Blocking Executable Files with Squid

LinuxLuvr · 03-20-2006, 11:36 PM

I am very new to Squid and having a hard time with blocking executable files. I am using this URL for testing http://www.eicar.com/download/eicar.com
The goal is to be able to block com, exe, etc. files from being downloaded. I have tried this acl:

Code:

acl denyext url_regex "/usr/local/squid/etc/denyext"
http_access deny denyext

I have

Code:

\.com

in the external file. Your help will be greatly appreciated.

unSpawn · 03-23-2006, 07:42 PM

I have tried this acl
And? What's the error?
And what if you try "\.com$" (w/o the quotes)?

having a hard time with blocking executable files
To be clear you're not. You're blocking extensions.

LinuxLuvr · 03-23-2006, 08:54 PM

In answer to your first question, there was no error. I was able to download the file (not a good thing).

As for

Quote:

having a hard time with blocking executable files
To be clear you're not. You're blocking extensions.

I KNOW it is extensions (of executable files when I am done) that I am blocking. I am looking toward the goal not the semantics or minutia. That's not to say I don't appreciate the help. As I said I am new to Squid and will pick up on the 'jargon' the longer I use it I am sure.

In short, thanks again for the help. I actually do have the '$' at the end and it still downloads.

unSpawn · 03-24-2006, 06:49 AM

I KNOW it is extensions (of executable files when I am done) that I am blocking. I am looking toward the goal not the semantics or minutia.
It's not a nit. Take for example an image with a WMF payload or downloading a binary as proto://some.site/dump&fileid=001 or reading a page proto://some.site/gif?section=win32&type=exe&search=process%20list. What I'm trying to point at is that extensions don't have to match or relate to contents.

In answer to your first question, there was no error.
Could you post your log/error log for one GET of the EICAR file plus squid conf (w/o the comment lines)?

LinuxLuvr · 03-25-2006, 05:54 PM

OK. I figured out the problem. As it turned out, it was not the acl. The problem was was with the redirector_access directive. I had it denying the localhost, but not the host IP address. While looking at the log entry for the GET that you requested I noticed that it was denying downloads for localhost.

Thanks for the help!!

unSpawn · 03-25-2006, 08:41 PM

Found it yourself.
Well done.