home.net/nice

compose/e2guardian/lists/example.group/headerregexplist

@@ -0,0 +1,15 @@
+# Outgoing HTTP request header modifying Regular Expressions
+#
+# The format is: "extended regular expression"->"replacement straight string"
+# E.g. "shit"->"censored" would replace all occurances of shit in any case.
+# Far more complicated matches are possible.  See other sources for examples
+# of extended regular expressions.
+#
+# Headers are run through replacements line-by-line, not as a single block.
+#
+# To remove a header put "X-E2G-IgnoreMe:" as the replacement
+# e.g. to remove 'upgrade:' headers
+#"upgrade:.*$"->"X-E2G-IgnoreMe:"
+
+# Windows Live Search cookie replacement - force filtering on
+#"cookie:(.*)&ADLT=(OFF|DEMOTE)"->"Cookie:$1&ADLT=STRICT"

compose/e2guardian/lists/example.group/ipnobypass

@@ -0,0 +1,13 @@
+# User are not allowed to bypass IP sites in this list
+
+#
+# This is not the IP of web servers
+# you want to filter.
+
+# Single IPs, ranges and subnets can be used,
+# e.g.
+# 192.168.0.1
+# 10.0.0.1-10.0.0.3
+# 10.0.0.0/24
+#
+

compose/e2guardian/lists/example.group/localbannedsearchlist

@@ -0,0 +1,14 @@
+#Local Banned Search Words
+#
+#Words must be in alphabetic order within a single line
+# and separated by a '+' sign.
+#All combinations of the words will be blocked
+# e.g.   girl+naughty
+#     will block  naughty+girl as well as girl+naughty
+
+
+#.Include</home/dg/etc/local/lists/local_block_all/bannedsearchterms>
+#.Include</home/dg/etc/local/lists/porn/bannedsearchterms>
+#.Include</home/dg/etc/local/lists/proxy/bannedsearchterms>
+#.Include</home/dg/etc/local/lists/hacking/bannedsearchterms>
+#.Include</home/dg/etc/local/lists/drugs/bannedsearchterms>

compose/e2guardian/lists/example.group/localbannedsiteiplist

@@ -0,0 +1,10 @@
+# IP sites in local banned list
+
+# IP site addresses 
+#
+# Single IPs, ranges and subnets can be used,
+# e.g.
+# 192.168.0.1
+# 10.0.0.1-10.0.0.3
+# 10.0.0.0/24
+#

compose/e2guardian/lists/example.group/localbannedsitelist

@@ -0,0 +1,6 @@
+#domains in local banned list
+#.Include</home/dg/etc/local/lists/local_block_all/domains>
+#.Include</home/dg/etc/local/lists/porn/domains>
+#.Include</home/dg/etc/local/lists/proxy/domains>
+#.Include</home/dg/etc/local/lists/hacking/domains>
+#.Include</home/dg/etc/local/lists/drugs/domains>

compose/e2guardian/lists/example.group/localbannedsslsiteiplist

@@ -0,0 +1,12 @@
+# IP sites in local banned ssl list
+#This list is only used for SSL (or CONNECT) requests
+#Unlike the bannedsitelist it overides all other lists
+
+# IP site addresses 
+#
+# Single IPs, ranges and subnets can be used,
+# e.g.
+# 192.168.0.1
+# 10.0.0.1-10.0.0.3
+# 10.0.0.0/24
+#

compose/e2guardian/lists/example.group/localbannedsslsitelist

@@ -0,0 +1,5 @@
+#domains in banned ssl list
+#Don't bother with the www. or the https://
+#This list is only used for SSL (or CONNECT) requests
+# and has no effect when MITM is enabled
+#Unlike the bannedsitelist it overides all other lists

compose/e2guardian/lists/example.group/localbannedurllist

@@ -0,0 +1 @@
+#URLs in local banned list

compose/e2guardian/lists/example.group/localexceptionsiteiplist

@@ -0,0 +1,10 @@
+#IP Sites in local exception list
+
+# IP site addresses 
+#
+# Single IPs, ranges and subnets can be used,
+# e.g.
+# 192.168.0.1
+# 10.0.0.1-10.0.0.3
+# 10.0.0.0/24
+#

compose/e2guardian/lists/example.group/localexceptionsitelist

@@ -0,0 +1 @@
+#Sites in local exception list