####### kerberos authentication
auth_param negotiate program /usr/lib/squid3/squid_kerb_auth -d -s HTTP/1cserver.pharmlider.local
auth_param negotiate children 10
auth_param negotiate keep_alive on

####### provide access via ldap for clients not authenticated via kerberos
auth_param basic program /usr/lib/squid3/squid_ldap_auth -R \
        -b "dc=pharmlider,dc=local" \
        -D samba@pharmlider.local \
        -w "Ujkjktl200" \
        -f sAMAccountName=%s \
        -h taraz.pharmlider.local
auth_param basic children 10
auth_param basic realm Internet Proxy
auth_param basic credentialsttl 1 minute

####### ldap authorizations
# restricted proxy access logged
external_acl_type internet_users %LOGIN /usr/lib/squid3/squid_ldap_group -R -K \
        -b "dc=pharmlider,dc=local" \
        -D samba@pharmlider.local \
        -w "Ujkjktl200" \
        -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=Internet Users,ou=Security Grou$
        -h taraz.pharmlider.local
# full proxy access no logging
external_acl_type internet_users_full_nolog %LOGIN /usr/lib/squid3/squid_ldap_group -R -K \
        -b "dc=pharmlider,dc=local" \
        -D samba@pharmlider.local \
        -w "Ujkjktl200" \
        -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=Internet Users Full NoLog,ou=Se$
        -h taraz.pharmlider.local
# full proxy access logged
external_acl_type internet_users_full_log %LOGIN /usr/lib/squid3/squid_ldap_group -R -K \
        -b "pharmlider,dc=local" \
        -D samba@pharmlider.local \
        -w "Ujkjktl200" \
        -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=Internet Users Full,ou=Security$
        -h taraz.pharmlider.local

####### acl for proxy auth and ldap authorizations
acl auth proxy_auth REQUIRED
# format "acl, aclname, acltype, acltypename, activedirectorygroup"
acl RestrictedAccessLog external internet_users Internet\ Users
acl FullAccessNoLog external internet_users_full_nolog Internet\ Users\ Full\ NoLog
acl FullAccessLog external internet_users_full_log Internet\ Users\ Full
acl whitelistsites url_regex -i "/etc/squid3/whitelistsites.list"
acl blockedsites url_regex -i "/etc/squid3/blocklistsites.list"

####### squid defaults
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost

####### enforce auth: order of rules is important for authorization levels
no_cache deny whitelistsites
http_access allow whitelistsites
http_access allow FullAccessNoLog auth
http_access allow FullAccessLog auth
http_access deny blockedsites
http_access allow RestrictedAccessLog auth

####### logging
# don't log whitelistsites, FullAccessNoLog
access_log /var/log/squid3/access.log squid !whitelistsites !FullAccessNoLog

####### squid defaults
http_access deny all
http_port 192.168.11.4:3128
hierarchy_stoplist cgi-bin ?
coredump_dir /var/spool/squid3
refresh_pattern ^ftp:                   1440    20%     10080
refresh_pattern ^gopher:                1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?)       0       0%      0
refresh_pattern .                       0       20%     4320