Differences between version 3 and predecessor to the previous major change of SquidNotes.
Other diffs: Previous Revision, Previous Author, or view the Annotated Edit History
| Newer page: | version 3 | Last edited on Thursday, June 24, 2004 5:41:00 pm | by CraigBox | Revert |
| Older page: | version 1 | Last edited on Thursday, June 24, 2004 2:25:56 pm | by GreigMcGill | Revert |
@@ -1,11 +1,104 @@
-!!Squid Proxy Auth with NTLM.
+!!! [
Squid] Caching
Proxy Server Notes
-This will allow anyone in the AD Group "Internet" to have full access to the internet, and anyone in "Domain Users" (and not in "Internet") to access sites in the "/etc/squid-allowedsites" file only.
+!!Problem solving
-If you are using IE
, this will work transparently
using NTLM Authentication
. If you're using another browser and you'll be prompted for
a username and password
.
+!Resolving name problems
+Having problems that !http://brian/wherever/whatever doesn't resolve in Squid? This is caused by Squid running its own DNS resolver
, instead of
using gethostbyname(3)
. It pulls the IPs of the name servers out of resolv.conf(5). Add
a line like this to your squid
.conf:
-Using Squid 2.5STABLE3 and Samba 2.2.8a. Squid was recompiled with all winbind helpers and samba was recompiled with challenge-auth.
+ append_domain .yourdomain.tla
+
+Any domain without a dot in it will get that domain prepended to it; everything works nicely all of a sudden.
+
+!Always get Connection Refused for any website
+probably means that squid has run out of disk space...
+
+!"Unable to load page" error
+
+[Microsoft] InternetExplorer 6 SP 1 has a bug where if you are using "Basic" auth (eg, with squid), the first page afterwards will display an "Unable to load page" error. This is because MSIE tries to reuse an already closed [TCP] connection. See KB:331906.
+
+!!Add-on utilities for Squid
+
+! Log Analysis (sarg)
+sarg is a log file analyser for squid. It's partially useful.
+
+[Sarg|http://web.onda.com.br/orso/index.html] is a reasonably nice tool for generating nice reports for your squid logs. I have only two problems with it currently.
+* Dates on reports spanning weeks or months are often wrong - all the data is there but the title of the report says it only covers 2-5 days.
+* Only shows reports of the percentage of traffic that was/was not served from the cache. Does not give an actual byte count. Sure it is easy to calculate it from the total but it would be even easier if it did it for me.
+
+! Log Analysis (srg)
+SRG is a fast and flexible log analyser written in C/C++, it was written by MattBrown while working for [CRCnet] because none of the existing log analysation programs such as sarg were adequate. In particular SRG allows you to generate reports right down to the level of each file requested from a site, and reports can be generated in plain html or using PHP to allow you to easily integrate with your squid authentication system to restrict access to all or parts of the report. Another useful feature of SRG is the ability to generate an email every time a report is generated summarising the traffic used during the reporting period.
+
+SRG is released under the GPL and is under active development.
+
+Find out more about srg at http://www.crc.net.nz/software/srg.php
+
+! Graphing Squid data
+[Here|http://www.serassio.it/SquidNT/MRTG.htm] are some other notes on [Squid], [SNMP] and [MRTG]. This shows sample [MRTG] config options for graphing some of the info. Note that you can get MRTG to talk directly to Squid's nonstard SNMP port.
+
+! Content Blocking
+
+Investigate the following blacklists:
+
+* DansGuardian (http://dansguardian.org) (GPL, but commercial users are asked to pay for DL)
+* SquidGuard (http://www.squidguard.org) (GPL but you can't sell it)
+
+(Note from Daniel Barron, DG author: the SG clause is in violation of the GPL and thus is invalid. The DG license is fully 100% within the GPL. What is asked for is that commercial users pay to __download__ DG. I just thought I'd clarify the [FUD].)
+
+
+!!Useful configurations and tips
+
+! Proxy Auto Detection
+
+To set things up so that your web browsers auto detect your proxy server, investigate [WPAD], the Web Proxy Auto Detection script.
+
+! Filtering - [ACL]s in squid
+
+When specifying ACLs, dont set more than one type of acl on a single acl line. Squid ignores them. eg:
+
+<pre>
+ acl lab proxy_auth labuser src 192.168.2./32
+ acl denylab proxy_auth labuser
+ ....
+ http_access allow lab
+ http_access deny denylab
+</pre>
+
+doesn't work. instead:
+<pre>
+ acl labuser proxy_auth labuser
+ acl labmachines proxy_auth 192.168.2./32
+ ....
+ http_access allow labuser labmachines
+ http_access deny labuser
+</pre>
+
+will do the trick.
+
+!URL Blocking
+<pre>
+ acl restrictedmachine src ip.ad.dr.ess/255.255.255.255
+ acl restrictedmachinesites dstdomain "/etc/squid/list-of-sites"
+
+ http_access allow restrictedmachine restrictedmachinesites
+ http_access deny restrictedmachine
+</pre>
+list-of-sites takes the form
+<pre>
+ # banned sites list
+ host.domain.com
+ # or
+ .domain.com
+ # for everything in domain.com
+</pre>
+
+!!Proxy Auth with [NTLM]
+
+A full working example on having a Squid proxy pick up user information from NTLM and a MicrosoftWindows ActiveDiretory. This will allow anyone in the AD Group "Internet" to have full access to the internet, and anyone in "Domain Users" (and not in "Internet") to access sites in the "/etc/squid-allowedsites" file only.
+
+If you are using InternetExplorer or newer [Mozilla] browsers, this will work transparently using NTLM Authentication. If you're using another browser and you'll be prompted for a username and password.
+
+
Using [
Squid]
2.5STABLE3 and [
Samba]
2.2.8a. Squid was recompiled with all winbind helpers and samba was recompiled with challenge-auth.
Initially we tried to use transparent proxying AND NTLM auth, as all indications were that this should work. In practice it does not - it seems there are bugs in squid which prevent this.
After installation of all packages and config files, samba must be joined to the domain with the command "smbpasswd -j DOMAIN -r PDC -U Administrator" - this will prompt you for the admin password.
@@ -42,19 +135,8 @@
external_acl_type NT_global_group %LOGIN /usr/lib/squid/wb_group -c
acl FullUsers external NT_global_group "/etc/squid-fullusers"
acl SSL_ports port 443 563
-acl Safe_ports port 80 # http
-acl Safe_ports port 21 # ftp
-acl Safe_ports port 443 563 # https, snews
-acl Safe_ports port 70 # gopher
-acl Safe_ports port 210 # wais
-acl Safe_ports port 1025-65535 # unregistered ports
-acl Safe_ports port 280 # http-mgmt
-acl Safe_ports port 488 # gss-http
-acl Safe_ports port 591 # filemaker
-acl Safe_ports port 777 # multiling http
-acl Safe_ports port 901 # SWAT
#acl purge method PURGE
#acl CONNECT method CONNECT
#http_access allow manager localhost
