<div dir="ltr">Have you checked <a href="https://www.squid-cache.org/Doc/config/logformat/">https://www.squid-cache.org/Doc/config/logformat/</a> ?<div>There is a note about "logformat referrer", it should be what you are looking for</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Apr 10, 2024 at 10:16 PM Bobby Matznick <bmatznick@pbandt.bank> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg-5728136536054365583">
<div lang="EN-US" style="overflow-wrap: break-word;">
<div class="m_-5728136536054365583WordSection1">
<p class="MsoNormal"><span style="font-size:11pt">Question about squid, Debian version 4.13. Looking for a way to log referer’s. I see the way that worked up until version 4, seems this does not work anymore. I’m having some trouble finding if anything replaced
it or if there’s another way to go about this? Here is the old way.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">referrer_log /pathname<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Thanks for any help you can provide!<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">Bobby<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> squid-users <<a href="mailto:squid-users-bounces@lists.squid-cache.org" target="_blank">squid-users-bounces@lists.squid-cache.org</a>>
<b>On Behalf Of </b><a href="mailto:squid-users-request@lists.squid-cache.org" target="_blank">squid-users-request@lists.squid-cache.org</a><br>
<b>Sent:</b> Friday, April 5, 2024 6:00 AM<br>
<b>To:</b> <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<b>Subject:</b> [External] squid-users Digest, Vol 116, Issue 7<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<table border="0" cellspacing="0" cellpadding="0" align="left" width="100%" style="width:100%">
<tbody>
<tr>
<td style="background:rgb(255,185,0);padding:5pt 2pt"></td>
<td width="100%" style="width:100%;background:rgb(255,248,229);padding:5pt 4pt 5pt 12pt">
<div>
<p class="MsoNormal">
<b><span style="color:rgb(34,34,34)">Caution:</span></b><span style="color:red"> This is an external email and has a suspicious subject or content. Please take care when clicking links or opening attachments. When in doubt, contact your IT Department
<u></u><u></u></span></p>
</div>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="margin-bottom:12pt">Send squid-users mailing list submissions to<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.squid-cache.org/listinfo/squid-users" target="_blank">https://lists.squid-cache.org/listinfo/squid-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:squid-users-request@lists.squid-cache.org" target="_blank">squid-users-request@lists.squid-cache.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:squid-users-owner@lists.squid-cache.org" target="_blank">squid-users-owner@lists.squid-cache.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of squid-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: Squid cache questions (Amos Jeffries)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Fri, 5 Apr 2024 14:17:16 +1300<br>
From: Amos Jeffries <<a href="mailto:squid3@treenet.co.nz" target="_blank">squid3@treenet.co.nz</a>><br>
To: <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
Subject: Re: [squid-users] Squid cache questions<br>
Message-ID: <<a href="mailto:bef43696-be7f-463b-b82e-d4346abba2a5@treenet.co.nz" target="_blank">bef43696-be7f-463b-b82e-d4346abba2a5@treenet.co.nz</a>><br>
Content-Type: text/plain; charset=UTF-8; format=flowed<br>
<br>
On 4/04/24 17:48, Jonathan Lee wrote:<br>
