[squid-users] Any suggestions or comments about my configuration? squid 3.5.20

[neok]

Thank you very much Amos!
Your indications have helped me a lot. I have been able to apply them to
practically all of them.

I share my configuration in case someone with the same objectives can use
it.

Greetings!

squid.conf

### Negotiate/NTLM and Negotiate/Kerberos authentication
auth_param negotiate program /usr/sbin/negotiate_wrapper --ntlm
/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp --kerberos
/usr/lib64/squid/negotiate_kerberos_auth -r -i -s GSS_C_NO_NAME 
auth_param negotiate children 10 
auth_param negotiate keep_alive on

### standard allowed ports
acl SSL_ports port 443 
acl Safe_ports port 80 # http 
acl Safe_ports port 21 # ftp 
acl Safe_ports port 443 # https 
acl Safe_ports port 70 # gopher 
acl Safe_ports port 210 # wais 
acl Safe_ports port 1025-65535 # unregistered ports 
acl Safe_ports port 280 # http-mgmt 
acl Safe_ports port 488 # gss-http 
acl Safe_ports port 591 # filemaker 
acl Safe_ports port 777 # multiling http 
acl CONNECT method CONNECT

### destination domains to be blocked in a HTTP access control policy
acl LS_adult dstdomain -i "/etc/squid/DBL/adult.txt"
acl LS_anonvpn dstdomain -i "/etc/squid/DBL/anonvpn.txt"
acl LS_hacking dstdomain -i "/etc/squid/DBL/hacking.txt"
acl LS_malicius dstdomain -i "/etc/squid/DBL/malicius.txt"
acl LS_remotecontrol dstdomain -i "/etc/squid/DBL/remotecontrol.txt"
acl LS_warez dstdomain -i "/etc/squid/DBL/warez.txt"

### acl for proxy authentication (kerberos or ntlm)
acl auth proxy_auth REQUIRED

### LDAP group membership sources ###
external_acl_type AD_WEB_ACCESS %LOGIN /usr/lib64/squid/ext_ldap_group_acl
-P -R -b "OU=USERS,DC=netgol,DC=local" -D ldap -W "/etc/squid/ldap_pass.txt"
-f
"(&(sAMAccountname=%u)(memberof=cn=%g,OU=INTERNET,OU=PERMISSIONS,OU=USERS,DC=netgol,DC=local))"
-h s-dc1.netgol.local
acl WEB_USERS_1 external AD_WEB_ACCESS WEB_USERS_1
acl WEB_USERS_2 external AD_WEB_ACCESS WEB_USERS_2
acl WEB_USERS_3 external AD_WEB_ACCESS WEB_USERS_3

### HTTP access control policies
http_access deny !Safe_ports 
http_access deny CONNECT !SSL_ports 
http_access allow localhost manager 
http_access deny manager
http_access deny !auth
http_access allow localhost
http_access deny LS_malicius			# malicius sites denied for all

http_access allow WEB_USERS_1					# WEB_USERS_1 member users can browse
without restrictions

http_access deny WEB_USERS_2 LS_remotecontrol	# WEB_USERS_2 member users
can't browse Remote Control sites
http_access deny WEB_USERS_2 LS_warez			# WEB_USERS_2 member users can't
browse Warez sites
http_access allow WEB_USERS_2					# WEB_USERS_2 member users can browse the
rest of the sites not bloqued

http_access deny WEB_USERS_3 LS_adult			# WEB_USERS_3 member users can't
browse Adult sites
http_access deny WEB_USERS_3 LS_anonvpn			# WEB_USERS_3 member users can't
browse Anonymous VPN sites
http_access deny WEB_USERS_3 LS_hacking			# WEB_USERS_3 member users can't
browse Hacking sites
http_access deny WEB_USERS_3 LS_remotecontrol	# WEB_USERS_3 member users
can't browse Remote Control sites
http_access deny WEB_USERS_3 LS_warez			# WEB_USERS_3 member users can't
browse Warez sites
http_access allow WEB_USERS_3					# WEB_USERS_3 member users can browse the
rest of the sites not bloqued

http_access deny all

### PERSONALIZATION ###
http_port 8080 
coredump_dir /var/spool/squid 
refresh_pattern ^ftp: 1440 20% 10080 
refresh_pattern ^gopher: 1440 0% 1440 
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 
refresh_pattern .  0 20% 4320 
quick_abort_min 0 KB 
quick_abort_max 0 KB 
read_timeout 5 minutes 
request_timeout 3 minutes 
shutdown_lifetime 15 seconds 
ipcache_size 2048 
fqdncache_size 4096 
forwarded_for off 
cache_mgr support at netgol.net 
visible_hostname proxy.netgol.local 
httpd_suppress_version_string on 
logfile_rotate 7



--
Sent from: http://squid-web-proxy-cache.1019090.n4.nabble.com/Squid-Users-f1019091.html