Re: squid-users-digest Digest V00 #670

--- squid-users-digest-request@ircache.net wrote:

> ATTACHMENT part 1 message/rfc822
>
> squid-users-digest Digest Volume 00 : Issue 670
>
> Today's Topics:
> Re: [SQU] I'm a squid beginner Sorry [ "Martin A.
> Brooks" <martin@hinterla ]
> Re: [SQU] access lists help ...again [ Xwindows
> User <xwindowuser@discflo. ]
> Re: [SQU] ports and proxy. How? [
> Tom.Williams@diversifiedsoftware.co ]
> Re: [SQU] is there a port of Squidgu [ "Robert
> Collins" <robert.collins@it ]
> Re: [SQU] Terms and Conditions [ "Robert
> Collins" <robert.collins@it ]
> [SQU] accelerator and icp [ Ask Bjoern
> Hansen <ask@valueclick.c ]
> Re: [SQU] Terms and Conditions [ Colin
> Campbell <sgcccdc@citec.qld.g ]
> OT: Re: [SQU] Terms and Conditions [ "Robert
> Collins" <robert.collins@it ]
> [SQU] Squid Directives [ "Simon
> Croome" <scroome@solent.ac.u ]
> [SQU] HOW DENY AND RESTRICT FTP [ "Sinisa
> Malesevic" <malesevic@sever ]
> [SQU] Proxy Transparent [ "Roberto
> Salazar M." <rcsalazar77@h ]
> [SQU] Parent Peer Failover [ Rainer
> Ginsberg <rainer.ginsberg@de ]
> [SQU] How to turn off proxy when usi [
> stan@bort.gps.caltech.edu ]
> AW: [SQU] Parent Peer Failover [viru [ "Ingo
> Wupper" <ingo.wupper@vanco.de ]
>

> ATTACHMENT part 2 message/rfc822
> Date: Tue, 19 Dec 2000 19:41:34 +0000
> From: "Martin A. Brooks" <martin@hinterlands.org>
> To: <thettick@surfsoft.com>
> CC: squid-users@ircache.net
> Subject: Re: [SQU] I'm a squid beginner Sorry!
>
> At 09:56 19/12/00 -0800, you wrote:
> >When accessing one of our secure sites we get this
> error. Any help would be
> >great.
> >
> >HTTP Error 401
> >401.3 Unauthorized: Unauthorized due to ACL on
> resource
>
> This is not a Squid error message. Take a look at
> the Squid log files and
> post any relevant information back to the list.
>
> Regards
>
>
> Martin A. Brooks
>
------------------------------------------------------
> If Windows NT were an animal, it'd be a fainting
> goat.
>
> --
> To unsubscribe, see
> http://www.squid-cache.org/mailing-lists.html
>

> ATTACHMENT part 3 message/rfc822
> Date: Tue, 19 Dec 2000 12:03:24 -0800
> From: Xwindows User <xwindowuser@discflo.com>
> To: squid-users@ircache.net
> CC: squid-users@ircache.net
> Subject: Re: [SQU] access lists help ...again
>
> ok, got all the stuff running and blocking napster,
> thansk guys....larry
>
>
>
> Craig Fels wrote:
> >
> > > ok here I go again. I have this:
> > >
> > > acl discflo src 192.168.0.0/255.255.255.0
> > > acl denied src 192.168.0.55/255.255.255.0
> > > acl all src 0.0.0.0/0.0.0.0
> > >
> > > http_access allow discflo
> > > http_access deny denied
> > > http_access deny all
> > >
> > > no one gets denied, the one I want to deny is
> 192.168.0.55, as you can
> > > se in the ACL.
> >
> > Okay, no one gets denied here because everything
> in the 192.168.0.x subnet
> > matches the acl discflo. None of the sources,
> included 192.168.0.55 makes
> > it to the http_access deny line.
> >
> > Try reversing it... like this:
> >
> > http_access deny denied
> > http_access allow discflo
> > http_access deny all
> >
> > > conversely I have tried this too:
> > > with the same ACL's from above I tried:
> > >
> > > http_acces deny discflo
> > > http_access allow denied
> > > http_access deny all
> > >
> > > and noone gets access....I thought that the
> rules matched, it looks like
> > > they do but I guess not. once again I am
> confused, thanks
> >
> > no one gets access because EVERYTHING in
> 192.168.0.x matches the first
> > http_access line. Therefore, everyone on this
> subnet gets denied.
> >
> > Hope I've helped!
> >
> > Craig
> >
> > --
> > To unsubscribe, see
> http://www.squid-cache.org/mailing-lists.html
>
> --
> To unsubscribe, see
> http://www.squid-cache.org/mailing-lists.html
>

> ATTACHMENT part 4 message/rfc822
> Date: Tue, 19 Dec 2000 12:19:17 -0800
> From: Tom.Williams@diversifiedsoftware.com
> To: martin@hinterlands.org
> CC: mcc@TO.GD-ES.COM, zackerov@libero.it,
> squid-users@ircache.net
> Subject: Re: [SQU] ports and proxy. How?
>
> I got the SOCKS5 implementation that we use from
> http://www.socks.nec.com.
>
> Peace.....
>
> Tom
>
>
>
>
> "Martin A. Brooks" <martin@hinterlands.org> on
> 12/19/2000 11:39:58 AM
>
> To: Merton Campbell Crockett <mcc@TO.GD-ES.COM>,
> Zackerov
> <zackerov@libero.it>
> cc: squid-users@ircache.net
> Subject: Re: [SQU] ports and proxy. How?
>
>
> At 07:43 19/12/00 -0800, Merton Campbell Crockett
> wrote:
>
> >Squid does not proxy POP3 or Telnet. If you want
> to proxy them you will
> >need to use something like Socks or FWTK (Firewall
> Toolkit). I believe
> that
> >both are freely available but its been some time
> since I've referenced
> them
> >so I can't give you a URL.
>
> FWTK is available from
> http://www.tis.com/research/software/
> I can't find the link to the SOCKS implementation I
> have installed, but,
> whatever it is, it works fine :)
>
>
>
> Martin A. Brooks
>
------------------------------------------------------
> If Windows NT were an animal, it'd be a fainting
> goat.
>
> --
> To unsubscribe, see
> http://www.squid-cache.org/mailing-lists.html
>
>
>
>
>
> --
> To unsubscribe, see
> http://www.squid-cache.org/mailing-lists.html
>

> ATTACHMENT part 5 message/rfc822
> Date: Wed, 20 Dec 2000 10:34:11 +1300
> From: "Robert Collins"
> <robert.collins@itdomain.com.au>
> To: "Thomas Adam" <thomas_adam16@yahoo.com>,
> "squid mailing list"
> <squid-users@ircache.net>
> Subject: Re: [SQU] is there a port of Squidguard to
> NT?
>
> Squidguard requires the Sleepycat DB engine version
> 2 - and version 3.x is
> the current and only supported version of the
> product. When squidguard gets
> updated to use the db 3.x engine, then you should be
> able to build it out of
> the box.
>
> Rob
> ----- Original Message -----
> From: "Thomas Adam" <thomas_adam16@yahoo.com>
> To: "squid mailing list" <squid-users@ircache.net>
> Sent: Wednesday, December 20, 2000 2:31 AM
> Subject: [SQU] is there a port of Squidguard to NT?
>
>
> > Dear List,
> >
> > I am using the ported version of squid to NT
> (stable
> > release4) on one of the school's file servers.
> Does
> > anybody know of (or is anybody thinking of doing)
> a
> > port of SquidGuard to windows NT??
> >
> > Thankyou in Advanced,
> >
> > Thomas Adam
> > re: thomas_adam16@yahoo.com
> >
> > =====
> > Thomas Adam
> > Linux Co-ordinator for The Purbeck School
> >
> > e-mail (school):
> n6tadam@users.purbeck.dorset.sch.uk
> > e-mail (yahoo) : thomas_adam16@yahoo.com
> >
> > __________________________________________________
> > Do You Yahoo!?
> > Yahoo! Shopping - Thousands of Stores. Millions of
> Products.
> > http://shopping.yahoo.com/
> >
> > --
> > To unsubscribe, see
> http://www.squid-cache.org/mailing-lists.html
> >
> >
>
> --
> To unsubscribe, see
> http://www.squid-cache.org/mailing-lists.html
>