> Is there any particular order to squid configuration??<br>
> <br>
<br>
Yes. <<a href="https://wiki.squid-cache.org/SquidFaq/OrderIsImportant" target="_blank">https://wiki.squid-cache.org/SquidFaq/OrderIsImportant</a>><br>
<br>
<br>
> Does this look correct?<br>
> <br>
<br>
Best way to find out is to run "squid -k parse", which should be done <br>
after upgrades as well to identify and fix changes between versions as <br>
we improve the output.<br>
<br>
<br>
> I actually get allot of hits and it functions amazing, so I wanted to <br>
> share this in case I could improve something. Is there any issues with <br>
> security?<br>
<br>
Yes, the obvious one is "DONT_VERIFY_PEER" disabling TLS security <br>
entirely on outbound connections. That particular option will prevent <br>
you even being told about suspicious activity regarding TLS.<br>
<br>
Also there are a few weird things in your TLS cipher settings, such as <br>
this sequence " EECDH+aRSA+RC4:...:!RC4 "<br>
Which as I understand, enables the EECDH with RC4 hash, but also <br>
forbids all uses of RC4.<br>
<br>
<br>
> I am concerned that an invasive container could become <br>
> installed in the cache and data marshal the network card.<br>
> <br>
<br>
You have a limit of 4 MB for objects allowed to pass through this proxy, <br>
exception being objects from domains listed in the "windowsupdate" ACL <br>
(not all Windows related) which are allowed up to 512 MB.<br>
<br>
For the general case, any type of file which can store an image of some <br>
system is a risk for that type of vulnerability can be cached.<br>
<br>
The place to fix that vulnerability properly is not the cache or Squid. <br>
It is the OS permissions allowing non-Squid software access to the cache <br>
files and/or directory.<br>
<br>
<br>
<br>
> Here is my config<br>
> <br>
> # This file is automatically generated by pfSense<br>
> # Do not edit manually !<br>
<br>
Since this file is generated by pfsense there is little that can be done <br>
about ordering issues and very hard to tell which of the problems below <br>
are due to pfsense and which due toy your settings.<br>
<br>
FWIW, there are no major issues, just some lines not being necessary due <br>
to setting things to their default values, or just some blocks already <br>
denyign things that are blocked previously.<br>
<br>
<br>
> <br>
> http_port <a href="http://192.168.1.1:3128" target="_blank">192.168.1.1:3128</a> ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE<br>
> <br>
> http_port <a href="http://127.0.0.1:3128" target="_blank">127.0.0.1:3128</a> intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE<br>
> <br>
> https_port <a href="http://127.0.0.1:3129" target="_blank">127.0.0.1:3129</a> intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB cert=/usr/local/etc/squid/serverkey.pem cafile=/usr/local/share/certs/ca-root-nss.crt capath=/usr/local/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE<br>
> <br>
> icp_port 0<br>
> digest_generation off<br>
> dns_v4_first on<br>
> pid_filename /var/run/squid/squid.pid<br>
> cache_effective_user squid<br>
> cache_effective_group proxy<br>
> error_default_language en<br>
> icon_directory /usr/local/etc/squid/icons<br>
> visible_hostname ****<br>
> cache_mgr ****<br>
> access_log /var/squid/logs/access.log<br>
> cache_log /var/squid/logs/cache.log<br>
> cache_store_log none<br>
> netdb_filename /var/squid/logs/netdb.state<br>
> pinger_enable on<br>
> pinger_program /usr/local/libexec/squid/pinger<br>
> sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/lib/ssl_db -M 4MB -b 2048<br>
> tls_outgoing_options cafile=/usr/local/share/certs/ca-root-nss.crt<br>
> tls_outgoing_options capath=/usr/local/share/certs/<br>
> tls_outgoing_options options=NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE<br>
> tls_outgoing_options cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS<br>
> tls_outgoing_options flags=DONT_VERIFY_PEER<br>
> sslcrtd_children 10<br>
> <br>
> logfile_rotate 0<br>
> debug_options rotate=0<br>
> shutdown_lifetime 3 seconds<br>
> # Allow local network(s) on interface(s)<br>
> acl localnet src <a href="http://192.168.1.0/27" target="_blank">
192.168.1.0/27</a><br>
> forwarded_for transparent<br>
> httpd_suppress_version_string on<br>
> uri_whitespace strip<br>
> <br>
> acl getmethod method GET<br>
> <br>
> acl windowsupdate dstdomain <a href="http://windowsupdate.microsoft.com" target="_blank">windowsupdate.microsoft.com</a><br>
> acl windowsupdate dstdomain .<a href="http://update.microsoft.com" target="_blank">update.microsoft.com</a><br>
> acl windowsupdate dstdomain <a href="http://download.windowsupdate.com" target="_blank">download.windowsupdate.com</a><br>
> acl windowsupdate dstdomain <a href="http://redir.metaservices.microsoft.com" target="_blank">redir.metaservices.microsoft.com</a><br>
> acl windowsupdate dstdomain <a href="http://images.metaservices.microsoft.com" target="_blank">images.metaservices.microsoft.com</a><br>
> acl windowsupdate dstdomain <a href="http://c.microsoft.com" target="_blank">c.microsoft.com</a><br>
> acl windowsupdate dstdomain <a href="http://www.download.windowsupdate.com" target="_blank">
www.download.windowsupdate.com</a><br>
> acl windowsupdate dstdomain <a href="http://wustat.windows.com" target="_blank">wustat.windows.com</a><br>
> acl windowsupdate dstdomain <a href="http://crl.microsoft.com" target="_blank">crl.microsoft.com</a><br>
> acl windowsupdate dstdomain <a href="http://sls.microsoft.com" target="_blank">sls.microsoft.com</a><br>
> acl windowsupdate dstdomain <a href="http://productactivation.one.microsoft.com" target="_blank">productactivation.one.microsoft.com</a><br>
> acl windowsupdate dstdomain <a href="http://ntservicepack.microsoft.com" target="_blank">ntservicepack.microsoft.com</a><br>
> acl windowsupdate dstdomain <a href="http://dc1-st.ksn.kaspersky-labs.com" target="_blank">dc1-st.ksn.kaspersky-labs.com</a><br>
> acl windowsupdate dstdomain <a href="http://dc1-file.ksn.kaspersky-labs.com" target="_blank">dc1-file.ksn.kaspersky-labs.com</a><br>
> acl windowsupdate dstdomain <a href="http://dc1.ksn.kaspersky-labs.com" target="_blank">dc1.ksn.kaspersky-labs.com</a><br>
> <br>
> acl rewritedoms dstdomain .<a href="http://facebook.com" target="_blank">facebook.com</a> .<a href="http://akamaihd.net" target="_blank">akamaihd.net</a> .<a href="http://fbcdn.net" target="_blank">fbcdn.net</a> .<a href="http://google.com" target="_blank">google.com</a> .<a href="http://static.com" target="_blank">static.com</a> .<a href="http://apple.com" target="_blank">apple.com</a> .<a href="http://oracle.com" target="_blank">oracle.com</a> .<a href="http://sun.com" target="_blank">sun.com</a> .<a href="http://java.com" target="_blank">java.com</a> .<a href="http://adobe.com" target="_blank">adobe.com</a> .<a href="http://steamstatic.com" target="_blank">steamstatic.com</a> .<a href="http://steampowered.com" target="_blank">steampowered.com</a> .<a href="http://steamcontent.com" target="_blank">steamcontent.com</a> .<a href="http://google.com" target="_blank">google.com</a><br>
