LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 06-23-2006, 03:11 AM   #1
winxandlinx
Member
 
Registered: May 2006
Posts: 141

Rep: Reputation: 15
Squid Error while blocking sites


Hi Everyone

I am using redhat 9 ,i am trying to block

google.com in the squid i done it after that when i am

restarting the squid ,i am getting the error like

[root@kmglinux squid]# service squid restart
Stopping squid: 2006/06/23 13:02:11| squid.conf line 1738: acl rider google.com
2006/06/23 13:02:11| aclParseAclLine: Invalid ACL type 'google.com'
2006/06/23 13:02:11| squid.conf line 1744: http_access deny rider
2006/06/23 13:02:11| aclParseAccessLine: ACL name 'rider' not found.
2006/06/23 13:02:11| squid.conf line 1744: http_access deny rider
2006/06/23 13:02:11| aclParseAccessLine: Access line contains no ACL's, skipping
[ OK ]
Starting squid: . [ OK ]


This is the squid where i made changes


acl our_networks src 10.159.207.0/24
acl rider google.com

http_access allow our_networks

# And finally deny all other access to this proxy
http_access allow localhost
http_access deny rider


Helping this issue will be very much appriciated

Thanks & Regards
winxandlinx
 
Old 06-23-2006, 03:54 AM   #2
prozac
Member
 
Registered: Oct 2005
Location: Australia
Distribution: slackware 12.1
Posts: 753

Rep: Reputation: 32
@squid.conf
Defining an Access List
#
# acl aclname acltype string1 ...
# acl aclname acltype "file" ...
#
# when using "file", the file should contain one item per line


where is your acltype?
you will need something like "url_regex -i" in front of google.com.
 
Old 06-23-2006, 04:12 AM   #3
winxandlinx
Member
 
Registered: May 2006
Posts: 141

Original Poster
Rep: Reputation: 15
Can you somewhat briefly

i cannot able to understand since i am new to linux

can you directly tell me the code

i mean is acl name is rider and site to block is google.com

You can directly give me the code for this issue

Thanks & Regards
winxandlinx
 
Old 06-23-2006, 04:16 AM   #4
prozac
Member
 
Registered: Oct 2005
Location: Australia
Distribution: slackware 12.1
Posts: 753

Rep: Reputation: 32
Code:
acl rider url_regex -i google.com
instead of
Quote:
acl rider google.com
as in
Quote:
acl our_networks src 10.159.207.0/24 where

acl=acl
aclname=our_networks
acltype=src
string1=10.159.207.0/24
got it?
 
Old 06-24-2006, 02:24 AM   #5
Notwerk
Member
 
Registered: Apr 2005
Location: Jordan
Distribution: Debian (Sarge), Ubuntu (6.06)
Posts: 271

Rep: Reputation: 30
A suggestion:
Create a file /etc/squid/blocked_domains which would contain a list of all the domains you want to block each on a separate line. Which would look something like this:
Code:
#touch /etc/squid/blocked_domains
#vi /etc/squid/blocked_domains
xxx
.sex.com
.google.com
Then chown the file to root.squid and chmod it to 640
Code:
#chown root.squid /etc/squid/blocked_domains
#chmod 640 /etc/squid/blocked_domains
Finally, add this acl:
Code:
acl BLOCKED_DOMAINS dstdom_regex -i "/etc/squid/blocked_domains"
http_access deny BLOCKED_DOMAINS
This way you can manage the blocked domains using the the file /etc/squid/blocked_domains without revisitng the squid settings.

REMEMBER to reload squid if you make changes to the file
Code:
#/etc/init.d/squid reload
One more IMPORTANT note:
Squid processes your rules in sequential order, so using:
Code:
acl OUR_NETWORKS src 10.159.207.0/24
http_access allow OUR_NETOWRKS

acl BLOCKED_DOMAINS dstdom_regex -i "/etc/squid/blocked_domains"
http_access deny BLOCKED_DOMAINS
will allow all machines on the 10.159.207.0/24 network unrestricted access, since the deny rule will not be tested for any hosts coming from the defined network.
As a general rule, you should put all your DENY rules BEFORE any ALLOW rules, then check the order of each group to insure they are being enforced correctly.

Hope this was useful
 
Old 06-28-2006, 02:10 AM   #6
winxandlinx
Member
 
Registered: May 2006
Posts: 141

Original Poster
Rep: Reputation: 15
Yes i did but its not working

i dont know where i went wrong may be

yes just have a look at the code

Here my squid.conf file

acl our_networks src 10.159.207.0/24

http_access allow our_networks

# And finally deny all other access to this proxy
http_access allow localhost
acl BLOCKED_DOMAINS dstdom_regex -i "/etc/squid/blocked_domains"
http_access deny BLOCKED_DOMAINS



my blocked_domains file here

[root@kmglinux squid]# vi blocked_domains
www.google.com
.google.com


~
You will be very much appriciated if any one help out of this issue

Thanks & Regards
winxandlinx
 
Old 06-28-2006, 05:34 AM   #7
prozac
Member
 
Registered: Oct 2005
Location: Australia
Distribution: slackware 12.1
Posts: 753

Rep: Reputation: 32
instead of this,

Code:
acl our_networks src 10.159.207.0/24

http_access allow our_networks

# And finally deny all other access to this proxy
http_access allow localhost
acl BLOCKED_DOMAINS dstdom_regex -i "/etc/squid/blocked_domains"
http_access deny BLOCKED_DOMAINS
I think it should be like this

Code:
# And finally deny all other access to this proxy
http_access allow localhost
acl BLOCKED_DOMAINS dstdom_regex -i "/etc/squid/blocked_domains"
http_access deny BLOCKED_DOMAINS
http_access allow our_networks
 
