Advertisement
Guest User

squid-external.conf.mas

a guest
Nov 13th, 2013
170
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 7.61 KB | None | 0 0
  1. <%doc>
  2. Main configuration file for Squid daemon
  3.  
  4. Parameters:
  5.  
  6. snmpEnabled - Boolean indicating if SNMP is enabled or not
  7. </%doc>
  8. <%args>
  9. $port
  10. $transparent => undef
  11.  
  12. $hostfqdn
  13. $realm => ''
  14.  
  15. $memory
  16. $cacheDirSize
  17. $max_object_size
  18.  
  19. @nameservers
  20. $append_domain
  21.  
  22. $cache_host
  23. $cache_port
  24. $cache_user
  25. $cache_passwd
  26.  
  27. $urlRewriteProgram => undef
  28. @objectsDelayPools
  29. @notCachedDomains
  30.  
  31. $snmpEnabled => 0
  32. </%args>
  33. <%shared>
  34. our $anyPrefix = 'any_src_';
  35. our $maxAclNameLength = 31;
  36. our %longAclNames = ();
  37. </%shared>
  38. <%perl>
  39. # needed because space scape doesnt work in acl names
  40. sub _escapeWS
  41. {
  42. my ($string) = @_;
  43. $string =~ s{ }{__}g;
  44. return $string;
  45. }
  46. # needed to avoid log acl problems
  47. sub _aclName
  48. {
  49. my ($name) = @_;
  50. if (length($name) <= $maxAclNameLength) {
  51. return _escapeWS($name);
  52. }
  53.  
  54. if (not exists $longAclNames{$name}) {
  55. my $nextId = 1 + keys %longAclNames;
  56. $nextId = 'longAcl' . $nextId;
  57. $longAclNames{$name} = $nextId;
  58. }
  59.  
  60. return _escapeWS($longAclNames{$name});
  61. }
  62. </%perl>
  63. <%def .rulesACLs>
  64. <%args>
  65. @rules
  66. $realm
  67. </%args>
  68. % foreach my $rule (@rules) {
  69. % if ($rule->{any}) {
  70. <& .timeACLs, rule => $rule, id => $anyPrefix . $rule->{number} &>
  71. % next;
  72. % }
  73. % my $object = $rule->{object};
  74. % my $group = $rule->{group};
  75. % my $src = $object ? $object : $group;
  76. % my $aclName = _aclName($src);
  77. % if ($object) {
  78. acl <% $aclName %> src <% join ' ', @{ $rule->{addresses} } %>
  79. % } else {
  80. % # escape user names
  81. % my @users = map { $_ =~ s{ }{\\ }g; $_ } @{$rule->{users}};
  82. % if ($realm) {
  83. % @users = map { $_ . '@' . $realm } @users;
  84. % }
  85. acl <% $aclName %> proxy_auth <% join (' ', @users) %>
  86. % }
  87. <& .timeACLs, rule => $rule, id => $src &>
  88. % }
  89. </%def>
  90.  
  91. <%def .timeACLs>
  92. <%args>
  93. $rule
  94. $id
  95. </%args>
  96. % if ($rule->{timeDays}) {
  97. acl <% _aclName('timeDays_' . $id) %> time <% $rule->{timeDays} %>
  98. % }
  99. % if ($rule->{timeHours}) {
  100. acl <% _aclName('timeHours_' . $id) %> time <% $rule->{timeHours} %>
  101. % }
  102. </%def>
  103.  
  104. <%def .delayPools>
  105. <%args>
  106. @objectsDelayPools
  107. </%args>
  108. % if ( @objectsDelayPools ) {
  109. % my $pools = @objectsDelayPools;
  110. delay_pool_uses_indirect_client on
  111. delay_pools <% $pools %>
  112. % }
  113. <%perl>
  114. my $id = 0;
  115. foreach my $objPool (@objectsDelayPools) {
  116. $id++;
  117. my $rate = $objPool->{rate};
  118. if ($rate > 0) {
  119. $rate *= 1024;
  120. }
  121. my $size = $objPool->{size};
  122. if ($size > 0) {
  123. $size *= 1024 * 1024;
  124. }
  125. </%perl>
  126. delay_class <% $id %> <% $objPool->{class} %>
  127. % if ( $objPool->{class} eq '1' ) {
  128. delay_parameters <% $id %> <% $rate %>/<% $size %>
  129. % } elsif ( $objPool->{class} eq '2' ) {
  130. <%perl>
  131. my $clt_rate = $objPool->{clt_rate};
  132. if ($clt_rate > 0) {
  133. $clt_rate *= 1024;
  134. }
  135. my $clt_size = $objPool->{clt_size};
  136. if ($clt_size > 0) {
  137. $clt_size *= 1024 * 1024;
  138. }
  139. </%perl>
  140. delay_parameters <% $id %> <% $rate %>/<% $size %> <% $clt_rate %>/<% $clt_size %>
  141. % }
  142. delay_initial_bucket_level 90
  143. delay_access <% $id %> allow <% $objPool->{object} %>
  144. delay_access <% $id %> deny all
  145. % }
  146. </%def>
  147.  
  148. <%def .snmp>
  149. <%doc>
  150. Define the SNMP configuration as SNMP agent
  151. </%doc>
  152. acl snmppublic snmp_community public
  153. snmp_port 3401
  154. snmp_access allow snmppublic from_localhost
  155. snmp_access deny all
  156. </%def>
  157. ###################################################################################
  158. http_port localhost:<% $port %> ignore-cc
  159.  
  160.  
  161. visible_hostname (external)<% $hostfqdn %>
  162.  