> <br>
> store_id_program /usr/local/libexec/squid/storeid_file_rewrite /var/squid/storeid/storeid_rewrite.txt<br>
> store_id_children 10 startup=5 idle=1 concurrency=0<br>
> always_direct allow !getmethod<br>
> store_id_access deny connect<br>
> store_id_access deny !getmethod<br>
> store_id_access allow rewritedoms<br>
> reload_into_ims on<br>
> max_stale 20 years<br>
> minimum_expiry_time 0<br>
> <br>
<br>
<br>
I am not sure how many of these refresh_pattern rules below are written <br>
by you, copy-pasted from elsewhere, or added automatically by pfsense. <br>
So how you need to fix the problems here is uncertain.<br>
<br>
That said, please consider removing all these override-* and ignore-*.<br>
<<a href="http://www.squid-cache.org/Doc/config/refresh_pattern" target="_blank">http://www.squid-cache.org/Doc/config/refresh_pattern/</a>><br>
<br>
<br>
> <br>
> refresh_pattern -i squid.internal 10080 80% 79900 override-lastmod override-expire ignore-reload ignore-no-store ignore-must-revalidate ignore-private ignore-auth<br>
> <br>
> #APPLE STUFF<br>
> refresh_pattern -i <a href="http://apple.com/." target="_blank">
apple.com/.</a>.(cab|exe|msi|msu|msf|asf|wmv|wma|dat|zip|dist)$ 0 80% 43200 refresh-ims<br>
> <br>
> #apple update<br>
> refresh_pattern -i (download|adcdownload)<a href="http://apple.com/.*" target="_blank">apple.com/.*</a>.(pkg|dmg) 4320 100% 43200<br>
> refresh_pattern -i <a href="http://appldnld.apple.com" target="_blank">appldnld.apple.com</a> 129600 100% 129600<br>
> refresh_pattern -i <a href="http://phobos.apple.com" target="_blank">phobos.apple.com</a> 129600 100% 129600<br>
> refresh_pattern -i <a href="http://iosapps.itunes.apple.com" target="_blank">iosapps.itunes.apple.com</a> 129600 100% 129600<br>
> <br>
> # Updates: Windows<br>
> refresh_pattern -i <a href="http://microsoft.com/." target="_blank">
microsoft.com/.</a>.(cab|exe|msi|msu|msf|asf|wma|dat|zip)$ 4320 80% 43200 refresh-ims<br>
> refresh_pattern -i <a href="http://windowsupdate.com/." target="_blank">
windowsupdate.com/.</a>.(cab|exe|msi|msu|msf|asf|wma|wmv)|dat|zip)$ 4320 80% 43200 refresh-ims<br>
> refresh_pattern -i <a href="http://windows.com/." target="_blank">
windows.com/.</a>.(cab|exe|msi|msu|msf|asf|wmv|wma|dat|zip)$ 4320 80% 43200 refresh-ims<br>
> refresh_pattern -i <a href="http://microsoft.com/.*" target="_blank">
microsoft.com/.*</a>.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200<br>
> refresh_pattern -i <a href="http://windowsupdate.com/.*" target="_blank">
windowsupdate.com/.*</a>.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200<br>
> refresh_pattern -i <a href="http://windows.com/.*" target="_blank">
windows.com/.*</a>.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 4320 80% 43200<br>
> refresh_pattern -i .*<a href="http://windowsupdate.com/.*" target="_blank">windowsupdate.com/.*</a>.(cab|exe) 259200 100% 259200<br>
> refresh_pattern -i .*<a href="http://update.microsoft.com/.*" target="_blank">update.microsoft.com/.*</a>.(cab|exe|dll|msi|psf) 259200 100% 259200<br>
> refresh_pattern <a href="http://windowsupdate.com/.*" target="_blank">
windowsupdate.com/.*</a>.(cab|exe|dll|msi|psf) 10080 100% 43200<br>
> refresh_pattern <a href="http://download.microsoft.com/.*" target="_blank">
download.microsoft.com/.*</a>.(cab|exe|dll|msi|psf) 10080 100% 43200<br>
> refresh_pattern <a href="http://www.microsoft.com/.*" target="_blank">
www.microsoft.com/.*</a>.(cab|exe|dll|msi|psf) 10080 100% 43200<br>
> refresh_pattern <a href="http://au.download.windowsupdate.com/.*" target="_blank">