Old 06-28-2006, 06:31 AM   #8
winxandlinx
Member
 
Registered: May 2006
Posts: 141

Original Poster
Rep: Reputation: 15
Still its not working

now my squid.conf file is

# And finally deny all other access to this proxy
And finally deny all other access to this proxy
http_access allow localhost
acl BLOCKED_DOMAINS dstdom_regex -i "/etc/squid/blocked_domains"
http_access deny BLOCKED_DOMAINS
http_access allow our_networks
acl our_networks src 10.159.207.0/24


and after saving this i had restared the squid

so i am getting the error

[root@kmglinux squid]# service squid restart
Stopping squid: 2006/06/28 17:01:25| parseConfigFile: line 1736 unrecognized: 'And finally deny all other access to this proxy'
2006/06/28 17:01:25| squid.conf line 1740: http_access allow our_networks
2006/06/28 17:01:25| aclParseAccessLine: ACL name 'our_networks' not found.
2006/06/28 17:01:25| squid.conf line 1740: http_access allow our_networks
2006/06/28 17:01:25| aclParseAccessLine: Access line contains no ACL's, skipping
 
Old 06-28-2006, 06:37 AM   #9
prozac
Member
 
Registered: Oct 2005
Location: Australia
Distribution: slackware 12.1
Posts: 753

Rep: Reputation: 32
oh! sorry! but did you just copy/paste? comon' get a lil' bit smart. i missed this and so did you:
Quote:
acl our_networks src 10.159.207.0/24
since our_networks have not been defined with acl you are getting that error:

new code:
Code:
# And finally deny all other access to this proxy
acl our_networks src 10.159.207.0/24
http_access allow localhost
acl BLOCKED_DOMAINS dstdom_regex -i "/etc/squid/blocked_domains"
http_access deny BLOCKED_DOMAINS
http_access allow our_networks
 
Old 06-28-2006, 06:39 AM   #10
prozac
Member
 
Registered: Oct 2005
Location: Australia
Distribution: slackware 12.1
Posts: 753

Rep: Reputation: 32
also delete this line or comment it:
Quote:
And finally deny all other access to this proxy
 
Old 06-28-2006, 07:44 AM   #11
winxandlinx
Member
 
Registered: May 2006
Posts: 141

Original Poster
Rep: Reputation: 15
This time i did not get any error

But the blocking site rule is not working

That is i can able to access the site google.com

By the rule i should not able to get the access


Even if you have squid.conf file just give me

which also helps me

Even if you are in online you can give me your chat id also '

if you are interested

Thanks for your replay

and still waithing for thge solutions
 
Old 06-28-2006, 09:35 AM   #12
prozac
Member
 
Registered: Oct 2005
Location: Australia
Distribution: slackware 12.1
Posts: 753

Rep: Reputation: 32
this is just an example

DO NOT COPY/PASTE. Instead read it and follow it.

Code:
#Recommended minimum configuration:
acl all src 0.0.0.0/0.0.0.0
#your network, replace x.x.x.x/x.x.x.x with your own network address
acl your_network_name_here src x.x.x.x/x.x.x.x

### Deny some specific ip's known for mischief
acl DENY1 src x.x.x.x 
http_access deny DENY1

#### Allow everything to some people
acl privileged_user src x.x.x.x/x
http_access allow privileged_user

############################# RULES ############################3
## GAMES ::
acl GAMES url_regex -i .candystand.com.* .miniclip.com.* .shockwave.com .e-messenger.net .msn2go.com
http_access deny GAMES

## to deny certain website at business hours
acl WEB url_regex -i .*google.com.*
acl business_hours time S M T W H F 8:30-18:30
http_access allow your_network_name_here WEB
http_access deny WEB business_hours

### To Block downloading ###
acl extndeny url_regex -i "/etc/squid/denied_ext"
acl download method GET

#allow user_X to download
http_access allow user_X extndeny
http_access deny denied_ext download
http_access deny extndeny

# Banned sites and Services
acl bad_ip dst "/etc/squid/banned_ip.txt"
acl bad_domains dstdomain "/etc/squid/banned_domain.txt"

http_access deny bad_ip your_network_name_here
http_access deny bad_domains your_network_name_here
..
 
Old 06-29-2006, 03:53 AM   #13
winxandlinx
Member
 
Registered: May 2006
Posts: 141

Original Poster
Rep: Reputation: 15
Can You give me any full sample file

Because sometime the error is happening due to inserting the line may be at not

exact place
 
Old 06-29-2006, 03:56 AM   #14
winxandlinx
Member
 
Registered: May 2006
Posts: 141

Original Poster
Rep: Reputation: 15
Just give me code with the following details

my local ips are 10.160.56/0 whole network

and i want to block google.com

If you can give me a code for this issue then it will be very much appricated
 
Old 06-29-2006, 04:09 AM   #15
prozac
Member
 
Registered: Oct 2005
Location: Australia
Distribution: slackware 12.1
Posts: 753

Rep: Reputation: 32
#12 is your best bet, take it or leave it.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
SQUID for blocking yahoo and msn [inc squid.conf] chrisfirestar Linux - Security 10 03-03-2008 08:33 AM
iptables is blocking sites... The_wave Linux - Networking 9 09-09-2005 04:44 PM
controlling access through squid( blocking all sites except for one) jomy Linux - Networking 1 12-15-2004 06:27 AM
Blocking some sites... gani *BSD 2 11-05-2004 09:07 PM
Blocking porn sites debug019 Linux - Newbie 4 09-07-2004 01:13 AM


All times are GMT -5. The time now is 05:34 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration