<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
-----BEGIN PGP SIGNED MESSAGE----- <br>
Hash: SHA256 <br>
<br>
<br>
<br>
22.04.16 18:39, Odhiambo Washington пишет:<br>
<span style="white-space: pre;">><br>
><br>
> On 22 April 2016 at 13:45, Amos Jeffries
<<a class="moz-txt-link-abbreviated" href="mailto:squid3@treenet.co.nz">squid3@treenet.co.nz</a> <a class="moz-txt-link-rfc2396E" href="mailto:squid3@treenet.co.nz"><mailto:squid3@treenet.co.nz></a>>
wrote:<br>
><br>
> On 22/04/2016 8:23 p.m., Odhiambo Washington wrote:<br>
> ><br>
> > Sure, I am really struggling to understand this. I
would like to serve<br>
> > error pages. A complete example of this would really
help. I am thinking,<br>
> > based on the two templates you gave and going with
the one where squid<br>
> > intrudes, that it could be like below, but to be
honest I am not sure so<br>
> > kindly correct me.<br>
> ><br>
> ><br>
> > acl time_wastage_sites_ssl ssl::server_name
.facebook.com <a class="moz-txt-link-rfc2396E" href="http://facebook.com"><http://facebook.com></a> .youtube.com
<a class="moz-txt-link-rfc2396E" href="http://youtube.com"><http://youtube.com></a><br>
> > ssl_bump splice time_wastage_sites_ssl<br>
> > ssl_bump stare all<br>
> > ssl_bump bump all<br>
> > http_access allow time_wastage_sites_ssl
privileged-staff<br>
> > http_access allow time_wastage_sites_ssl
privileged-clients<br>
> > http_access allow time_wastage_sites_ssl TIMElunch<br>
> > http_access allow time_wastage_sites_ssl
TIMEafterhoursAFT<br>
> > http_access allow time_wastage_sites_ssl
TIMEafterhoursMORN<br>
> > http_access allow time_wastage_sites_ssl
TIMEsatALLDAY<br>
> > http_access allow time_wastage_sites_ssl
TIMEsundALLDAY<br>
> > http_access deny time_wastage_sites_ssl<br>
> ><br>
><br>
> In a file called "/etc/squid/tws":<br>
> .facebook.com <a class="moz-txt-link-rfc2396E" href="http://facebook.com"><http://facebook.com></a><br>
> .youtube.com <a class="moz-txt-link-rfc2396E" href="http://youtube.com"><http://youtube.com></a><br>
><br>
><br>
> squid.conf:<br>
> acl time_wastage_sites_ssl ssl::server_name
"/etc/squid/tws"<br>
> acl time_wastage_sites_http dstdomain
"/etc/squid/tws"<br>
><br>
> acl privileged_traffic any-of \<br>
> privileged-staff privileged-clients \<br>
> TIMElunch TIMEafterhoursAFT TIMEafterhoursMORN \<br>
> TIMEsatALLDAY TIMEsundALLDAY<br>
><br>
> http_access allow privileged_traffic<br>
> http_access deny time_wastage_sites_http<br>
><br>
> ssl_bump splice privileged_traffic
time_wastage_sites_ssl<br>
> ssl_bump stare all<br>
> ssl_bump bump all<br>
><br>
><br>
><br>
> You can probably merge the TIME* ACLs down as well like:<br>
> # lunch<br>
> acl okay_times time ...<br>
> # afterhours PM<br>
> acl okay_times time ...<br>
> # afterhours AM<br>
> acl okay_times time ...<br>
> # Saturday and Sunday all day<br>
> acl okay_times time SA<br>
><br>
> Amos<br>
><br>
><br>
> Quoting Alex:<br>
> "<br>
> If you want Squid to not intrude except when terminating
prohibited traffic, then start with this sketch:<br>
><br>
> > ssl_bump terminate prohibited_traffic<br>
> > ssl_bump peek all<br>
> > ssl_bump splice all <br>
> "<br>
><br>
> So is it possible to achieve such a non-intrusive setup, but
without 'terminate'?</span><br>
Not only possible. This is the only solution if you do not want
legal problems. But, of course, you will forgot about high cache
hit.... :))))))))))<br>
<span style="white-space: pre;">><br>
><br>
><br>
> -- <br>
> Best regards,<br>
> Odhiambo WASHINGTON,<br>
> Nairobi,KE<br>
> +254 7 3200 0004/+254 7 2274 3223<br>
> "Oh, the cruft."<br>
><br>
><br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></span><br>
<br>
-----BEGIN PGP SIGNATURE-----
<br>
Version: GnuPG v2
<br>
<br>
iQEcBAEBCAAGBQJXGhxQAAoJENNXIZxhPexG+vMH/1BC4CuOMJKp9RYxHcpf/0a+
<br>
HsBW3wdCJxCMUI6gq89wCxD9FRq/7gmJIl1vM22l6zZP15JigYrUrosBaD2bjyhk
<br>
U+e8daGrOORdnxqajgggKrCOC+pBmkjlmaceU5etteb6QfkHW4sOVTxL9kF8dx1o
<br>
0/p1Dvl4LtRynsAloBhK8mr0BMhFFYSLoYipEKSBadK0mckqxAdCIyt1EQiyNAdy
<br>
aMRfPMit5KU9JhiK8R28v0c6eSiIyP0cZ7oQG1YL2DmlGOiJ6zwPBmrsDTkb7hRZ
<br>
10XPFtzAyRydVI5ca4kN+W2o/pmIc2yUEi0CLX7qUMV88PJjS4Ep7l7+QJF5/SM=
<br>
=zxK+
<br>
-----END PGP SIGNATURE-----
<br>
<br>
</body>
</html>