au.download.windowsupdate.com/.*</a>.(cab|exe|dll|msi|psf) 4320 100% 43200<br>
> refresh_pattern <a href="http://bg.v4.pr.dl.ws.microsoft.com/.*" target="_blank">
bg.v4.pr.dl.ws.microsoft.com/.*</a>.(cab|exe|dll|msi|psf) 4320 100% 43200<br>
> #windows update NEW UPDATE 0.04<br>
> refresh_pattern <a href="http://update.microsoft.com/.*" target="_blank">
update.microsoft.com/.*</a>.(cab|exe) 43200 100% 129600<br>
> refresh_pattern ([^.]+.)?(download|(windows)?update).(microsoft.)?com/.*.(cab|exe|msi|msp|psf) 4320 100% 43200<br>
> refresh_pattern <a href="http://update.microsoft.com/.*" target="_blank">
update.microsoft.com/.*</a>.(cab|exe|dll|msi|psf) 10080 100% 43200<br>
> refresh_pattern -i <a href="http://update.microsoft.com/.*" target="_blank">
update.microsoft.com/.*</a>.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600<br>
> refresh_pattern -i <a href="http://windowsupdate.com/.*" target="_blank">
windowsupdate.com/.*</a>.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600<br>
> refresh_pattern -i <a href="http://download.microsoft.com/.*" target="_blank">
download.microsoft.com/.*</a>.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600<br>
> refresh_pattern -i <a href="http://ws.microsoft.com/.*" target="_blank">
ws.microsoft.com/.*</a>.(cab|exe|ms[i|u|f]|[ap]sf|wm[v|a]|dat|zip) 525600 100% 525600<br>
> <br>
> refresh_pattern ([^.]+.)?(cs|content[1-9]|hsar|content-origin|client-download).[steampowered|steamcontent].com/.*.* 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod<br>
> refresh_pattern ([^.]+.)?<a href="http://akamai.steamstatic.com/.*.*" target="_blank">akamai.steamstatic.com/.*.*</a> 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod<br>
> <br>
> refresh_pattern -i ([^.]+.)?<a href="http://adobe.com/.*" target="_blank">adobe.com/.*</a>.(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod<br>
> refresh_pattern -i ([^.]+.)?<a href="http://java.com/.*" target="_blank">java.com/.*</a>.(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod<br>
> refresh_pattern -i ([^.]+.)?<a href="http://sun.com/.*" target="_blank">sun.com/.*</a>.(zip|exe) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod<br>
> refresh_pattern -i ([^.]+.)?<a href="http://oracle.com/.*" target="_blank">oracle.com/.*</a>.(zip|exe|tar.gz) 43200 100% 43200 reload-into-ims ignore-reload ignore-no-store override-expire override-lastmod<br>
> <br>
> refresh_pattern -i <a href="http://appldnld.apple.com" target="_blank">appldnld.apple.com</a> 43200 100% 43200 ignore-reload ignore-no-store override-expire override-lastmod<br>
> refresh_pattern -i ([^.]+.)?<a href="http://apple.com/.*.(ipa)" target="_blank">apple.com/.*.(ipa)</a> 43200 100% 43200 ignore-reload ignore-no-store override-expire override-lastmod<br>
> <br>
> refresh_pattern -i ([^.]+.)?<a href="http://google.com/.*" target="_blank">google.com/.*</a>.(exe|crx) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>
> refresh_pattern -i ([^.]+.)?<a href="http://g.static.com/.*" target="_blank">g.static.com/.*</a>.(exe|crx) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>
> <br>
> #FACEBOOK<br>
> refresh_pattern ^http?://*<a href="http://facebook.com/*" target="_blank">facebook.com/*</a> 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>
> <br>
> #FACEBOOK IMAGES<br>
> refresh_pattern -i pixel.facebook.com..(jpg|png|gif|ico|css|js) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>
> refresh_pattern -i .akamaihd.net..(jpg|png|gif|ico|css|js) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>
