[squid-users] Squid config / transparent proxy questions

Hello,

I have the following 2 questions:

1. I have setup Squid 3.0 STABLE 9 without https / transparent proxy
options (i.e., configure WITHOUT "--with-openssl=/usr/local/openssl",
"--enable-ssl" and "--enable-????-transparent" options) and it appears
to work fine using the squidclient. But after I rerun configure with
the "--with-openssl=/usr/local/openssl" and "--enable-ssl" options,
"squid -k parse squid.conf" gives me the following errors:

2008/12/26 06:42:07| Processing Configuration File:
/usr/local/squid/etc/squid.conf (depth 0)
2008/12/26 06:42:07| aclParseAccessLine: ACL name 'manager' not found.
FATAL: Bungled squid.conf line 629: http_access allow manager localhost
Squid Cache (Version 3.0.STABLE9): Terminated abnormally.

I would like to be able to get past the above mentioned errors before
I modify the config file further. The squid.conf is the one that
"make install" generated - the only line I added was for the
visible_hostname to set to the name of the machine where I have squid
installed. As the squid.conf is pretty large, I have pasted the
relevant lines below --

acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8

acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network

acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

http_access allow manager localhost
http_access deny manager
# Deny requests to unknown ports
http_access deny !Safe_ports
# Deny CONNECT to other than SSL ports
http_access deny CONNECT !SSL_ports

http_access allow localnet

If I comment out the following lines (just to see what happens):

#http_access allow manager localhost
#http_access deny manager

then it gives me the error:

2008/12/26 06:52:49| Processing Configuration File:
/usr/local/squid/etc/squid.conf (depth 0)
2008/12/26 06:52:49| aclParseAccessLine: ACL name 'Safe_ports' not found.
FATAL: Bungled squid.conf line 632: http_access deny !Safe_ports
Squid Cache (Version 3.0.STABLE9): Terminated abnormally.

Could someone please tell what I could be doing wrong here. If you
need the entire squid.conf file (or other relevant entries within the
squid.conf file), please let me know.

2. Where I work, we have an equipment from F5 for load balancing and
certificate management - so I guess it will decrypt the https request
and send it off to the Squid server (after the F5 rules are in place).
 In this scenario, do we even need to worry about setting up Squid
with https or transparent proxying enabled (as I understand it, https
will not work with transparent proxying), but in our scenario, I guess
the F5 rules will take care of transparent proxying and since the F5
will decrypt and send the request to the Squid server, I suppose I
don't need to worry about https either. Am I correct in saying that
if we have Squid setup to work with http requests alone without
transparent proxy, it will able to handle https requests as well,
given our setup? If I need transparent proxy with http, do I would
have to run configure with one of the following options (i.e., it is
not enabled by default, yeah?):

--enable-ipfw-transparent
--enable-ipf-transparent
--enable-pf-transparent
--enable-linux-netfilter
--enable-linux-tproxy

Thanks much for your help.

Regards,
Kishore
Received on Fri Dec 26 2008 - 23:42:55 MST