  163. coredump_dir /var/spool/squid3
  164. cache_effective_user proxy
  165. cache_effective_group proxy
  166. cache_mem 640 MB
  167. maximum_object_size_in_memory 256 KB
  168. cache_dir diskd /var/spool/squid3 <% $cacheDirSize %> 16 256
  169. maximum_object_size 800 MB
  170. buffered_logs on
  171. client_db off
  172. pipeline_prefetch on
  173. ipcache_size 10240
  174. memory_pools off
  175. redirect_children 55
  176. range_offset_limit 200 MB
  177. quick_abort_min -1
  178. access_log /var/log/squid3/external-access.log squid
  179. cache_log /var/log/squid3/external-cache.log
  180. cache_store_log /var/log/squid3/external-store.log
  181. pid_filename /var/run/squid3-external.pid
  182.  
  183. % if (@nameservers) {
  184. % my $dns_nameservers = '';
  185. % foreach my $srv (@nameservers) {
  186. % $dns_nameservers .= "$srv ";
  187. % }
  188. dns_nameservers <% $dns_nameservers %>
  189. % }
  190. % if ($append_domain) {
  191. append_domain .<% $append_domain %>
  192. % }
  193.  
  194. # refresh patterns
  195.  
  196. # windows updates
  197. refresh_pattern http://.*\.windowsupdate\.microsoft\.com/ 0 80% 20160 reload-into-ims
  198. refresh_pattern http://.*\.update\.microsoft\.com/ 0 80% 20160 reload-into-ims
  199. refresh_pattern http://download\.microsoft\.com/ 0 80% 20160 reload-into-ims
  200. refresh_pattern http://windowsupdate\.microsoft\.com/ 0 80% 20160 reload-into-ims
  201. refresh_pattern http://.*\.download\.windowsupdate\.com/ 0 80% 20160 reload-into-ims
  202. refresh_pattern http://office\.microsoft\.com/ 0 80% 20160 reload-into-ims
  203. refresh_pattern http://w?xpsp[0-9]\.microsoft\.com/ 0 80% 20160 reload-into-ims
  204. refresh_pattern http://w2ksp[0-9]\.microsoft\.com/ 0 80% 20160 reload-into-ims
  205.  
  206. # linux updates
  207. refresh_pattern http://.*\.archive\.ubuntu\.com/ 0 80% 20160 reload-into-ims
  208. refresh_pattern http://(ftp|http)[0-9]*\.[a-z]+\.debian\.org/ 0 80% 20160 reload-into-ims
  209.  
  210. refresh_pattern ^ftp: 1440 20% 10080
  211. refresh_pattern ^gopher: 1440 0% 1440
  212. refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
  213. refresh_pattern . 0 20% 4320
  214.  
  215. # end refresh patterns
  216.  
  217. % if ($cache_host and $cache_port) {
  218. % my $peerAuth = '';
  219. % if ($cache_user and $cache_passwd) {
  220. # WARN: remember that for squid auth % are HTML escapes
  221. % $peerAuth = 'login=' . $cache_user . ':' . $cache_passwd;
  222. % }
  223. cache_peer <% $cache_host %> parent <% $cache_port %> 0 no-query no-digest <% $peerAuth %>
  224. % }
  225.  
  226. % if ($urlRewriteProgram) {
  227. url_rewrite_program <% $urlRewriteProgram %>
  228. % }
  229.  
  230. <& .rulesACLs, rules => [ @objectsDelayPools ], realm => $realm &>
  231. acl_uses_indirect_client on
  232.  
  233. # no cache domains acl
  234. % foreach my $domain (@notCachedDomains) {
  235. acl noCached dstdomain <% $domain %>
  236. % }
  237.  
  238.  
  239. acl from_localhost src 127.0.0.0/8 ::1
  240. acl to_localhost dst 127.0.0.0/8 ::1
  241. acl manager url_regex -i ^cache_object:// +i ^https?://[^/]+/squid-internal-mgr/
  242. acl SSL_ports port 443 # https, snews
  243. acl SSL_ports port 873 # rsync
  244. acl Safe_ports port 80 # http
  245. acl Safe_ports port 21 # ftp
  246. acl Safe_ports port 443 563 # https, snews
  247. acl Safe_ports port 70 # gopher
  248. acl Safe_ports port 210 # wais
  249. acl Safe_ports port 1025-65535 # unregistered ports
  250. acl Safe_ports port 280 # http-mgmt
  251. acl Safe_ports port 488 # gss-http
  252. acl Safe_ports port 591 # filemaker
  253. acl Safe_ports port 631 # cups
  254. acl Safe_ports port 777 # multiling http
  255. acl Safe_ports port 873 # rsync
  256. acl Safe_ports port 901 # SWAT
  257.  
  258. acl CONNECT method CONNECT
  259. acl purge method PURGE
  260.  
  261.  
  262. follow_x_forwarded_for allow from_localhost
  263. log_uses_indirect_client on
  264.  
  265. http_access allow manager to_localhost
  266.  
  267. http_access deny manager
  268. http_access deny purge
  269. #http_access deny !Safe_ports
  270.  
  271. #http_access deny CONNECT !SSL_ports
  272. http_access allow from_localhost
  273.  
  274. # we use firewall to deny clients from the outside
  275. http_access allow all
  276. % if ($cache_host and $cache_port) {
  277. never_direct allow all
  278. % }
  279.  
  280. <& .delayPools, objectsDelayPools => \@objectsDelayPools &>
  281.  
  282. % if ( $snmpEnabled ) {
  283. <& .snmp &>
  284. % }
  285.  
  286. always_direct allow to_localhost
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement