[SOLVED] Squid proxy doesn't deny all despite the directive

usr345 · 10-09-2016, 05:11 AM

I have installed squid proxy on my Linux Slackware machine. I thought that it's configured to deny connections to all hosts by default as http_access deny all directive was used in my config file. But to my surprise it allows all. Why doesn't it deny all?

Code:

# squid -k parse
2016/10/09 12:52:05| Processing Configuration File: /etc/squid/squid.conf (depth 0)
2016/10/09 12:52:05| Processing: acl localnet src 10.0.0.0/8    # RFC1918 possible internal network
2016/10/09 12:52:05| Processing: acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
2016/10/09 12:52:05| Processing: acl localnet src 192.168.0.0/16        # RFC1918 possible internal network
2016/10/09 12:52:05| Processing: acl localnet src fc00::/7       # RFC 4193 local private network range
2016/10/09 12:52:05| Processing: acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines
2016/10/09 12:52:05| Processing: acl SSL_ports port 443
2016/10/09 12:52:05| Processing: acl Safe_ports port 80         # http
2016/10/09 12:52:05| Processing: acl Safe_ports port 21         # ftp
2016/10/09 12:52:05| Processing: acl Safe_ports port 443                # https
2016/10/09 12:52:05| Processing: acl Safe_ports port 70         # gopher
2016/10/09 12:52:05| Processing: acl Safe_ports port 210                # wais
2016/10/09 12:52:05| Processing: acl Safe_ports port 1025-65535 # unregistered ports
2016/10/09 12:52:05| Processing: acl Safe_ports port 280                # http-mgmt
2016/10/09 12:52:05| Processing: acl Safe_ports port 488                # gss-http
2016/10/09 12:52:05| Processing: acl Safe_ports port 591                # filemaker
2016/10/09 12:52:05| Processing: acl Safe_ports port 777                # multiling http
2016/10/09 12:52:05| Processing: acl CONNECT method CONNECT
2016/10/09 12:52:05| Processing: http_access deny !Safe_ports
2016/10/09 12:52:05| Processing: http_access deny CONNECT !SSL_ports
2016/10/09 12:52:05| Processing: http_access allow localhost manager
2016/10/09 12:52:05| Processing: http_access deny manager
2016/10/09 12:52:05| Processing: http_access deny to_localhost
2016/10/09 12:52:05| Processing: http_access allow localnet
2016/10/09 12:52:05| Processing: http_access allow localhost
2016/10/09 12:52:05| Processing: http_access deny all
2016/10/09 12:52:05| Processing: http_port 3128
2016/10/09 12:52:05| Processing: cache_dir ufs /var/cache/squid 256 16 256
2016/10/09 12:52:05| Processing: pid_filename /var/run/squid/squid.pid
2016/10/09 12:52:05| Processing: coredump_dir /var/log/squid/cache/squid
2016/10/09 12:52:05| Processing: refresh_pattern ^ftp:          1440    20%     10080
2016/10/09 12:52:05| Processing: refresh_pattern ^gopher:       1440    0%      1440
2016/10/09 12:52:05| Processing: refresh_pattern -i (/cgi-bin/|\?) 0    0%      0
2016/10/09 12:52:05| Processing: refresh_pattern .              0       20%     4320
2016/10/09 12:52:05| Processing: visible_hostname laptop

bathory · 10-09-2016, 09:55 AM

Hi,

Quote:

...
2016/10/09 12:52:05| Processing: http_access allow localnet
2016/10/09 12:52:05| Processing: http_access allow localhost
2016/10/09 12:52:05| Processing: http_access deny all
...

The ACLs are read in sequence. As soon as one is met the next ones are ignored. See this for more.
So with the above configuration, squid at first allows access to anyone in localnet and ignores the next "http_access deny all"

Regards

usr345 · 10-09-2016, 03:14 PM

I removed this:

Code:

http_access allow localhost

and it started to block. I thought that it only allows http://localhost. Why did it allow everything?

usr345 · 10-09-2016, 04:12 PM

bathory, if you have rc.squid for Slackware - can you post it here. For some reason it wasn't installed for me from Slackbuild.

bathory · 10-10-2016, 12:31 AM

Quote:

Originally Posted by usr345

bathory, if you have rc.squid for Slackware - can you post it here. For some reason it wasn't installed for me from Slackbuild.

I'm running squid compiled from source, so I use a simple custom made rc script. You may look at the attached file and change it to fit your needs

But if indeed there is no rc script in the squid slackbuild you should inform the maintainer, so he fixes it

Regards