> refresh_pattern -i (<a href="http://facebook.com" target="_blank">facebook.com</a>).(jpg|png|gif) 10080 80% 43200 store-stale override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>
> refresh_pattern static.(xx|ak).fbcdn.net.(jpg|gif|png) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>
> refresh_pattern ^https?://<a href="http://profile.ak.fbcdn.net" target="_blank">profile.ak.fbcdn.net</a>*.(jpg|gif|png) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>
> <br>
> #FACEBOOK VIDEO<br>
> refresh_pattern -i .video.ak.fbcdn.net.*.(mp4|flv|mp3|amf) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>
> refresh_pattern (audio|video)/(webm|mp4) 10080 80% 43200 override-expire override-lastmod ignore-no-cache ignore-reload reload-into-ims ignore-private<br>
> <br>
> <br>
> range_offset_limit 512 MB windowsupdate<br>
> maximum_object_size 512 MB windowsupdate<br>
> range_offset_limit 0<br>
> quick_abort_min -1 KB<br>
> <br>
> cache_mem 64 MB<br>
> maximum_object_size_in_memory 256 KB<br>
> memory_replacement_policy heap LFUDA<br>
> cache_replacement_policy heap LFUDA<br>
> minimum_object_size 0 KB<br>
> maximum_object_size 4 MB<br>
> cache_dir diskd /var/squid/cache 64000 256 256<br>
> offline_mode off<br>
> cache_swap_low 90<br>
> cache_swap_high 95<br>
> acl donotcache dstdomain '/var/squid/acl/donotcache.acl'<br>
> cache deny donotcache<br>
> cache allow all<br>
> # Add any of your own refresh_pattern entries above these.<br>
> refresh_pattern ^ftp: 1440 20% 10080<br>
> refresh_pattern ^gopher: 1440 0% 1440<br>
> refresh_pattern -i (/cgi-bin/|?) 0 0% 0<br>
> refresh_pattern . 0 20% 4320<br>
> <br>
> <br>
> #Remote proxies<br>
> <br>
> <br>
> # Setup some default acls<br>
> # ACLs all, manager, localhost, and to_localhost are predefined.<br>
> acl allsrc src all<br>
> acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 8080 3128 3129 1025-65535<br>
> acl sslports port 443 563 8080 5223 2197<br>
> <br>
> acl purge method PURGE<br>
> acl connect method CONNECT<br>
> <br>
> # Define protocols used for redirects<br>
> acl HTTP proto HTTP<br>
> acl HTTPS proto HTTPS<br>
> <br>
> # SslBump Peek and Splice<br>
> # <a href="http://wiki.squid-cache.org/Features/SslPeekAndSplice" target="_blank">
http://wiki.squid-cache.org/Features/SslPeekAndSplice</a><br>
> # <a href="http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit" target="_blank">
http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit</a><br>
> # Match against the current step during ssl_bump evaluation [fast]<br>
> # Never matches and should not be used outside the ssl_bump context.<br>
> #<br>
> # At each SslBump step, Squid evaluates ssl_bump directives to find<br>
> # the next bumping action (e.g., peek or splice). Valid SslBump step<br>
> # values and the corresponding ssl_bump evaluation moments are:<br>
> # SslBump1: After getting TCP-level and HTTP CONNECT info.<br>
> # SslBump2: After getting TLS Client Hello info.<br>
> # SslBump3: After getting TLS Server Hello info.<br>
> # These ACLs exist even when 'SSL/MITM Mode' is set to 'Custom' so that<br>
> # they can be used there for custom configuration.<br>
> acl step1 at_step SslBump1<br>
> acl step2 at_step SslBump2<br>
> acl step3 at_step SslBump3<br>
> acl banned_hosts src '/var/squid/acl/banned_hosts.acl'<br>
> acl whitelist dstdom_regex -i '/var/squid/acl/whitelist.acl'<br>
> acl blacklist dstdom_regex -i '/var/squid/acl/blacklist.acl'<br>
> http_access allow manager localhost<br>
> <br>
> # Allow external cache managers<br>
