http_access deny acesso_restrito http_access allow liberado http_access allow acesso_total http_access allow rede_interna #esta linha nem precisa
2009/5/20 Eslei Jesus <[email protected]> > > > Olá pessoal, > > Estou com um problema no squid, tenho um grupo de usuários com acesso total > e outro com acesso restrito todos controlados por IP e proxy transparente. > Acontece que quando o usuário coloca um IP que não esteja nos grupos (nas > listas de acesso) ele consegue ter acesso total aos sites, ou seja, não > passa pelo proxy. > > Quero saber onde estou errando, onde devo corrigir. Obrigado pela atenção > de todos. > > # WELCOME TO SQUID 2.7 > # ---------------------------- > # Proxy Transparente > http_port 3128 transparent > htcp_port 3128 > > hierarchy_stoplist cgi-bin ? > acl QUERY urlpath_regex cgi-bin \? > no_cache deny QUERY > acl apache rep_header Server ^Apache > broken_vary_encoding allow apache > > # > ----------------------------------------------------------------------------- > cache_mem 300 MB > cache_swap_low 90 > cache_swap_high 95 > maximum_object_size 32 MB > minimum_object_size 0 KB > maximum_object_size_in_memory 128 KB > > ipcache_size 1024 > ipcache_low 90 > ipcache_high 95 > fqdncache_size 1024 > > cache_dir ufs /var/spool/squid 3000 16 256 > access_log /var/log/squid/access.log > > # > ----------------------------------------------------------------------------- > ftp_user anonymous@ > dns_retransmit_interval 5 seconds > dns_timeout 2 minutes > dns_defnames on > dns_nameservers 127.0.0.1 200.255.255.66 200.255.255.77 > hosts_file /etc/hosts > > refresh_pattern ^ftp: 1440 20% 10080 > refresh_pattern ^gopher: 1440 0% 1440 > refresh_pattern . 0 20% 4320 > > # ACCESS CONTROLS > acl all src 0.0.0.0/0.0.0.0 > acl acesso_total src "/etc/squid/acesso_total.txt" > acl acesso_restrito src "/etc/squid/acesso_restrito.txt" > acl liberado url_regex -i "/etc/squid/liberado.txt" > acl manager proto cache_object > acl localhost src 127.0.0.1/255.255.255.255 > acl rede_interna src 172.16.1.0/255.255.255.0 > acl sistemaai dst 200.241.59.9 > acl windows dstdomain microsoft.com > acl to_localhost dst 127.0.0.0/8 > acl SSL_ports port 443 # https > acl Safe_ports port 3128 # proxy > acl Safe_ports port 110 > acl Safe_ports port 25 > acl Safe_ports port 2096 > acl SSL_ports port 563 # snews > acl SSL_ports port 873 # rsync > acl Safe_ports port 80 # http > acl Safe_ports port 20 # ftp > acl Safe_ports port 21 # ftp > acl Safe_ports port 443 # https > acl Safe_ports port 70 # gopher > acl Safe_ports port 210 # wais > acl Safe_ports port 1025-65535 # unregistered ports > acl Safe_ports port 280 # http-mgmt > acl Safe_ports port 488 # gss-http > acl Safe_ports port 591 # filemaker > acl Safe_ports port 777 # multiling http > acl Safe_ports port 631 # cups > acl Safe_ports port 873 # rsync > acl Safe_ports port 901 # SWAT > acl purge method PURGE > acl CONNECT method CONNECT > > # Controle de Banda > # ====================================================================== > acl suporte src 172.16.1.245 > http_access allow suporte > delay_pools 1 > delay_class 1 2 > # Reserva 128kbps para o servidor, e 512kbps para os clientes > # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > delay_parameters 1 114688/114688 65536/65536 > delay_access 1 allow rede_interna > # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> > > # ==================================================================== > > http_access allow manager localhost > http_access deny manager > http_access allow purge localhost > http_access deny purge > http_access deny !Safe_ports > http_access deny CONNECT !SSL_ports > http_access allow sistemaai > > # ======================================================== > > http_access deny !liberado acesso_restrito > http_access allow acesso_total > http_access allow rede_interna > http_access allow localhost > http_access deny all > > http_reply_access allow all > icp_access allow all > > cache_effective_group proxy > > visible_hostname master > error_directory /usr/share/squid/errors/Portuguese > > >