> ATTACHMENT part 6 message/rfc822
> Date: Wed, 20 Dec 2000 10:45:45 +1300
> From: "Robert Collins"
> <robert.collins@itdomain.com.au>
> To: "Craig Fels" <csfels@swbell.net>,
> <bmckellar@optushome.com.au>,
> "Squid-Users@Ircache.Net"
> <squid-users@ircache.net>
> Subject: Re: [SQU] Terms and Conditions
>
> That cannot display the policies every time the user
> starts a browsing
> session. It can a) show a page once or b) take them
> to a home page. If they
> start browsing by going to favorites or a emailed
> shortcut they will not see
> the T&C page. You might be able to do something by
> resetting the 'first
> run' flag for IE in the registry every login so it
> goes to the 'first run'
> page each time. But that's getting tricky.
>
> Doing it in squid is pretty easy. Either whena new
> client is added to the
> client_db or when a new user is added to the user
> cache (and you'll want
> auth_rewrite so the cache gets cleaned or this won't
> work) redirect the user
> to the T&C page. If you're kind you'll make the T&C
> page a gci script that
> accepts the URI the user wanted to go to as a
> parameter and puts a link on
> the page (click here to go to the page you wanted to
> goto)..
>
> Rob
>
> ----- Original Message -----
> From: "Craig Fels" <csfels@swbell.net>
> To: <bmckellar@optushome.com.au>;
> "Squid-Users@Ircache.Net"
> <squid-users@ircache.net>
> Sent: Wednesday, December 20, 2000 4:36 AM
> Subject: Re: [SQU] Terms and Conditions
>
>
> > The only way I know how to do it is with Windows
> Policies. You can use
> > the ADM template that comes with IE5's
> administrators kit (free download)
> > and set the proxy values, start page, and lots of
> other options.
> >
> > Craig
> > ----- Original Message -----
> > From: "Ben M" <bmckellar@optushome.com.au>
> > To: "Squid-Users@Ircache.Net"
> <squid-users@ircache.net>
> > Sent: Tuesday, December 19, 2000 7:00 AM
> > Subject: [SQU] Terms and Conditions
> >
> >
> > > Hi,
> > >
> > > I run a proxy in an organisation with approx 50
> users. Management wants
> > the
> > > terms and conditions explained to each user when
> they open up Internet
> > > Explorer. I currently log all sites visited
> with authentication by
> > > username.
> > >
> > > Is there a way through the proxy i can make it
> start on a certain page
> all
> > > the time, that overides the default homepage?
> Any other ideas about
> > listing
> > > the terms and conditions of surfing the
> internet.. e.g so they know
> they
> > > are monitored.. ??
> > >
> > > cheers
> > >
> > > Ben M
> > >
> > > --
> > > To unsubscribe, see
> http://www.squid-cache.org/mailing-lists.html
> > >
> >
> > --
> > To unsubscribe, see
> http://www.squid-cache.org/mailing-lists.html
> >
> >
>
> --
> To unsubscribe, see
> http://www.squid-cache.org/mailing-lists.html
>

> ATTACHMENT part 7 message/rfc822
> Date: Tue, 19 Dec 2000 14:30:18 -0800 (PST)
> From: Ask Bjoern Hansen <ask@valueclick.com>
> To: squid-users@ircache.net
> Subject: [SQU] accelerator and icp
>
> hi,
>
> I've setup some squid servers as http accelerators
> with a simple
> redirector so
> http://nameofcluster/foo/blah/server/path will be
> rewritten to http://server/path?blah. The server is
> setup to ignore
> reload requests and with loong expire times. The
> /blah/ part we can
> then change to make the squid request the document
> again. It works
> great. Squid rocks.
>
> How can I make squid not send the ?blah part when it
> forwards the
> request? It's not too important, but it would be
> cleaner.
>
> If I enable proxy with accel can I then use ICP to
> have the squids
> peer for each other (to provide more fault
> tolerance)?
>
> The servers will be in clusters of 3-7 servers in
> each geographic
> location with a number of geographic locations
> around the world. How
> good is squid at figuring out which peer to use if I
> just list a
> bunch of peers from other clusters (again to make it
> work even if
> links between the cluster and the main server goes
> away).
>
>
>
> - ask
>
> --
> ask bjoern hansen - <http://ask.netcetera.dk/>
>
> --
> To unsubscribe, see
> http://www.squid-cache.org/mailing-lists.html
>

