### /etc/squid3/squid.conf Configuration File ###

### provide basic authentication via ldap for clients not autheticated via kerberos/ntlm
auth_param basic program /usr/lib/squid3/basic_ldap_auth -R -b "dc=ihcrc,dc=org" -D squid@ihcrc.org -W /etc/squid3/ldappass.txt -f sAMAccountName=%s -h srv-dataserver2.ihcrc.org
auth_param basic children 10
auth_param basic realm Internet Proxy
auth_param basic credentialsttl 1 minute

### ldap authorization
external_acl_type memberof %LOGIN /usr/lib/squid3/ext_ldap_group_acl -R-K-S-b "dc=ihcrc,dc=org" -D squid@ihcrc.org -W /etc/squid3/ldappass.txt -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=%g,ou=INFORMATION_SYSTEMS,dc=ihcrc,dc=org))" -h srv-dataserver2.ihcrc.org

### acl for proxy auth and ldap authorizations
acl auth proxy_auth REQUIRED
#   aclname             acltype  typename activediretorygroup
acl AllIHCRC		external memberof "/etc/squid3/AllIHCRC.txt"
acl allowedsites	dstdomain "/etc/squid3/allowedsites.txt"

### squid defaults
acl localhost src
acl to_localhost dst
acl INSIDE dstdomain .ihcrc.org
always_direct allow INSIDE
never_direct allow all
acl SSL_ports port 443
acl safe_ports port 80		# http
acl safe_ports port 21		# ftp
acl safe_ports port 443		# https
acl safe_ports port 70		# gopher
acl safe_ports port 210		# wais
acl safe_ports port 1025-65535	# unregistered ports
acl safe_ports port 280		# http-mgmt
acl safe_ports port 488		# gss-http
acl safe_ports port 591		# filemaker
acl safe_ports port 777		# multiling http
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow manager localhost
http_access deny manager

### enforce authentication
http_access allow allowedsites
http_access allow AllIHCRC auth
http_access allow localhost
http_access deny all

### logging
access_log /var/log/squid3/access.log

### squid Debian defaults
http_port 3128
hierarchy_stoplist cgi-bin ?
coredump_dir /var/spool/squid3
refresh_pattern ^ftp:		1440	20%	10080
refresh_pattern ^gopher:	1440	0%	1440
refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
refresh_pattern .		0	20%	4320

request_header_access Allow allow all
request_header_access Authorization allow all
request_header_access Proxy-Authorization allow all
request_header_access Proxy-Authenticate allow all
request_header_access Cache-Control allow all
request_header_access Content-Encoding allow all
request_header_access Content-Length allow all
request_header_access Content-Type allow all
request_header_access Date allow all
request_header_access Expires allow all
request_header_access Host allow all
request_header_access If-Modified-Since allow all
request_header_access Last-Modified allow all
request_header_access Location allow all
request_header_access Pragma allow all
request_header_access Accept allow all
request_header_access Accept-Charset allow all
request_header_access Accept-Encoding allow all
request_header_access Accept-Language allow all
request_header_access Content-Language allow all
request_header_access Mime-Version allow all
request_header_access Retry-After allow all
request_header_access Title allow all
request_header_access Connection allow all
request_header_access Proxy-Connection allow all
request_header_access User-Agent allow all
request_header_access Cookie allow all
request_header_access All deny all
