<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thank You for quick turnover, as per your request I changed squid config like below, still I going to
<a href="http://www.google.com">www.google.com</a> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">acl CONNECT method CONNECT<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">acl sslconnect dstdomain -i https://www.google.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">acl GoogleRecaptcha url_regex ^https://www.google.com/recaptcha/$<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">http_access allow CONNECT sslconnect<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">http_access allow backoffice_users GoogleRecaptcha<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thanks& Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Naresh<o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Flashdown [mailto:flashdown@data-core.org]
<br>
<b>Sent:</b> Tuesday, June 27, 2017 11:37 AM<br>
<b>To:</b> squid-users@lists.squid-cache.org; Cherukuri, Naresh; Eliezer Croitoru<br>
<b>Subject:</b> Re: [squid-users] Squid Version 3.5.20<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">Well, I know that issue very good and google is the issue since they should put their captcha on a own subdomain. Then we could effectivley allow only the access to the captcha.<br>
<br>
Until that there is no good way to achive this. But there is a non reliable way of blocking
<a href="http://google.com">google.com</a><br>
<br>
First allow the Connect method for <a href="http://google.com">google.com</a><br>
Acl CONNECT method CONNECT<br>
acl sslconnect dstdomain -i <a href="http://www.google.com">www.google.com</a><br>
http_access allow CONNECT sslconnect<br>
Then use an url regex and allow <a href="http://google.com/recaptcha">google.com/recaptcha</a><br>
<br>
This way sometimes <a href="http://www.google.com">www.google.com</a> is blocked, sometimes not. But access to recaptcha will always work.<br>
<br>
Why we can't block it reliable? Well when browser/client wants to connect to https website then the firsr thing the browser trie is open a ssl tunnel to the FQDN<br>
As soon as the tunnel is up it will request the ressource. May it helps if you add a url regex deny between allowing the connect method and allowing the url
<a href="http://www.google.com/recaptcha">www.google.com/recaptcha</a><br>
<br>
Written on my mobile..<br>
<br>
Br,<br>
Flashdown<br>
<br>
<br>
<o:p></o:p></p>
<div>
<p class="MsoNormal">Am 27. Juni 2017 17:07:19 MESZ schrieb "Cherukuri, Naresh" <<a href="mailto:ncherukuri@partycity.com">ncherukuri@partycity.com</a>>:<o:p></o:p></p>
<pre style="margin-bottom:12.0pt">Hi Eliezer,<br><br>We successfully blocked gmail, google images, google drive and rest all google related. Now we allowing <a href="http://www.google.com">www.google.com</a> and www. google/Recaptcha. We still need to block <a href="http://www.google.com">www.google.com</a> and just allow <a href="http://www.google/recaptcha">www.google/recaptcha</a>. Is there a way to do that?<br><br>Appreciate your quick turnover!<br><br>Thanks&Regards,<br>Naresh<br><br> <br>-----Original Message-----<br>From: Eliezer Croitoru [<a href="mailto:eliezer@ngtech.co.il">mailto:eliezer@ngtech.co.il</a>] <br>Sent: Tuesday, June 27, 2017 10:16 AM<br>To: Cherukuri, Naresh; <a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>Subject: RE: [squid-users] Squid Version 3.5.20<br><br>Hey,<br><br>I can try to help you but I do not have enough logs for it.<br>Also it's not so simple.<br>Basically you will need to block gmail and google drive themselves in one rule that will not include other google services.<br><br>All The Bests,<br>Eliezer<br><br>----<br><a href="http://ngtech.co.il/lmgtfy">http://ngtech.co.il/lmgtfy</a>/<br>Linux System Administrator<br>Mobile: +972-5-28704261<br>Email: <a href="mailto:eliezer@ngtech.co.il">eliezer@ngtech.co.il</a><br><br><br>From: squid-users [<a href="mailto:squid-users-bounces@lists.squid-cache.org">mailto:squid-users-bounces@lists.squid-cache.org</a>] On Behalf Of Cherukuri, Naresh<br>Sent: Friday, June 23, 2017 23:34<br>To: <a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>Subject: [squid-users] Squid Version 3.5.20<br><br>Hello All,<br><br>I installed Squid version 3.5.20 on RHEL 7 and generated selfsigned CA certificates, can you shed some light on how to "Configure regular expression of the Google ReCaptcha URL with ACL".<br><br>My requirement :<br><br>This requirement is to allow Google's ReCaptcha URL (HTTPS) so associates can successfully use ADP which now utilizes Google's ReCaptcha which is called via an HTTPS URL, without allowing users to access other Google-related services such as Gmail or Google Drive.<br><br>Any ideas much appreciated!<br><br>Thanks,<br>Naresh<o:p></o:p></pre>
<pre style="text-align:center"><hr size="2" width="100%" align="center"></pre>
<pre><br>squid-users mailing list<br><a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br><a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><o:p></o:p></pre>
</div>
</div>
</body>
</html>