Re: проблемы с squid
> А в чем заключалась целесообразность пересборки? Может, стоит
> попробовать дистрибутивную версию?
>
собиралось вручную задолго до меня и скорее всего из-за необходимости
ntlm аутентификации
собственно мой конфиг:
http_port 172.20.0.11:3128
http_port 192.168.253.1:3128
http_port 127.0.0.1:3128
icp_port 0
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
cache_mem 16 MB
cache_swap_low 96
cache_swap_high 98
maximum_object_size 8192 KB
minimum_object_size 0 KB
maximum_object_size_in_memory 8 KB
ipcache_size 8192
ipcache_low 90
ipcache_high 95
fqdncache_size 1024
cache_replacement_policy heap LFUDA
memory_replacement_policy heap LFUDA
cache_dir ufs /var/spool/squid 3072 16 256
cache_access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log
cache_store_log none
emulate_httpd_log off
log_ip_on_direct off
mime_table /usr/local/squid/etc/mime.conf
log_mime_hdrs off
useragent_log /var/log/squid/useragent.log
referer_log /var/log/squid/referer.log
pid_filename /var/run/squid.pid
debug_options ALL,1
log_fqdn off
client_netmask 255.255.255.255
ftp_user fuck@oma.by
ftp_list_width 48
ftp_passive on
ftp_sanitycheck on
diskd_program /usr/local/squid/libexec/diskd
unlinkd_program /usr/local/squid/libexec/unlinkd
redirect_program /usr/local/squidGuard/bin/squidGuard -c
/usr/local/squidGuard/etc/squidGuard.conf
redirect_children 30
redirector_bypass on
auth_param ntlm program /usr/local/samba/bin/ntlm_auth
--helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 10
auth_param ntlm max_challenge_reuses 0
auth_param ntlm max_challenge_lifetime 2 minutes
auth_param basic program /usr/local/squid/libexec/ncsa_auth
/usr/local/squid/etc/passwd
auth_param basic children 15
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
authenticate_cache_garbage_interval 1 hour
authenticate_ttl 1 hour
authenticate_ip_ttl 2 hours
external_acl_type NT_global_group %LOGIN
/usr/local/squid/libexec/wbinfo_group.pl
request_header_max_size 64 KB
request_body_max_size 1 MB
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
quick_abort_min 16 KB
quick_abort_max 16 KB
quick_abort_pct 95
negative_ttl 1 minutes
positive_dns_ttl 6 hours
negative_dns_ttl 5 minutes
range_offset_limit 0 KB
connect_timeout 2 minutes
read_timeout 5 minutes
request_timeout 60 seconds
persistent_request_timeout 1 minute
client_lifetime 1 day
half_closed_clients on
pconn_timeout 120 seconds
shutdown_lifetime 30 seconds
acl aclocsrc src 172.20.0.0/16
acl aclocdst dst 172.20.0.0/16
#debian reposirory
acl debian_s src 192.168.248.0/24
acl debian_d dstdomain .debian.org .debian.ru .mgts.by
acl DEB_PRT port 80 21
#SuSe repository
acl suse_src src 172.20.0.15/32
acl suse_dst dst 0.0.0.0/0.0.0.0
acl suse_prt port 80 21
acl oma_src src 172.20.0.0/16 192.168.128.0/24 192.168.129.0/24
192.168.130.0/24 192.168.131.0/24 192.168.132.0/24 192.168.139.0/24
192.168.250.0/28 192.168.248.0/24 192.168.136.0/24
acl oma_dom dstdomain .oma.by .icetrade.by .google-analytics.com .hotlog.ru
acl oma_port port 80
acl office external NT_global_group ProxyUsers
acl winupdate src 172.20.0.10/32
acl winupdate1 src 172.20.0.7/32
acl staff src 172.20.1.0/29
acl ppp src 172.20.10.0/25
acl icqtest src 172.20.0.0/16 192.168.128.0/24 192.168.129.0/24
192.168.130.0/24 192.168.131.0/24 192.168.132.0/24 192.168.139.0/24
