### /etc/squid3/squid.conf Configuration File ###

## negotiate kerberos and ntlm authentication
auth_param negotiate program /usr/local/bin/negotiate_wrapper -d --ntlm /usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp --domain=IHCRC --kerberos /usr/lib/squid3/negotiate_kerberos_auth -d -s GSS_C_NO_NAME
auth_param negotiate children 10
auth_param negotiate keep_alive off

### pure ntlm authentication
auth_param ntlm program /usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp --domain=IHCRC
auth_param ntlm children 10
auth_param ntlm keep_alive off

### provide basic authentication via ldap for clients not autheticated via kerberos/ntlm
auth_param basic program /usr/lib/squid3/basic_ldap_auth -R -b "dc=ihcrc,dc=org" -D squid@ihcrc.org -W /etc/squid3/ldappass.txt -f sAMAccountName=%s -h srv-dataserver2.ihcrc.org
auth_param basic children 10
auth_param basic realm Internet Proxy
auth_param basic credentialsttl 1 minute

### acl for proxy auth and ldap authorizations
acl auth proxy_auth REQUIRED
acl INSIDE dstdomain .ihcrc.org
always_direct allow INSIDE
never_direct allow all

### squid defaults
acl localhost src
acl to_localhost dst
acl INSIDE dstdomain .ihcrc.org
always_direct allow INSIDE
never_direct allow all
acl SSL_ports port 443
acl safe_ports port 80		# http
acl safe_ports port 21		# ftp
acl safe_ports port 443		# https
acl safe_ports port 70		# gopher
acl safe_ports port 210		# wais
acl safe_ports port 1025-65535	# unregistered ports
acl safe_ports port 280		# http-mgmt
acl safe_ports port 488		# gss-http
acl safe_ports port 591		# filemaker
acl safe_ports port 777		# multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost

### enforce authentication
http_access deny !auth
http_access allow auth
http_access deny all

### squid Debian defaults
http_port 3128
hierarchy_stoplist cgi-bin ?
coredump_dir /var/spool/squid3
refresh_pattern ^ftp:		1440	20%	10080
refresh_pattern ^gopher:	1440	0%	1440
refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
refresh_pattern .		0	20%	4320
