Perguntas & Respostas

ola pessoal, estou tendo um problema na configuracao do meu squid, as acls de bloqueio a extencoes de download, de sites e de palavras nao estao funcionando... ou seja os terminai continuam fazendo downloads e acessando os sites que eram pra estar restritos vou mandar o arquivo squid.conf meu para que vcs possam analizar e me dizer o que eu fiz errado...


http_port 3128
maximum_object_size_in_memory 64 KB

maximum_object_size 16 MB
minimum_object_size 0 KB

cache_swap_low 90
cache_swap_high 95

cache_dir ufs /var/spool/squid 512 16 256

visible_hostname debian
cache_mgr carlos_epg@hotmail.com

access_log /var/log/squid/access.log squid


# OPTIONS FOR EXTERNAL SUPPORT PROGRAMS
# -----------------------------------------------------------------------------

hosts_file /etc/hosts

refresh_pattern ^ftp:      1440   20%   10080
refresh_pattern ^gopher:   1440   0%   1440
refresh_pattern .      0   20%   4320


# ACCESS CONTROLS
# -----------------------------------------------------------------------------

#acl que obriga os usuarios a se logarem antes de acessar qualquer pagina

auth_param basic program /usr/lib/squid/ncsa_auth /etc/squid/squid_passwd
acl autenticados proxy_auth REQUIRED
http_access allow autenticados


#configuracao padrao que tem que ser mantida:
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443      # https
acl SSL_ports port 563      # snews
acl SSL_ports port 873      # rsync
acl Safe_ports port 80      # http
acl Safe_ports port 21      # ftp
acl Safe_ports port 443      # https
acl Safe_ports port 70      # gopher
acl Safe_ports port 210      # wais
acl Safe_ports port 1025-65535   # unregistered ports
acl Safe_ports port 280      # http-mgmt
acl Safe_ports port 488      # gss-http
acl Safe_ports port 591      # filemaker
acl Safe_ports port 777      # multiling http
acl Safe_ports port 631      # cups
acl Safe_ports port 873      # rsync
acl Safe_ports port 901      # SWAT
acl purge method PURGE
acl CONNECT method CONNECT

#Recommended minimum configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
# Only allow purge requests from localhost
http_access allow purge localhost
http_access deny purge
# Deny requests to unknown ports
http_access deny !Safe_ports
# Deny CONNECT to other than SSL ports
http_access deny CONNECT !SSL_ports

#nega acesso a sites
acl sites dstdom_regex -i "/etc/squid/bloqueados/sitesproibidos"
http_access deny sites

#nega acesso a palavras
acl nomes url_regex -i "/etc/squid/bloqueados/palavra"
http_access deny nomes

#nega download de arquivos
acl download url_regex -i .exe$ .avi$ .mp3$ .wmv$ .mpeg$ .mpg$ .rm$ .wma$
http_access deny download

#acl que informa a faixa de ip da minha rede e quais pcs usaram o proxy
acl our_networks src 10.1.1.131/255.255.255.255 10.1.1.100/255.255.255.255
http_access allow our_networks
http_access allow localhost

#negando acesso a todas regras que nao sejam as sitadas acima
http_access deny all

# Insert your own rules here.
#
#
# and finally allow by default
http_reply_access allow all

# icp_access deny all
#
#Allow ICP queries from everyone
icp_access allow all

# ADMINISTRATIVE PARAMETERS
# -----------------------------------------------------------------------------

cache_effective_group proxy


# OPTIONS FOR THE CACHE REGISTRATION SERVICE
# -----------------------------------------------------------------------------

# DELAY POOL PARAMETERS (all require DELAY_POOLS compilation option)
# -----------------------------------------------------------------------------

coredump_dir /var/spool/squid



e tbm vou mandar o ex de como estao os arquivos palavras e sites

palavras :

default.default
sexo
sexy
hacker



o arquivo sites :

default.default
astalavista.com
playboy.abril.com.br
orkut.com


gostaria que vcs me dissessem onde esta o meu erro na configuracao, o pq as acls que eu criei nao funcionam... pois todo o restante esta funcionando normalmente... estou usando o debian...