> acl ext_manager src 192.168.1.1<br>
> acl ext_manager src <a href="http://127.0.0.1" target="_blank">
127.0.0.1</a><br>
> http_access allow manager ext_manager<br>
> <br>
> http_access deny manager<br>
> http_access allow purge localhost<br>
> http_access deny purge<br>
> http_access deny !safeports<br>
> http_access deny CONNECT !sslports<br>
> <br>
> # Always allow localhost connections<br>
> http_access allow localhost<br>
> <br>
> quick_abort_min 0 KB<br>
> quick_abort_max 0 KB<br>
> quick_abort_pct 95<br>
> request_body_max_size 0 KB<br>
> delay_pools 1<br>
> delay_class 1 2<br>
> delay_parameters 1 -1/-1 -1/-1<br>
> delay_initial_bucket_level 100<br>
> delay_access 1 allow allsrc<br>
> <br>
> # Reverse Proxy settings<br>
> <br>
> deny_info TCP_RESET allsrc<br>
> <br>
> # Package Integration<br>
> url_rewrite_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf<br>
> url_rewrite_bypass off<br>
> url_rewrite_children 32 startup=8 idle=4 concurrency=0<br>
> <br>
<br>
Squidguard is very outdated. You should upgrade to its successor <br>
ufdbguard if possible.<br>
<br>
<br>
<br>
> # Custom options before auth<br>
> #host_verify_strict on<br>
> <br>
> # These hosts are banned<br>
> http_access deny banned_hosts<br>
> # Always allow access to whitelist domains<br>
> http_access allow whitelist<br>
> # Block access to blacklist domains<br>
> http_access deny blacklist<br>
> # List of domains allowed to logging in to Google services<br>
> request_header_access X-GoogApps-Allowed-Domains deny all<br>
> request_header_add X-GoogApps-Allowed-Domains consumer_accounts<br>
> # Set YouTube safesearch restriction<br>
> acl youtubedst dstdomain -n <a href="http://www.youtube.com" target="_blank">
www.youtube.com</a> <a href="http://m.youtube.com" target="_blank">m.youtube.com</a> <a href="http://youtubei.googleapis.com" target="_blank">youtubei.googleapis.com</a> <a href="http://youtube.googleapis.com" target="_blank">youtube.googleapis.com</a> <a href="http://www.youtube-nocookie.com" target="_blank">
www.youtube-nocookie.com</a><br>
> request_header_access YouTube-Restrict deny all<br>
> request_header_add YouTube-Restrict none youtubedst<br>
> acl sglog url_regex -i sgr=ACCESSDENIED<br>
> http_access deny sglog<br>
> # Custom SSL/MITM options before auth<br>
> acl manager proto cache_object<br>
> acl localhost src <a href="http://192.168.1.1/32" target="_blank">
192.168.1.1/32</a><br>
> #cachemgr_passwd disable offline_toggle reconfigure shutdown<br>
> #cachemgr_passwd secret all<br>
> acl https_login url_regex -i ^https.*(login|Login).*<br>
> acl no_miss url_regex -i ^.*<a href="http://gateway.facebook.com/ws/realtime?" target="_blank">gateway.facebook.com/ws/realtime?</a><br>
> acl no_miss url_regex -i ^.*<a href="http://web-chat-e2ee.facebook.com/ws/chat" target="_blank">web-chat-e2ee.facebook.com/ws/chat</a>
<br>
> acl CONNECT method CONNECT<br>
> acl wuCONNECT dstdomain <a href="http://www.update.microsoft.com" target="_blank">
www.update.microsoft.com</a><br>
> acl wuCONNECT dstdomain <a href="http://sls.microsoft.com" target="_blank">sls.microsoft.com</a><br>
> http_access allow CONNECT wuCONNECT localnet<br>
> http_access allow CONNECT wuCONNECT localhost<br>
> http_access allow windowsupdate localnet<br>
> http_access allow windowsupdate localhost<br>
> http_access deny manager<br>
> <br>
> acl BrokenButTrustedServers dstdomain '/usr/local/pkg/dstdom.broken'<br>
> acl DomainMismatch ssl_error SQUID_X509_V_ERR_DOMAIN_MISMATCH<br>
