12-07-04 10:46 PM
I am having an issues with the ip_user command in squid 2.5 Stable 7.
Even though I have the ip_user.conf file set to none I can still access
the internet from this ip. I have posted the squid.conf file
#Use Squid for authenication on ports and general proxying. All access
policies are
#handled by squidGuard redirector interface.
#ACL's debug
#debug_options ALL,1 32,2
#ACCESS's debug
debug_options ALL,1 28,12
#debug_options ALL,9 #store debug
#debug_options ALL,1 25,12 28,12
#port 3128 is used for squidGuard
http_port 3128 8080 8083 8085 8090
cache_effective_group squid
visible_hostname testsquid
#redirect_program /usr/local/bin/squidGuard -c
/usr/local/squidGuard/squidGuard.conf
#redirect_program /usr/local/squidGuard/bin/squidGuard -c
/usr/local/squidGuard/squidGuard.conf
redirect_children 16
acl SSL_ports port 443 563 33108 9080
acl Safe_ports port 21 80 443 563 70 210 1025-65535
acl Safe_ports port 9080 # freemarkets
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
cache_dir ufs /usr/local/squid/var/cache 100 16 256
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
#define all as source group
acl all src 0.0.0.0/0.0.0.0
external_acl_type ip_user %SRC %LOGIN
/usr/local/squid/etc/ip_user_check -f /usr/local/squid/etc/ip_user.conf
#define proxy ports, 8080 - users, 8090 - administrators, 8083 - real
audio
acl user_myport myport 8080
acl admin_myport myport 8090
acl realaudio_myport myport 8083
#define authenication
auth_param basic program /usr/local/squid/bin/ncsa_auth
/usr/local/squid/etc/passwd
auth_param basic children 5
auth_param basic realm Squid Cache Proxy Server
auth_param basic credentialsttl 2 hours
#define domain users group, password required
acl domainusers proxy_auth REQUIRED
#define domain admins group, password required, have to be list's
members
acl administrators_list proxy_auth
"/usr/local/squidGuard/db/administrators_list
#define dload users group, password required, have to be list's members
acl dload_users proxy_auth "/usr/local/squidGuard/db/dload_users_list"
#acl bad_ext url_regex "/usr/local/squid/etc/bad_ext.txt"
#acl allow_ext url_regex "/usr/local/squid/etc/allow_ext.txt"
#acl dload_ext url_regex
"/usr/local/squidGuard/db/whitelist/dload/expressions"
#acl dload_domain url_regex
"/usr/local/squidGuard/db/whitelist/dload/domains"
#acl bad_mime url_regex "/usr/local/squid/etc/bad_mime.txt"
logfile_rotate 45
#download main rule, deny all downloads after it
#http_access allow user_myport dload_ext dload_domain dload_users
#!!!!!!!!!!!!!!!!!!!!1'deny' configuration
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
#disable extensions from the list for domain users
# Added to allow login.exe 11/5/02
#http_access deny user_myport bad_ext
#disable ftp for domain users
#http_access deny user_myport FTP
#main 'allow' rules, the rule uses AND logic per line. Requests got
checked untill match
#is found per line. Example: 'http_access allow user_myport
domainusers' will check port first,
#then check if user in domainusers, since domainuser has to be
authenicated will call for password,
#if all(AND) conditions are met then proxying is allowed.
http_access allow realaudio_myport domainusers
http_access allow user_myport domainusers
http_access allow user_myport administrators_list
http_access allow admin_myport administrators_list
#last rule - deny!!!!!!
#in case no match was found in previous lines.
http_access deny all
----------------------
This is what is in my ip_user.conf file:
192.168.0.249 NONE
----------------------------
Can someone please tell me what I am doing wrong?
Here are my configure options:
Squid Cache: Version 2.5.STABLE7-20041206
configure options: --prefix=/usr/local/squid
--enable-basic-auth-helpers=NCSA --enable-external-acl-helpers=ip_user
[ Post a follow-up to this message ]
| 
