<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">You can also add this to lock down the proxy after hours so nothing is used much like locking a door, whatever is inside is going to keep working ie connections already established however all new connections will be blocked. I love this one <div><br></div><div><div><b>acl block_hours time 00:30-05:00</b></div><div><b>ssl_bump terminate all block_hours</b></div><div><b>http_access deny all block_hours</b></div><div><br></div><div>however this is for use with ssl intercept and root certificates installed however it also works for spliced connections as it comes before everything else the terminate everything line </div><div><br></div><div>you can also if you want to lock down to specific mac addresses ie small office home network </div><div><br></div><div>use </div><div><br></div><div><b>eui_lookup on</b></div><div><br></div><div><br></div><div>Example of use with mac addresses</div><div><br></div><div><div><b>acl splice_only src 192.168.1.8 #Tasha iPhone</b></div><div><b>acl splice_only src 192.168.1.10 #Jon iPhone</b></div><div><b>acl splice_only src 192.168.1.11 #Amazon Fire</b></div><div><b>acl splice_only src 192.168.1.15 #Tasha HP</b></div><div><b>acl splice_only src 192.168.1.16 #iPad</b></div><div><b><br></b></div><div><b>acl splice_only_mac arp (unique 48bit hardware address here)</b></div><div><b>acl splice_only_mac arp (unique 48bit hardware address here)</b></div><div><b>acl splice_only_mac arp (unique 48bit hardware address here)</b></div><div><b>acl splice_only_mac arp (unique 48bit hardware address here)</b></div><div><b>acl splice_only_mac arp (unique 48bit hardware address here)</b></div><div><b><br></b></div><div><b>acl NoSSLIntercept ssl::server_name_regex -i "/usr/local/pkg/reg.url.nobump"</b></div><div><b>acl NoBumpDNS dstdomain "/usr/local/pkg/dns.nobump"</b></div><div><b><br></b></div><div><b>acl markBumped annotate_client bumped=true</b></div><div><b>acl active_use annotate_client active=true</b></div><div><b>acl bump_only src 192.168.1.3 #webtv</b></div><div><b>acl bump_only src 192.168.1.4 #toshiba</b></div><div><b>acl bump_only src 192.168.1.5 #imac</b></div><div><b>acl bump_only src 192.168.1.9 #macbook</b></div><div><b>acl bump_only src 192.168.1.13 #dell</b></div><div><b><br></b></div><div><b>acl bump_only_mac arp (unique 48bit hardware address here)</b></div><div><b>acl bump_only_mac arp (unique 48bit hardware address here)</b></div><div><b>acl bump_only_mac arp (unique 48bit hardware address here)</b></div><div><b>acl bump_only_mac arp (unique 48bit hardware address here)</b></div><div><b>acl bump_only_mac arp (unique 48bit hardware address here)</b></div><div><b><br></b></div><div><b>ssl_bump peek step1</b></div><div><b>miss_access deny no_miss active_use</b></div><div><b>ssl_bump splice https_login active_use</b></div><div><b>ssl_bump splice splice_only_mac splice_only active_use (this works as “and logic” except my annotate active use)</b></div><div><b>ssl_bump splice NoBumpDNS active_use</b></div><div><b>ssl_bump splice NoSSLIntercept active_use</b></div><div><b>ssl_bump bump bump_only_mac bump_only active_use</b></div><div><b>acl activated note active_use true</b></div><div><b>ssl_bump terminate !activated</b></div><div><b><br></b></div><div><b>acl markedBumped note bumped true</b></div><div><b>url_rewrite_access deny markedBumped</b></div></div><div><br><blockquote type="cite"><div>On Jun 6, 2024, at 12:08, Kevin <squid@kretz.net> wrote:</div><br class="Apple-interchange-newline"><div><div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;"><div data-marker="__QUOTED_TEXT__"><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;"><div>>> uri_whitespace encode<br>><br>>Hmm. Accepting whitespace in URLs is a risky choice. One can never be<br>>completely sure how third-party agents in the network are handling it<br>>before the request arrived.<br>><br>>If (big IF) you are able to use "uri_whitespace deny" this proxy would<br>>be a bit more secure. This is just a suggestion, you know best here.<br></div><br><div>I think that was a workaround for a vulnerability. If it was, it may no longer be needed.<br></div><br><div><br>><br>>> acl trellix_phone_cloud dstdomain amcore-ens.rest.gti.trellix.com<br>>> http_access deny trellix_phone_cloud<br>>> external_acl_type host_based_filter children-max=15 ttl=0 0X0P+0CL >> acl HostBasedRules external host_based_filter<br>>> http_access allow HostBasedRules<br>>> auth_param digest program /usr/lib/squid/digest_file_auth -c /etc/squid/passwd<br>>> auth_param digest realm squid<br>>> auth_param digest children 2<br>>> auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/basic_passwd<br>>> auth_param basic children 2<br>>> auth_param basic realm squidb<br>>> auth_param basic credentialsttl 2 hours<br>><br>>> acl auth_users proxy_auth REQUIRED<br>>> external_acl_type custom_acl_db children-max=15 ttl=0 0X0P+0CL >> acl CustomAclDB external custom_acl_db<br>>> http_access allow CustomAclDB<br>><br>><br>>Hmm, this use of combined authentication+authorization is a bit tricky<br>>with two layers of asynchronous helper lookups going on. That alone<br>>might be what is going on with the weird 403's.<br>><br>><br>>A better sequence would be:<br>><br>># ensure login is performed<br>>http_access deny !auth_users<br>><br>># check the access permissions for whichever user logged in<br>>http_access allow CustomAclDB<br><br></div><br><div>The first call the the external_acl is to process unauthenticated requests. Is the suggestion to replace<br></div><br><div> acl auth_users proxy_auth REQUIRED </div><br><div>with <br></div><br><div> http_access deny !auth_users </div><br><div>before the second external_acl (for authenticated requests)?<br></div><br><br><br><br><div>Thanks again, very much<br></div><br><br><div>Kevin<br></div></div><br></div></div></div>_______________________________________________<br>squid-users mailing list<br>squid-users@lists.squid-cache.org<br>https://lists.squid-cache.org/listinfo/squid-users<br></div></blockquote></div><br></div></body></html>