LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 05-27-2012, 04:26 PM   #1
jat421
LQ Newbie
 
Registered: May 2012
Posts: 12

Rep: Reputation: Disabled
squid3 acl's


Hi, I need some help with squid acl that doesn't seems to be working. I have install squid3 and it seems to be routing the traffic. In the squid.conf file I have put a acl but it's not working.

Code:
acl bad_sites dstdomain .facebook.com

http_access deny bad_sites
I can post the config file but not sure how to easily remove comments from the config file. Thanks
 
Old 05-27-2012, 06:03 PM   #2
bathory
LQ Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 11,516

Rep: Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501
Hi,

Quote:
I can post the config file but not sure how to easily remove comments from the config file.
You can use:
Code:
 grep -v ^# squid.conf > squid.conf.txt
Regards
 
Old 05-27-2012, 06:32 PM   #3
jat421
LQ Newbie
 
Registered: May 2012
Posts: 12

Original Poster
Rep: Reputation: Disabled
Thanks!!!. Here is the conf file

Code:
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl bad_sites dstdomain *.facebook.com
acl nav src 192.168.0.0/16      # RFC1918 possible internal network



acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT



http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access allow nav
http_access deny bad_sites
http_access deny all


http_port 8080


coredump_dir /var/spool/squid3


refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern (Release|Packages(.gz)*)$      0       20%     2880
refresh_pattern .               0       20%     4320
 
Old 05-28-2012, 01:19 AM   #4
bathory
LQ Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 11,516

Rep: Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501
So, what exactly is not working?
If you want to deny access to bad_sites for your LAN, you should use the "http_access deny bad_sites" directive, before the "http_access allow nav"
Code:
<snip>
http_access deny bad_sites
http_access allow nav
http_access deny all
<snip>
Regards
 
Old 05-28-2012, 02:23 AM   #5
linuxlover.chaitanya
Senior Member
 
Registered: Apr 2008
Location: Nagpur, India
Distribution: Cent OS 5/6, Ubuntu Server 10.04
Posts: 4,629

Rep: Reputation: Disabled
What if you try to change the acl from dstdomain to url_regex or url_path_regex? Does this work? But this will be more restrictive and you need to understand how it will work.
 
Old 05-28-2012, 08:58 AM   #6
jat421
LQ Newbie
 
Registered: May 2012
Posts: 12

Original Poster
Rep: Reputation: Disabled
Thanks!!!. I will give this both suggestions a try later today and let you know the results.

The bad_sites .facebook.com is not blocked by the acl. And I will try to read up on regex as well and see how that works. Thanks!
 
Old 05-28-2012, 06:54 PM   #7
jat421
LQ Newbie
 
Registered: May 2012
Posts: 12

Original Poster
Rep: Reputation: Disabled
Thanks!!!..that was it. Putting the bad_sites before nav fixed it!!

The only other thing is that I have to reboot the server for the changes to take effect. I have tried restarting squid3 by "sudo squid3 restart" but that does not work. I do not get any errors with the command it's just any changes won't take effect until I reboot. Is there any trick to restarting squid without rebooting the server? Thanks!

I have ubuntu 12.04 running in VMware Player. Thanks!
 
Old 05-28-2012, 07:06 PM   #8
Zetec
Member
 
Registered: Jul 2006
Distribution: Debian, Ubuntu, W7, openSUSE, Centos
Posts: 152

Rep: Reputation: 25
Shouldn't have to reboot. Try sudo squid stop then watch it stop and start squid. Then check the logs for any error messages.
 
Old 05-28-2012, 07:18 PM   #9
jat421
LQ Newbie
 
Registered: May 2012
Posts: 12

Original Poster
Rep: Reputation: Disabled
Thanks Zetec!...so I followed your instructions and found something interesting

While watching the cache.log of squid with "tail -f" whenever I do a "sudo squid3 stop" in the log it says "Squid is already running Proccess ID 733"

So it looks like that might be the culprit. Any ideas?. I will do a google search in the meantime. Thanks!
 
Old 05-28-2012, 07:23 PM   #10
jat421
LQ Newbie
 
Registered: May 2012
Posts: 12

Original Poster
Rep: Reputation: Disabled
so google found me a command that seemed to have worked "sudo squid3 -k shutdown".

Wondering why the "sudo squid3 stop" didn't work. Thanks for all the help!

EDIT: lol looking at squid3 --help says to use "sudo squid3 -k shutdown" command. I guess the old squid version used the stop command not this one. Thanks for all the help guys!!

Last edited by jat421; 05-28-2012 at 07:27 PM.
 
Old 05-28-2012, 10:00 PM   #11
Zetec
Member
 
Registered: Jul 2006
Distribution: Debian, Ubuntu, W7, openSUSE, Centos
Posts: 152

Rep: Reputation: 25
There you go. Glad you got it sorted. . Beats rebooting the server every time. .
 
Old 05-29-2012, 01:42 AM   #12
bathory
LQ Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 11,516

Rep: Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501Reputation: 1501
Quote:
so google found me a command that seemed to have worked "sudo squid3 -k shutdown".

Wondering why the "sudo squid3 stop" didn't work. Thanks for all the help!

EDIT: lol looking at squid3 --help says to use "sudo squid3 -k shutdown" command. I guess the old squid version used the stop command not this one.
You can use:
Code:
sudo /etc/init.d/squid3 restart
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
time based acl dosent work-squid3 alieblice Linux - Server 2 03-29-2012 09:49 AM
problem with samba and ACL ,ACL does not work as I want golden_boy615 Linux - Server 1 12-18-2011 10:18 AM
Why does the ACL of a file created under a directory differ from the default ACL sctebnt Linux - Security 5 12-02-2011 09:13 AM
[SOLVED] Squid3 Deny all traffic (Ignoring ACL) pliqui Linux - Server 3 02-18-2010 03:24 PM
iptables acl versus cisco acl id_viorel Linux - Security 1 04-09-2008 06:00 AM


All times are GMT -5. The time now is 02:54 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration