Administrace komentářů

Nefunguje na Lennym přístup na HTTPS servery na internetu, nelze se tedy přihlásit do seznam a centrum e-mailu, do internetových bankovnictví, všude tam, kde se používá HTTPS (443). Prostě z vnitřní sítě nelze na HTTPS přijít, z proxy serveru se na https dostane. Co se týká firewallu, port 443 je z vnitrni site povolen. Prikladam jeho squid.conf:

http_port 3128 transparent

hierarchy_stoplist cgi-bin ?

acl QUERY urlpath_regex cgi-bin \?

#cache_dir diskd /var/spool/squid 100 16 256

cache_store_log none

auth_param basic children 5

auth_param basic realm Squid proxy-caching web server

auth_param basic credentialsttl 2 hours

refresh_pattern ^ftp: 1440 20% 10080

refresh_pattern ^gopher: 1440 0% 1440

refresh_pattern . 0 20% 4320

half_closed_clients off

acl all src 0.0.0.0/0.0.0.0

acl wifistudent src 172.22.254.0/255.255.255.200

delay_pools 1

delay_class 1 1

delay_access 1 allow wifistudent

delay_parameters 1 64000/64000

acl manager proto cache_object

acl localhost src 127.0.0.1/255.255.255.255

acl to_localhost dst 127.0.0.0/8

acl SSL_ports port 443 563

acl Safe_ports port 80 # http

acl Safe_ports port 21 # ftp

acl Safe_ports port 443 563 # https, snews

acl Safe_ports port 70 # gopher

acl Safe_ports port 210 # wais

acl Safe_ports port 1025-65535 # unregistered ports

acl Safe_ports port 280 # http-mgmt

acl Safe_ports port 488 # gss-http

acl Safe_ports port 591 # filemaker

acl Safe_ports port 777 # multiling http

acl CONNECT method CONNECT

http_access allow manager localhost

http_access deny manager

http_access deny !Safe_ports

http_access deny CONNECT !SSL_ports

http_access deny to_localhost

acl mynetwork src 172.22.0.0/255.255.0.0

no_cache deny QUERY all

http_access allow mynetwork

http_access allow localhost

http_reply_access allow all

icp_access allow all

visible_hostname firewall

append_domain .vasweb.cz

err_html_text roman@gfpvm.cz

error_directory /usr/share/squid/errors/Czech

deny_info ERR_ACCESS_DENIED all

#memory_pools off

coredump_dir /var/spool/squid

ie_refresh on

vary_ignore_expire on

#httpd_accel_single_host off

forwarded_for off

#redirect_program /usr/bin/squidGuard -c /etc/squid/squidGuard.conf

cache_effective_user proxy

cache_effective_group proxy

access_log none

read_timeout 30 second

log_fqdn on