192.168.250.0/28 192.168.248.0/24
acl btc_net src 172.20.0.0/16
acl btc_addr dst 84.149.99.21/32
acl btc_dom dstdomain .cuprum.neolocation.net
acl btc_prt port 3306
acl 1connect max_user_ip 1
acl day time MTWHF 08:30-18:00
acl night time MTWHF 18:00-24:00
acl night1 time MTWHFSA 00:00-07:00
acl weekend time SA
acl ICQ_DOMAIN dstdomain http.proxy.icq.com cb.icq.com
icq.com aol.com login.icq.com irc.icq.com login.messaging.aol.com
acl ICQ_ADDR dst 64.12.0.0/16 205.188.0.0/16
acl ICQ_PORT port 443 5190
acl ICQ_PROTO proto HTTPS
acl CONNECT method CONNECT
acl password proxy_auth REQUIRED
#Recommended minimum configuration:
acl all src 0.0.0.0/0.0.0.0
acl statistics snmp_community measure-my
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 444 563 4443 4445 9010
acl Safe_ports port 80 # http
acl Safe_ports port 81 # http
acl Safe_ports port 4080 # http
acl Safe_ports port 8000 # http
acl Safe_ports port 8100 # http
acl Safe_ports port 8101 # http
acl Safe_ports port 8102 # http
acl Safe_ports port 8103 # http
acl Safe_ports port 8104 # http
acl Safe_ports port 8081 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 444 563 4443 4445 9010 #
https, snews
acl Safe_ports port 5190 # icq
acl Safe_ports port 3306 #bts-internet
#acl Safe_ports port 70 # gopher
#acl Safe_ports port 210 # wais
#acl Safe_ports port 1025-65535 # unregistered ports
#acl Safe_ports port 280 # http-mgmt
#acl Safe_ports port 488 # gss-http
#acl Safe_ports port 591 # filemaker
#acl Safe_ports port 777 # multiling http
#Recommended minimum configuration:
http_access allow debian_s debian_d
http_access allow suse_src suse_dst
http_access allow oma_src oma_dom
http_access allow manager localhost
http_access deny manager
http_access allow btc_net btc_dom
http_access allow btc_net btc_addr
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access deny to_localhost
http_access allow icqtest ICQ_DOMAIN
http_access allow icqtest ICQ_ADDR
http_access allow winupdate night1
http_access deny winupdate
http_access allow winupdate1
http_access deny winupdate
http_access allow staff
http_access deny staff
http_access allow ppp
http_access deny ppp
http_access allow office
http_access deny office
http_access deny all
http_reply_access allow all
icp_access deny all
always_direct allow oma_dom oma_port CONNECT
always_direct allow ICQ_DOMAIN ICQ_PORT CONNECT
always_direct allow ICQ_ADDR ICQ_PORT CONNECT
always_direct allow btc_dom btc_prt CONNECT
always_direct allow btc_addr btc_prt CONNECT
always_direct allow debian_d DEB_PRT CONNECT
always_direct allow suse_dst suse_prt CONNECT
miss_access allow all
reply_body_max_size 0 allow all
cache_effective_user squid
cache_effective_group squid
visible_hostname proxy.oma.by
logfile_rotate 10
append_domain .oma.by
tcp_recv_bufsize 0 bytes
memory_pools on
memory_pools_limit 32 MB
forwarded_for off
cachemgr_passwd disable all
store_avg_object_size 13 KB
store_objects_per_bucket 50
client_db on
icon_directory /usr/local/squid/share/icons
error_directory /usr/local/squid/share/errors/Russian-koi8-r
maximum_single_addr_tries 3
snmp_port 3401
snmp_access allow statistics localhost
snmp_access deny all
snmp_incoming_address 0.0.0.0
snmp_outgoing_address 255.255.255.255
--
В смысле осмысления бессмысленного смысл тоже имеет определенную
осмысленность!!!
Reply to: