Re: [squid-users] peek and splice content inspection question

2015-08-23 Thread wmunny william
> Looking for one single thing that does everything DG or e2guardian do, > or wraps them completely is the wrong approach. They are almost > full-blown proxies like Squid. > > The *CAP design is to leave all the transfer proxying and caching duties > to software like Squid and only perform the ac

Re: [squid-users] peek and splice content inspection question

2015-08-23 Thread Amos Jeffries
On 23/08/2015 10:36 p.m., wmunny william wrote: > >>> Sorry to jump on a late thread - it is also possible to use ICAP/eCAP >>> server to filter the actual contents of the stream. >>> >>> C-ICAP comes to mind first, then eCap samples from >>> http://www.e-cap.org/Downloads >>> >> >> And the *CAP

Re: [squid-users] peek and splice content inspection question

2015-08-23 Thread wmunny william
> > Sorry to jump on a late thread - it is also possible to use ICAP/eCAP > > server to filter the actual contents of the stream. > > > > C-ICAP comes to mind first, then eCap samples from > > http://www.e-cap.org/Downloads > > > > And the *CAP services is a better solution than either URL-re

Re: [squid-users] peek and splice content inspection question

2015-08-18 Thread Amos Jeffries
On 19/08/2015 12:44 a.m., Rafael Akchurin wrote: > Hello Stanford and the list, > > > Sorry to jump on a late thread - it is also possible to use ICAP/eCAP server > to filter the actual contents of the stream. > > C-ICAP comes to mind first, then eCap samples from > http://www.e-cap.org/Downlo

Re: [squid-users] peek and splice content inspection question

2015-08-18 Thread Rafael Akchurin
From: squid-users on behalf of Stanford Prescott Sent: Monday, August 17, 2015 1:04 AM To: Yuri Voinov Cc: squid-users Subject: Re: [squid-users] peek and splice content inspection question Yes, really. ufdbGuard, like squidGuard before it, is a URL Filter that filters known unwanted URLs. A

Re: [squid-users] peek and splice content inspection question

2015-08-18 Thread FredB
At least with squidguard you can't check the content (cookies, keywords in html, bad words, etc) It's "just" an URL/domains filter, but it can also block some objets contain in the request, eg http://foo.com/test.mp3, but it can't deny some kind of browsers or header informations. Maybe ufdbgu

Re: [squid-users] peek and splice content inspection question

2015-08-18 Thread FredB
At least with squidguard you can't check the content (cookies, keywords in html, bad words, etc) It's "just" an URL/domains filter, but it can also block some objets contain in the request, eg http://foo.com/test.mp3, but it can't deny some kind of browsers or header informations. Maybe ufdbgu

Re: [squid-users] peek and splice content inspection question

2015-08-17 Thread Yuri Voinov
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Either SquidGuard, or ufdbGuard has this functional onto blocking page. Just configure it. 17.08.15 5:04, Stanford Prescott пишет: > Yes, really. ufdbGuard, like squidGuard before it, is a URL Filter that > filters known unwanted URLs. A content f

Re: [squid-users] peek and splice content inspection question

2015-08-17 Thread Marko Cupać
On Sun, 16 Aug 2015 10:27:03 -0400 Stanford Prescott wrote: > FYI, E2Guardian has replaced the DansGuardian project and is > currently well maintained. E2Guardian can do content filtering for > SSL but only in explicit mode, It currently does not support > intercept (transparent) mode for SSLBump

Re: [squid-users] peek and splice content inspection question

2015-08-16 Thread Stanford Prescott
Yes, really. ufdbGuard, like squidGuard before it, is a URL Filter that filters known unwanted URLs. A content filter, like DansGuardian and E2Guardian are content filters which examine the content of web pages looking for unwanted things. On Sun, Aug 16, 2015 at 6:10 PM, Yuri Voinov wrote: > >

Re: [squid-users] peek and splice content inspection question

2015-08-16 Thread Yuri Voinov
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 O, really? 17.08.15 4:03, Stanford Prescott пишет: > ufdbGuard is not a content filter. > > On Sun, Aug 16, 2015 at 4:07 PM, Yuri Voinov wrote: > >> > ufdbguard does. > > 16.08.15 20:27, Stanford Prescott пишет: > > >>> I have SquidClamAV impleme

Re: [squid-users] peek and splice content inspection question

2015-08-16 Thread Stanford Prescott
ufdbGuard is not a content filter. On Sun, Aug 16, 2015 at 4:07 PM, Yuri Voinov wrote: > > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > ufdbguard does. > > 16.08.15 20:27, Stanford Prescott пишет: > > > I have SquidClamAV implemented with the Smoothwall Express 3.1 firewall. > It > > wo

Re: [squid-users] peek and splice content inspection question

2015-08-16 Thread Yuri Voinov
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 ufdbguard does. 16.08.15 20:27, Stanford Prescott пишет: > I have SquidClamAV implemented with the Smoothwall Express 3.1 firewall. It > works well and fast with ssl-bump, although the majority of our users only > have relatively small networks wi

Re: [squid-users] peek and splice content inspection question

2015-08-16 Thread Stanford Prescott
I have SquidClamAV implemented with the Smoothwall Express 3.1 firewall. It works well and fast with ssl-bump, although the majority of our users only have relatively small networks with smaller loads. FYI, E2Guardian has replaced the DansGuardian project and is currently well maintained. E2Guardi

Re: [squid-users] peek and splice content inspection question

2015-08-14 Thread Alex Rousskov
On 08/13/2015 10:31 PM, Amos Jeffries wrote: > AFAICS it > is the backend AV library only scanning disk objects that causes the > whole issue. Otherwise the eCAP could be much, much faster. The situation is more nuanced: eCAP supports asynchronous adapters. It is possible to write a ClamAV adapter

Re: [squid-users] peek and splice content inspection question

2015-08-13 Thread Amos Jeffries
On 14/08/2015 9:15 a.m., Yuri Voinov wrote: > > > > 14.08.15 2:56, Alex Rousskov пишет: >> On 08/13/2015 09:38 AM, Amos Jeffries wrote: >>> On 14/08/2015 12:47 a.m., Marko Cupać wrote: Is it possible - by means of squid's peek and splice feature - to inspect file extensions and mime ty

Re: [squid-users] peek and splice content inspection question

2015-08-13 Thread Yuri Voinov
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 14.08.15 2:56, Alex Rousskov пишет: > On 08/13/2015 09:38 AM, Amos Jeffries wrote: >> On 14/08/2015 12:47 a.m., Marko Cupać wrote: >>> Is it possible - by means of squid's peek and splice feature - to >>> inspect file extensions and mime types of

Re: [squid-users] peek and splice content inspection question

2015-08-13 Thread Alex Rousskov
On 08/13/2015 09:38 AM, Amos Jeffries wrote: > On 14/08/2015 12:47 a.m., Marko Cupać wrote: >> Is it possible - by means of squid's peek and splice feature - to >> inspect file extensions and mime types of https traffic? Can bumped >> https traffic be forwarded to icap (squidclamav) for AV scanning

Re: [squid-users] peek and splice content inspection question

2015-08-13 Thread Yuri Voinov
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 14.08.15 2:02, Marko Cupać пишет: > On Fri, 14 Aug 2015 03:38:47 +1200 > Amos Jeffries wrote: > >> On 14/08/2015 12:47 a.m., Marko Cupać wrote: >>> Hi, >>> >>> a few years ago I had a working setup of squid + dansguardian which >>> was giving me

Re: [squid-users] peek and splice content inspection question

2015-08-13 Thread Marko Cupać
On Fri, 14 Aug 2015 03:38:47 +1200 Amos Jeffries wrote: > On 14/08/2015 12:47 a.m., Marko Cupać wrote: > > Hi, > > > > a few years ago I had a working setup of squid + dansguardian which > > was giving me ability to inspect traffic and filter it according to > > various criteria, mainly extensio

Re: [squid-users] peek and splice content inspection question

2015-08-13 Thread Amos Jeffries
On 14/08/2015 12:47 a.m., Marko Cupać wrote: > Hi, > > a few years ago I had a working setup of squid + dansguardian which was > giving me ability to inspect traffic and filter it according to various > criteria, mainly extensions, mime types and presence of malicious code > (clamav). > > Lately