RalfGesellensetter wrote: > Am Freitag 19 Oktober 2007 schrieb José L. Redrejo Rodríguez: > >> acl no_ie browser MSIE >> http_access deny no_ie >> #allowing windowsupdate with ie: >> acl windowsupdate dstdomain .windowsupdate.com >> acl windowsupdate dstdomain .microsoft.com >> acl windowsupdate dstdomain .public-trust.com >> acl windowsupdate dstdomain .windows.com >> acl windowsupdate dstdomain .webiqonline.com >> acl windowsupdate dstdomain 207.46.224.158 >> acl windowsupdate dstdomain .msn.com >> always_direct allow windowsupdate >> http_access allow windowsupdate >> > > Thanks José, > > following your suggestion, I am glad to report successful > implementation. Two additional things: > - I added a dedicated error page explaining the danger of IE > (and linking to http://www.webdevout.net/ie-is-dangerous) > - I added a allow rule for opera: > >> acl opera browser Opera >> http_access allow opera >> > > Note, that the allow rule needs to be after blacklist, otherwise Opera > users could surf all the web. In the same turn I may suggest adding > this default rules to our default configuration: > > acl schoolnet src 10.0.2.0/255.255.254.0 > acl ltspnet src 192.168.0.0/255.255.255.0 > acl all src 0.0.0.0/0.0.0.0 > acl manager proto cache_object > acl localhost src 127.0.0.1/255.255.255.255 > acl to_localhost dst 127.0.0.0/8 > acl SSL_ports port 443 563 > acl SSL_ports port 873 > acl Safe_ports port 80,8080 > acl Safe_ports port 21 > acl Safe_ports port 443 563 > acl Safe_ports port 70 > acl Safe_ports port 210 > acl Safe_ports port 1025-65535 > acl Safe_ports port 280 > acl Safe_ports port 488 > acl Safe_ports port 591 > acl Safe_ports port 777 > acl Safe_ports port 631 > acl Safe_ports port 873 > acl Safe_ports port 901 > acl purge method PURGE > acl CONNECT method CONNECT > acl blacklist url_regex "/etc/squid/blacklist" > acl whitelist url_regex "/etc/squid/whitelist" > acl ltspserver00 src 10.0.2.10-10.0.2.10/255.255.255.255 > acl tjener srcdomain tjener intern > acl lockedhosts src "/etc/squid/lockedhosts" > acl openhosts src "7etc/squid/openhosts" > acl no_ie browser MSIE > acl opera browser Opera > > http_access allow manager localhost > http_access deny manager > http_access allow purge localhost > http_access deny purge > http_access deny !Safe_ports > http_access deny CONNECT !SSL_ports > http_access allow whitelist > http_access deny blacklist > http_access deny lockedhosts > http_access allow opera > http_access deny no_ie > http_access allow tjener > http_access allow schoolnet > http_access allow ltspnet > http_access allow localhost > http_access deny all > > http_reply_access allow all > icp_access allow all > cachemgr_passwd mySecret all > error_directory /usr/share/squid/errors/English > coredump_dir /var/spool/squid > deny_info no_ie.html no_ie > > ------ > > some files that are used here should be delivered empty or with sample > entries. This can help users to find a start. > > Kind regards > Ralf > > what method do you use to enforce IE using the proxy ? proxy autoconfig ? transparent proxy ? manually/automated configuring the clients ?
Ronny
