####### Configuration File #######
####### cache manager
cache_mgr administrator@pharmlider.loc

####### kerberos authentication
auth_param negotiate program /usr/lib/squid3/squid_kerb_auth -d -s HTTP/appserver.pharmlider.loc
auth_param negotiate children 10
auth_param negotiate keep_alive on

####### provide access via ldap for clients not authenticated via kerberos
auth_param basic program /usr/lib/squid3/squid_ldap_auth -R \
    -b "dc=pharmlider,dc=loc" \
    -D administrator@pharmlider.loc \
    -w "p@ssw0rd" \
    -f sAMAccountName=%s \
    -h taraz.pharmlider.loc
auth_param basic children 10
auth_param basic realm Internet Proxy
auth_param basic credentialsttl 1 minute

####### ldap authorizations
# restricted proxy access logged
external_acl_type internet_users %LOGIN /usr/lib/squid3/squid_ldap_group -R -K \
    -b "dc=pharmlider,dc=loc" \
    -D administrator@pharmlider.loc \
    -w "p@ssw0rd" \
    -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=Internet Users log,ou=Security Groups,ou=Taraz Users,dc=pharmlider,dc=loc))" \
    -h taraz.pharmlider.loc
# full proxy access no logging
external_acl_type internet_users_full_nolog %LOGIN /usr/lib/squid3/squid_ldap_group -R -K \
    -b "dc=pharmlider,dc=loc" \
    -D administrator@pharmlider.loc \
    -w "p@ssw0rd" \
    -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=Internet Users Full nolog,ou=Security Groups,ou=Taraz Users,dc=pharmlider,dc=loc))" \
    -h taraz.pharmlider.loc
# full proxy access logged
external_acl_type internet_users_full_log %LOGIN /usr/lib/squid3/squid_ldap_group -R -K \
    -b "dc=pharmlider,dc=loc" \
    -D administrator@pharmlider.loc \
    -w "p@ssw0rd" \
    -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=Internet Users Full log,ou=Security Groups,ou=Taraz Users,dc=pharmlider,dc=loc))" \
    -h taraz.pharmlider.loc

####### acl for proxy auth and ldap authorizations
acl auth proxy_auth REQUIRED
# format "acl, aclname, acltype, acltypename, activedirectorygroup"
acl RestrictedAccessLog external internet_users Internet\ Users\ log
acl FullAccessNoLog external internet_users_full_nolog Internet\ Users\ Full\ nolog
acl FullAccessLog external internet_users_full_log Internet\ Users\ Full\ log
acl whitelistsites url_regex -i "/etc/squid3/whitelist.list"
acl blockedsites url_regex -i "/etc/squid3/blocklist.list"

####### squid defaults
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl SSL_ports port 443
acl Safe_ports port 80        # http
acl Safe_ports port 21        # ftp
acl Safe_ports port 443        # https
acl Safe_ports port 70        # gopher
acl Safe_ports port 210        # wais
acl Safe_ports port 1025-65535    # unregistered ports
acl Safe_ports port 280        # http-mgmt
acl Safe_ports port 488        # gss-http
acl Safe_ports port 591        # filemaker
acl Safe_ports port 777        # multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost

####### enforce auth: order of rules is important for authorization levels
no_cache deny whitelistsites
http_access allow whitelistsites
http_access allow FullAccessNoLog auth
http_access allow FullAccessLog auth
http_access deny blockedsites
http_access allow RestrictedAccessLog auth

####### logging
# don't log whitelistsites, FullAccessNoLog
access_log /var/log/squid3/access.log squid !whitelistsites !FullAccessNoLog

####### squid defaults
http_access deny all
http_port 3128
hierarchy_stoplist cgi-bin ?
coredump_dir /var/spool/squid3
refresh_pattern ^ftp:            1440    20%    10080
refresh_pattern ^gopher:        1440    0%    1440
refresh_pattern -i (/cgi-bin/|\?)    0    0%    0
refresh_pattern .            0    20%    4320