<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
-----BEGIN PGP SIGNED MESSAGE----- <br>
Hash: SHA1 <br>
<br>
<a class="moz-txt-link-freetext" href="http://www.squid-cache.org/Doc/config/debug_options/">http://www.squid-cache.org/Doc/config/debug_options/</a><br>
<a class="moz-txt-link-freetext" href="http://wiki.squid-cache.org/KnowledgeBase/DebugSections">http://wiki.squid-cache.org/KnowledgeBase/DebugSections</a><br>
<br>
04.02.2015 18:54, <a class="moz-txt-link-abbreviated" href="mailto:Andreas.Reschke@mahle.com">Andreas.Reschke@mahle.com</a> пишет:<br>
<span style="white-space: pre;">> "squid-users"
<a class="moz-txt-link-rfc2396E" href="mailto:squid-users-bounces@lists.squid-cache.org"><squid-users-bounces@lists.squid-cache.org></a> schrieb am
04.02.2015 13:41:17:<br>
><br>
> > Von: Yuri Voinov <a class="moz-txt-link-rfc2396E" href="mailto:yvoinov@gmail.com"><yvoinov@gmail.com></a><br>
> > An: <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> > Datum: 04.02.2015 13:41<br>
> > Betreff: Re: [squid-users] Antwort: Re: Order of
http_access allow/deny<br>
> > Gesendet von: "squid-users"
<a class="moz-txt-link-rfc2396E" href="mailto:squid-users-bounces@lists.squid-cache.org"><squid-users-bounces@lists.squid-cache.org></a><br>
> ><br>
> ><br>
> As you can see (and warning your get shown it) the problem is
not in ACL's.<br>
><br>
> But in auth helper or near it:<br>
><br>
> ext_ldap_group_acl: WARNING: could not bind to binddn
'Invalid credentials<br>
><br>
> > And how can i debug it? All I found is too much of
output. How can I customize the debug level?<br>
><br>
><br>
><br>
><br>
> 04.02.2015 18:34, <a class="moz-txt-link-abbreviated" href="mailto:Andreas.Reschke@mahle.com">Andreas.Reschke@mahle.com</a> пишет:<br>
> > "squid-users"
<a class="moz-txt-link-rfc2396E" href="mailto:squid-users-bounces@lists.squid-cache.org"><squid-users-bounces@lists.squid-cache.org></a> schrieb<br>
> am 04.02.2015 13:13:49:<br>
><br>
> > > Von: Leonardo Rodrigues
<a class="moz-txt-link-rfc2396E" href="mailto:leolistas@solutti.com.br"><leolistas@solutti.com.br></a><br>
> > > An: <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> > > Datum: 04.02.2015 13:14<br>
> > > Betreff: Re: [squid-users] Order of http_access
allow/deny<br>
> > > Gesendet von: "squid-users"
<a class="moz-txt-link-rfc2396E" href="mailto:squid-users-bounces@lists.squid-cache.org"><squid-users-bounces@lists.squid-cache.org></a><br>
><br>
> > > On 04/02/15 09:19, <a class="moz-txt-link-abbreviated" href="mailto:Andreas.Reschke@mahle.com">Andreas.Reschke@mahle.com</a> wrote:<br>
> > > Hi there,<br>
> > > Is there a order of http_access allow/deny? If I
activate<br>
> > > "http_access deny !chkglwebhttp" nobody can use the
proxy, squid<br>
> > > allways ask for user and password (user and
password is correct)<br>
><br>
> > > ######<br>
> > > acl chkglwebhttp external LDAPLookup
GGPY-LO-Web-Http<br>
> > > acl sellingUser external LDAPLookup
GGPY-LO-Web-Allowed-Selling<br>
> > > acl socialUser external LDAPLookup
GGPY-LO-Web-Allowed-Social<br>
> > > acl allforbUser external LDAPLookup
GGPY-LO-Web-Allowed-All<br>
> > > acl ftpputUser external LDAPLookup
GGPY-LO-Web-Ftp-Put<br>
> > > acl loggingUser external LDAPLookup
GGPY-LO-Web-Log-User<br>
> > > acl auth proxy_auth REQUIRED<br>
> > > acl permitt_ips src 10.143.10.247/32<br>
> > > acl FTP proto FTP<br>
> > > acl PUT method PUT<br>
><br>
> > > # whitelisten<br>
> > > http_access allow open-sites all<br>
> > > http_access allow localhost<br>
> > > http_access allow permitt_ips !denied-sites
!social-sites<br>
> > > http_access allow indien DAY<br>
> > > http_access deny indien<br>
> > > #http_access deny !chkglwebhttp<br>
> > > http_access allow selling-sites sellingUser<br>
> > > http_access allow social-sites socialUser<br>
><br>
> > > Actually, and i dont know if this a bug or a
desired behavior,<br>
> > > denying a group seems to always (at least to me)