> sslproxy_cert_error allow BrokenButTrustedServers DomainMismatch<br>
> sslproxy_cert_error deny all<br>
> <br>
> acl splice_only src 192.168.1.8 #Tasha iPhone<br>
> acl splice_only src 192.168.1.10 #Jon iPhone<br>
> acl splice_only src 192.168.1.11 #Amazon Fire<br>
> acl splice_only src 192.168.1.15 #Tasha HP<br>
> acl splice_only src 192.168.1.16 #iPad<br>
> <br>
> acl NoSSLIntercept ssl::server_name_regex -i '/usr/local/pkg/url.nobump'<br>
> <br>
> acl markBumped annotate_client bumped=true<br>
> acl bump_only src 192.168.1.3 #webtv<br>
> acl bump_only src 192.168.1.4 #toshiba<br>
> acl bump_only src 192.168.1.5 #imac<br>
> acl bump_only src 192.168.1.9 #macbook<br>
> acl bump_only src 192.168.1.13 #dell<br>
> <br>
<br>
You have a previous "cache allow all". This below rule does nothing.<br>
<br>
> cache deny https_login<br>
> <br>
> ssl_bump peek step1<br>
> miss_access deny no_miss<br>
> ssl_bump splice https_login<br>
> ssl_bump splice splice_only<br>
> ssl_bump splice NoSSLIntercept<br>
> ssl_bump bump bump_only markBumped<br>
> ssl_bump stare all<br>
> <br>
> acl markedBumped note bumped true<br>
> url_rewrite_access deny markedBumped<br>
> <br>
> http_access deny all<br>
> read_ahead_gap 32 KB<br>
> negative_ttl 1 second<br>
> connect_timeout 30 seconds<br>
> request_timeout 60 seconds<br>
> half_closed_clients off<br>
> shutdown_lifetime 10 seconds<br>
> negative_dns_ttl 1 seconds<br>
> ignore_unknown_nameservers on<br>
> pipeline_prefetch 100<br>
> <br>
> #acl SSLIntercept ssl::server_name_regex -i '/usr/local/pkg/url.bump'<br>
> #ssl_bump bump SSLIntercept<br>
> <br>
<br>
You already have an earlier "http_access deny all". The below lines do <br>
nothing.<br>
<br>
> # Setup allowed ACLs<br>
> # Allow local network(s) on interface(s)<br>
> http_access allow localnet<br>
> # Default block all to be sure<br>
> http_access deny allsrc<br>
> <br>
<br>
<br>
HTH<br>
Amos<br>
<br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<a href="https://lists.squid-cache.org/listinfo/squid-users" target="_blank">https://lists.squid-cache.org/listinfo/squid-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of squid-users Digest, Vol 116, Issue 7<br>
*******************************************<u></u><u></u></p>
</div>
<br><b><i></i></b>
<p style="color:black"><b><i>
</i></b></p><table border="0" cellspacing="0" cellpadding="0"><tbody><tr><td><a href="http://www.pbandt.bank" target="_blank"><img border="0" src="cid:ii_18ec8ac26452baed231"></a></td></tr></tbody></table><b><i>
<font face="Times New Roman" size="2">
CONFIDENTIALITY NOTICE: The information contained in and attached to this email is intended only for the confidential use of the person or entity to which the email is addressed. This email and any attachments may contain privileged and confidential information. If you are not the intended recipient, you are notified that you received this email in error and that any reading, retention, use or distribution of this email and attachments is strictly prohibited. If you received this email in error, you are requested to immediately notify us by calling 888-728-3550 or by return email and immediately and permanently delete the email and any attachments. Thank you.
</font></i></b><i>
</i><p></p>
</div>
_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<a href="https://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">https://lists.squid-cache.org/listinfo/squid-users</a><br>
</div></blockquote></div><br clear="all"><div><br></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature"> Francesco</div>