# Recommended minimum configuration:
auth_param negotiate program /usr/lib64/squid/negotiate_kerberos_auth -d -s HTTP/squid.ax.loc
auth_param negotiate children 20 startup=0 idle=1
auth_param negotiate keep_alive off
acl auth proxy_auth REQUIRED
external_acl_type squid_deny ttl=300 negative_ttl=60 %LOGIN /usr/lib64/squid/ext_kerberos_ldap_group_acl -a -g squid_deny -D INTERFACE31.LAB
external_acl_type squid_allow ttl=300 negative_ttl=60 %LOGIN /usr/lib64/squid/ext_kerberos_ldap_group_acl -a -g squid_allow -D INTERFACE31.LAB
acl squid_deny external squid_deny
acl squid_allow external squid_allow
acl blacklist url_regex -i "/etc/squid/blacklist"

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
#acl localnet src 10.0.0.0/8<--># RFC1918 possible internal network
#acl localnet src 172.16.0.0/12># RFC1918 possible internal network
#acl localnet src 192.168.0.0/16<------># RFC1918 possible internal network
#acl localnet src fc00::/7       # RFC 4193 local private network range
#acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines
acl ax.loc src 192.168.0.0/24



acl SSL_ports port 443
acl Safe_ports port 80<><------># http
acl Safe_ports port 21<><------># ftp
acl Safe_ports port 443><------># https
acl Safe_ports port 70<><------># gopher
acl Safe_ports port 210><------># wais
acl Safe_ports port 1025-65535<># unregistered ports
acl Safe_ports port 280><------># http-mgmt
acl Safe_ports port 488><------># gss-http
acl Safe_ports port 591><------># filemaker
acl Safe_ports port 777><------># multiling http
acl CONNECT method CONNECT

#
# Recommended minimum Access Permission configuration:
#
# Deny requests to certain unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
#http_access allow localnet
#http_access allow localhost
http_access allow squid_allow
http_access deny squid_deny
http_access allow squid_allow
#http_access deny blacklist squid_deny
http_access deny all
#http_access allow auth

# And finally deny all other access to this proxy
#http_access deny all

# Squid normally listens to port 3128
http_port 3128

# Uncomment and adjust the following to add a disk cache directory.
cache_dir ufs /var/spool/squid 100 16 256

# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid

#
# Add any of your own refresh_pattern entries above these.
#
refresh_pattern ^ftp:<-><------>1440<-->20%<--->10080
refresh_pattern ^gopher:<------>1440<-->0%<---->1440
refresh_pattern -i (/cgi-bin/|\?) 0<--->0%<---->0
refresh_pattern .<-----><------>0<----->20%<--->4320