> ATTACHMENT part 8 message/rfc822
> Date: Wed, 20 Dec 2000 09:20:52 +1000 (EST)
> From: Colin Campbell <sgcccdc@citec.qld.gov.au>
> To: Ben M <bmckellar@optushome.com.au>
> CC: "Squid-Users@Ircache.Net"
> <squid-users@ircache.net>
> Subject: Re: [SQU] Terms and Conditions
>
> Hi,
>
> On Wed, 20 Dec 2000, Ben M wrote:
>
> > Hi,
> >
> > I run a proxy in an organisation with approx 50
> users. Management wants the
> > terms and conditions explained to each user when
> they open up Internet
> > Explorer. I currently log all sites visited with
> authentication by
> > username.
> >
> > Is there a way through the proxy i can make it
> start on a certain page all
> > the time, that overides the default homepage? Any
> other ideas about listing
> > the terms and conditions of surfing the internet..
> e.g so they know they
> > are monitored.. ??
>
> Why not explain to management that trying to solve
> people problames with
> technology is stupid. What you should be doing is
>
> 1) print T+C and put on user's desk
> 2) get them to read and sign copy of T+C
> 3) do not give them access until you have the signed
> copy of T+C in your
> hands
>
> That way the users have no excuses, cannot avoid it
> and you are saved a
> lot of hassles.
>
> Colin
>
> --
> To unsubscribe, see
> http://www.squid-cache.org/mailing-lists.html
>

> ATTACHMENT part 9 message/rfc822
> Date: Wed, 20 Dec 2000 12:45:12 +1300
> From: "Robert Collins"
> <robert.collins@itdomain.com.au>
> To: "Colin Campbell" <sgcccdc@citec.qld.gov.au>,
> "Ben M" <bmckellar@optushome.com.au>
> CC: "Squid-Users@Ircache.Net"
> <squid-users@ircache.net>
> Subject: OT: Re: [SQU] Terms and Conditions
>
> ----- Original Message -----
> From: "Colin Campbell" <sgcccdc@citec.qld.gov.au>
> To: "Ben M" <bmckellar@optushome.com.au>
> Cc: "Squid-Users@Ircache.Net"
> <squid-users@ircache.net>
> Sent: Wednesday, December 20, 2000 12:20 PM
> Subject: Re: [SQU] Terms and Conditions
>
>
> > Hi,
> >
> > On Wed, 20 Dec 2000, Ben M wrote:
> >
> > > Hi,
> > >
> > > I run a proxy in an organisation with approx 50
> users. Management wants
> the
> > > terms and conditions explained to each user when
> they open up Internet
> > > Explorer. I currently log all sites visited
> with authentication by
> > > username.
> > >
> > > Is there a way through the proxy i can make it
> start on a certain page
> all
> > > the time, that overides the default homepage?
> Any other ideas about
> listing
> > > the terms and conditions of surfing the
> internet.. e.g so they know
> they
> > > are monitored.. ??
> >
> > Why not explain to management that trying to solve
> people problames with
> > technology is stupid. What you should be doing is
> >
> > 1) print T+C and put on user's desk
> > 2) get them to read and sign copy of T+C
> > 3) do not give them access until you have the
> signed copy of T+C in your
> > hands
> >
> > That way the users have no excuses, cannot avoid
> it and you are saved a
> > lot of hassles.
> >
> > Colin
> >
>
> I don't think that using technology to assist in
> solving people problems is
> stupid. It's just not the _only answer needed_.
>
> the 1 2 3 process you have outlined above has fallen
> down in US courts (no I
> can't quote case numbers) due to the users 'not
> knowing the policy' - but
> this exact same viewpoint was discussed on firewall
> wizards recently, and in
> more detail. If the users are not kept up to date
> with the T&C, and not
> continually educated, and reminded, you cannot be
> sure they remember them.
> Displaying the latest changes, and reminding the
> users on a regular basis is
> needed. Can you remember your ISP's AUP? No? well
> forgetting could get you
> dropped off the net. This is the same issue.
>
> Having said that, any approach needs to tie in with
> (not a comprehensive
> list)
> * a signed acceptance of the corporate AUP; T&C;
> private information
> disclosure policy.
> * regular reminders of changes to any related policy
> (could be
> email/photocopy/popup on screen/first page seen each
> day/....)
> * Continual user education about security & risks.
> * frequent regular auditing of logs and enforcement
> of the AUP/T&C. If you
> don't enforce it every time, then users can claim "I
> thought that was ok. I
> did it for seven months" when you come to enforce
> the most recent case. You
> can of course just send a warning and leave it at
> that.. just as long as you
> do.
>
> But back to my point. Technical solutions do assist
> with people problems.
> The law in most countries says its illegal to steal,
> and by living in your
> country you accept the law of that country. So why
> do you lock the door of
> your house and why do you have a password on your
> usercode for your ISP
> account? These are technical solutions to a people
> problem...
>
> Rob
>
> --
> To unsubscribe, see
> http://www.squid-cache.org/mailing-lists.html
>

> ATTACHMENT part 10 message/rfc822
> Date: Wed, 20 Dec 2000 09:15:14 -0000
> From: "Simon Croome" <scroome@solent.ac.uk>
> To: <squid-users@ircache.net>
> Subject: [SQU] Squid Directives
>
> Hi,
>
> Does anyone know what directive needs to be entered
> into squid.conf to tell squid to refresh the cache
> more frequently than the default ?
>
> Thanks in advance, Simon.
>

> ATTACHMENT part 11 message/rfc822
> Date: Wed, 20 Dec 2000 13:55:45 +0100
> From: "Sinisa Malesevic" <malesevic@sever.co.yu>
> To: <squid-users@ircache.net>
> Subject: [SQU] HOW DENY AND RESTRICT FTP
>
> First questions: How deny ftp?
> Second questions: How restrict FTP by time (or acl)?
>
> Regard,
> Sinisa
> malesevic@sever.co.yu
>

> ATTACHMENT part 12 message/rfc822
> Date: Wed, 20 Dec 2000 10:44:28 -0500
> From: "Roberto Salazar M." <rcsalazar77@hotmail.com>
> To: squid-users@ircache.net
> Subject: [SQU] Proxy Transparent
>
> Hello:
> I am sorry my English y don`t speak English very
> vell.
> Y work with Linux 6.0 and 6.1, squid-2.3STABLE4 but
> I am tring setting
> a Proxy Transparent, I setting IPCHAINS and
> squid.conf how show in the
> manual HOWTO.
> But don't work correctly, to add the parameter:
> ipcahins -A input -p TCP -d any/0 www -j REDIRECT
> 3128 in rc.local, all the
> pages in the clients browser, obtain the next
> messages:
>
> ERROR:
> The URL it's not found:
> . URL incorrect.
>
> The port 3128 is correctly in Squid.
> Please, can help me
> Thank you
> Roberto
>
>
_________________________________________________________________________
> Get Your Private, Free E-mail from MSN Hotmail at
> http://www.hotmail.com.
>
> --
> To unsubscribe, see
> http://www.squid-cache.org/mailing-lists.html
>

> ATTACHMENT part 13 message/rfc822
> Date: Wed, 20 Dec 2000 16:48:39 +0100
> From: Rainer Ginsberg <rainer.ginsberg@de.bosch.com>
> To: squid-users@ircache.net
> Subject: [SQU] Parent Peer Failover
>
> Hi Squid Wizards,
>
> is it possible to set up Squid to use a second
> parent peer in case the
> first parent peer fails? The parents don't talk ICP.
>
> Cheers,
> Rainer
>
> --
> To unsubscribe, see
> http://www.squid-cache.org/mailing-lists.html
>

> ATTACHMENT part 14 message/rfc822
> Date: Wed, 20 Dec 2000 07:56:49 -0800 (PST)
> From: stan@bort.gps.caltech.edu
> To: squid-users@ircache.net
> Subject: [SQU] How to turn off proxy when using
> accelerator mode 2.3.STABLE3
>
> I'm having a weird problem. I checked the FAQ, and
> also the mailing list
> archives, and I couldn't find a solution, so I'm
> asking here.
>
> I have five Squid servers running as accelerators
> for various web sites
> in the Earthquake Hazards Program. I've found that
> using a Squid as an
> amplifier is the most cost-effective way of handling
> the occasional
> large surges of traffic we get after earthquakes.
>
> Anyway, the problem I'm having is with the three
> servers that accelerate
> the earthquake.usgs.gov. They are all identical
> FreeBSD machines running
> Squid 2.3.STABLE3. They are all set up as
> accelerators. But I found
> that if I set up Netscape to point to any one of
> them as a regular HTTP
> proxy, it will happily go and fetch yahoo, cnn, or
> whatever for me.
> In the case of the two older Squids I have that are
> running 2.2.STABLE5,
> if I do this, it gives an error. The older Squids
> refuse to fetch
> anything that is not on their 'httpd_accel_host'.
> This is what I want
> them to do, so how do I turn this off for the ones
> running 2.3?
>
> I added:
>
> httpd_accel_with_proxy off
>
> and did a 'squid -k reconfigure', but it still does
> it. Is this a
> peculiarity of 2.3 vs 2.2?
>
> Thanks for any help or enlightenment.
>
> --
> Stan Schwarz | Extreme sports...offer
> "some kind of physical
> stan@cosmo.pasadena.ca.us | analog to the thrill
> of installing Linux or
> http://cosmo.pasadena.ca.us | other open-source
> operating systems."
> | -Mikki
> Halpin, _The Geek Handbook_
>
> --
> To unsubscribe, see
> http://www.squid-cache.org/mailing-lists.html
>

> ATTACHMENT part 15 message/rfc822
> Date: Wed, 20 Dec 2000 16:52:27 +0100
> From: "Ingo Wupper" <ingo.wupper@vanco.de>
> To: "'Rainer Ginsberg'"
> <rainer.ginsberg@de.bosch.com>,
> squid-users@ircache.net
> Subject: AW: [SQU] Parent Peer Failover [virus
> checked]
>
> I would say: Use the second conf posibility
> described here and enter 2 (or
> more) parent caches.
> > Vanco Euronet GmbH
> > - the human network -
> >
> > Ingo Wupper
> > (Leiter Geschäftsbereich eSecurity)
> > Tel: +49 6102 785-601
> > Fax: +49 6102 785-556
> >
> >
> >
> > The information contained in this eMail is
> confidential. It is
> > intended solely for the addressee. Access to this
> eMail by anyone else
> > is unauthorized. If you are not the intended
> recipient, any form of
> > disclosure, reproduction, distribution or any
> action taken or
> > refrained from in reliance on it is prohibited and
> may be unlawful.
> > Please notify the sender immediatly. All
> statements of opinion or
> > advice directed via this eMail to our clients are
> subject to the terms
> > and conditions expressed in the governing VANCO
> AGB's. The content of
> > this eMail is not
> > legally binding unless confirmed by letter.
> >
> >
> >
>
>
> Note: The information here is current for version
> 2.2.
>
> First, you need to give Squid a parent cache.
> Second, you need to tell Squid
> it can not connect directly to origin servers. This
> is done with three
> configuration file lines:
>
> cache_peer parentcache.foo.com parent 3128 0
> no-query default
> acl all src 0.0.0.0/0.0.0.0
> never_direct allow all
>
> Note, with this configuration, if the parent cache
> fails or becomes
> unreachable, then every request will result in an
> error message.
>
> In case you want to be able to use direct
> connections when all the parents
> go down you should use a different approach:
>
> cache_peer parentcache.foo.com parent 3128 0
> no-query
> prefer_direct off
>
> The default behaviour of Squid in the absence of
> positive ICP, HTCP, etc
> replies is to connect to the origin server instead
> of using parents. The
> prefer_direct off directive tells Squid to try
> parents first.
>
> -----Ursprüngliche Nachricht-----
> Von: Rainer Ginsberg
> [mailto:rainer.ginsberg@de.bosch.com]
> Gesendet am: Mittwoch, 20. Dezember 2000 16:49
> An: squid-users@ircache.net
> Betreff: [SQU] Parent Peer Failover [virus checked]
>
> Hi Squid Wizards,
>
> is it possible to set up Squid to use a second
> parent peer in case the
> first parent peer fails? The parents don't talk ICP.
>
> Cheers,
> Rainer
did you try the weightage thing
> --
> To unsubscribe, see
> http://www.squid-cache.org/mailing-lists.html
>
>

__________________________________________________
Do You Yahoo!?
Yahoo! Shopping - Thousands of Stores. Millions of Products.
http://shopping.yahoo.com/

--
To unsubscribe, see http://www.squid-cache.org/mailing-lists.html