brings the<br>
> > > authentication popup. To avoid that and make things
really work as<br>
> > > expected, i usually add an 'all' to the denying
clause. As the 'all'<br>
> > > rule will match anything, it wont change the
denying or not of your<br>
> > > rule. And it will make things work. Actually this
hint was found on<br>
> > > the mailing list archives.<br>
><br>
> > > So, instead of<br>
><br>
> > > http_access deny !chkglwebhttp<br>
><br>
> > > try using<br>
><br>
> > > http_access deny !chkglwebhttp all<br>
><br>
> > > if your 'indien' acl, which is also used on a
deny rule, is also<br>
> > > a group rule (that cannot be confirmed on the conf
you posted), just<br>
> > > add the all as well. In summary, always add an
'all' to an<br>
> > > http_access rule which envolves denying by any king
of group checking.<br>
><br>
><br>
><br>
><br>
><br>
> > > --<br>
><br>
><br>
> > > Atenciosamente / Sincerily,<br>
> > > Leonardo Rodrigues<br>
> > > Solutti Tecnologia<br>
> > > <a class="moz-txt-link-freetext" href="http://www.solutti.com.br">http://www.solutti.com.br</a>
<a class="moz-txt-link-rfc2396E" href="http://www.solutti.com.br/"><http://www.solutti.com.br/></a><a class="moz-txt-link-rfc2396E" href="http://www.solutti.com.br/"><http://www.solutti.com.br/></a><br>
><br>
> > > Minha armadilha de SPAM, NÃO mandem email<br>
> > > <a class="moz-txt-link-abbreviated" href="mailto:gertrudes@solutti.com.br">gertrudes@solutti.com.br</a><br>
> > > My SPAMTRAP, do not email it<br>
><br>
><br>
> > > _______________________________________________<br>
> > > squid-users mailing list<br>
> > > <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> > > <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><br>
><br>
> > Hi Leonardo,<br>
><br>
> > thanks for you answer. I've tested it with "http_access
deny !<br>
> chkglwebhttp all", so no access is allowed.<br>
> > I always get "ext_ldap_group_acl: WARNING: could not
bind to<br>
> binddn 'Invalid credentials'"<br>
><br>
><br>
><br>
> > Mit freundlichen Grüßen / Kind regards<br>
><br>
> > Mr. Andreas Reschke<br>
> > <a class="moz-txt-link-abbreviated" href="mailto:andreas.reschke@mahle.com">andreas.reschke@mahle.com</a>, <a class="moz-txt-link-freetext" href="http://www.mahle.com">http://www.mahle.com</a>
<a class="moz-txt-link-rfc2396E" href="http://www.mahle.com/"><http://www.mahle.com/></a><a class="moz-txt-link-rfc2396E" href="http://www.mahle.com/"><http://www.mahle.com/></a><br>
><br>
><br>
> > _______________________________________________<br>
> > squid-users mailing list<br>
> > <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> > <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><br>
><br>
> > _______________________________________________<br>
> > squid-users mailing list<br>
> > <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> > <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><br>
><br>
> Mit freundlichen Grüßen / Kind regards<br>
><br>
> Mr. Andreas Reschke<br>
> <a class="moz-txt-link-abbreviated" href="mailto:andreas.reschke@mahle.com">andreas.reschke@mahle.com</a>, <a class="moz-txt-link-freetext" href="http://www.mahle.com">http://www.mahle.com</a>
<a class="moz-txt-link-rfc2396E" href="http://www.mahle.com/"><http://www.mahle.com/></a><br>
><br>
><br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></span><br>
<br>
-----BEGIN PGP SIGNATURE-----
<br>
Version: GnuPG v2
<br>
<br>
iQEcBAEBAgAGBQJU0hcZAAoJENNXIZxhPexG/MkH/29hNK9TEn8NVp7ehHEQXykG
<br>
F7xHTceoL2SYndypeweKLTHU76NIArGfYgk0YKRujSvMYf9Si8qvfxTnHDg/XtsB
<br>
b3Z8RBObZ4KHKhUoaJV54Ye6qumCS70PZqlpMHr+lwrPqrdyHRTS36CLTORGdV5j
<br>
MdCiXdq3RFLCyLoKIK1lODqWjOCwz7Mw+V4BANGuc9NakCpSpR4CnGoY38XMgYmn
<br>
MvAOovBJQstRiGYOgR9IasTszynrlPISJ+uEELF2dK6G3uEA7m2qvOUA2rhKTgeY
<br>
sxOg5DA14NYlY1p9ciuwvLqTIcC/YgPNOmsqt8Uqdp6WQL3EoSfFtgtBKCOwOhM=
<br>
=wldX
<br>
-----END PGP SIGNATURE-----
<br>
<br>
</body>
</html>