Perguntas & Respostas

estou com problemas nas acls do meu proxy... elas nao funcionam... vou mandar meu arquivo squid.conf para que vcs analisem tudo... e me digam o que pode ser...


http_port 3128 transparent
maximum_object_size_in_memory 64 KB

maximum_object_size 16 MB
minimum_object_size 0 KB

cache_swap_low 90
cache_swap_high 95

cache_dir ufs /var/spool/squid 512 16 256
error_directory /usr/share/squid/errors/Portuguese

visible_hostname debian
cache_mgr carlos_epg@hotmail.com

access_log /var/log/squid/access.log squid


# OPTIONS FOR EXTERNAL SUPPORT PROGRAMS
# -----------------------------------------------------------------------------

hosts_file /etc/hosts

refresh_pattern ^ftp:      1440   20%   10080
refresh_pattern ^gopher:   1440   0%   1440
refresh_pattern .      0   20%   4320


# ACCESS CONTROLS
# -----------------------------------------------------------------------------

#acl que obriga os usuarios a se logarem antes de acessar qualquer pagina

auth_param basic program /usr/lib/squid/ncsa_auth /etc/squid/squid_passwd
acl autenticados proxy_auth REQUIRED
http_access allow autenticados


#configuracao padrao que tem que ser mantida:
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443      # https
acl SSL_ports port 563      # snews
acl SSL_ports port 873      # rsync
acl Safe_ports port 80      # http
acl Safe_ports port 21      # ftp
acl Safe_ports port 443      # https
acl Safe_ports port 70      # gopher
acl Safe_ports port 210      # wais
acl Safe_ports port 1025-65535   # unregistered ports
acl Safe_ports port 280      # http-mgmt
acl Safe_ports port 488      # gss-http
acl Safe_ports port 591      # filemaker
acl Safe_ports port 777      # multiling http
acl Safe_ports port 631      # cups
acl Safe_ports port 873      # rsync
acl Safe_ports port 901      # SWAT
acl purge method PURGE
acl CONNECT method CONNECT

#Recommended minimum configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
# Only allow purge requests from localhost
http_access allow purge localhost
http_access deny purge
# Deny requests to unknown ports
http_access deny !Safe_ports
# Deny CONNECT to other than SSL ports
http_access deny CONNECT !SSL_ports

#nega acesso a sites
acl sites dstdomain -i "/etc/squid/bloqueados/sitesproibidos.txt"
http_access deny sites

#nega acesso a palavras
acl nomes url_regex -i "/etc/squid/bloqueados/negapalavra.txt"
http_access deny nomes

#nega download de arquivos
acl download url_regex -i .exe$ .avi$ .mp3$ .wmv$ .mpeg$ .mpg$ .rm$ .wma$
http_access deny download

#acl que informa a faixa de ip da minha rede e quais pcs usaram o proxy
acl our_networks src 10.1.1.131/255.255.255.255 10.1.1.100/255.255.255.255
http_access allow our_networks
http_access allow localhost

#negando acesso a todas regras que nao sejam as sitadas acima
http_access deny all

# Insert your own rules here.
#
#
# and finally allow by default
http_reply_access allow all

# icp_access deny all
#
#Allow ICP queries from everyone
icp_access allow all

# ADMINISTRATIVE PARAMETERS
# -----------------------------------------------------------------------------

cache_effective_group proxy


# OPTIONS FOR THE CACHE REGISTRATION SERVICE
# -----------------------------------------------------------------------------

# DELAY POOL PARAMETERS (all require DELAY_POOLS compilation option)
# -----------------------------------------------------------------------------

coredump_dir /var/spool/squid
logfile_rotate 10


e tbm uso o comando do iptables para redirecionar todo trafego da porta 80 para a 3128 do squid...

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to 3128

estou usando debian para fazer estas configuracoes... ja li varios tutoriais sobre proxy para chegar nesta configuracao... e li tbm sobre iptables... mas mesmo assim os clientes acessam todos os sites e fazem downloads, ignorando as regras das acls... espero que possam me ajudar... a resolver este problema...