WELCOME TO SQUID 2.6.STABLE12 # ---------------------------- # # This is the default Squid configuration file. You may wish # to look at the Squid home page (http://www.squid-cache.org/) # for the FAQ and other documentation. # # The default Squid config file shows what the defaults for # various options happen to be. If you don't need to change the # default, you shouldn't uncomment the line. Doing so may cause # run-time problems. In some cases "none" refers to no default # setting at all, while in other cases it refers to a valid # option - the comments for that keyword indicate if this is the # case. # # NETWORK OPTIONS # ----------------------------------------------------------------------------- # TAG: http_port # Usage: port [options] # hostname:port [options] # 1.2.3.4:port [options] # # The socket addresses where Squid will listen for HTTP client # requests. You may specify multiple socket addresses. # There are three forms: port alone, hostname with port, and # IP address with port. If you specify a hostname or IP # address, Squid binds the socket to that specific # address. This replaces the old 'tcp_incoming_address' # option. Most likely, you do not need to bind to a specific # address, so you can use the port number alone. # # The default port number is 3128. # # If you are running Squid in accelerator mode, you # probably want to listen on port 80 also, or instead. # # The -a command line option will override the *first* port # number listed here. That option will NOT override an IP # address, however. You may specify multiple socket addresses on multiple lines. # # options are: # # transparent Support for transparent interception of # outgoing requests without browser settings # # accel Accelerator mode. Also needs at least one # of vhost/vport/defaultsite. # # defaultsite= Main web site name for accelerators. Implies # accel. # # vhost Accelerator using the Host header for # virtual domain support. Implies accel. # # vport Accelerator with IP based virtual host support. # Implies accel. # # vport= As above, but uses specified port number # rather than the http_port number. Implies accel. # # urlgroup= Default urlgroup to mark requests # with (see also acl urlgroup and # url_rewrite_program) # # protocol= Protocol to reconstruct accelerated # requests with. Defaults to http. # # no-connection-auth # Prevent forwarding of Microsoft # connection oriented authentication # (NTLM, Negotiate and Kerberos) # # tproxy Support Linux TPROXY for spoofing # outgoing connections using the client # IP address. # # If you run Squid on a dual-homed machine with an internal # and an external interface we recommend you to specify the # internal address:port in http_port. This way Squid will only be # visible on the internal address. # Squid normally listens to port 3128 http_port 8080 transparent # TAG: https_port # Note: This option is only available if Squid is rebuilt with the # --enable-ssl option # # Usage: [ip:]port cert=certificate.pem [key=key.pem] [options...] # # The socket address where Squid will listen for HTTPS client # requests. # # This is really only useful for situations where you are running # squid in accelerator mode and you want to do the SSL work at the # accelerator level. # # You may specify multiple socket addresses on multiple lines, # each with their own SSL certificate and/or options. # # Options: # # accel Accelerator mode. Also needs at least one of # defaultsite or vhost. # # defaultsite= The name of the https site presented on # this port. Implies accel. # # vhost Domain based virtual host support. Useful # in combination with a wildcard certificate or # other certificates valid for more than one domain. # Implies accel. # # urlgroup= Default urlgroup to mark requests with (see # also acl urlgroup and url_rewrite_program) # # protocol= Protocol to reconstruct accelerated requests # with. Defaults to https. # # cert= Path to SSL certificate (PEM format) # # key= Path to SSL private key file (PEM format) assumed to be a combined certificate and # key file # # version= The version of SSL/TLS supported # 1 automatic (default) # 2 SSLv2 only # 3 SSLv3 only # 4 TLSv1 only # # cipher= Colon separated list of supported ciphers # # options= Various SSL engine options. The most important # being: # NO_SSLv2 Disallow the use of SSLv2 # NO_SSLv3 Disallow the use of SSLv3 # NO_TLSv1 Disallow the use of TLSv1 # SINGLE_DH_USE Always create a new key when using # temporary/ephemeral DH key exchanges # See src/ssl_support.c or OpenSSL SSL_CTX_set_options # documentation for a complete list of options. # # clientca= File containing the list of CAs to use when # requesting a client certificate # # cafile= File containing additional CA certificates to # use when verifying client certificates. If unset # clientca will be used. # # capath= Directory containing additional CA certificates # and CRL lists to use when verifying client certificates # # crlfile= File of additional CRL lists to use when verifying # the client certificate, in addition to CRLs stored in # the capath. Implies VERIFY_CRL flag below. # # dhparams= File containing DH parameters for temporary/ephemeral # DH key exchanges # # sslflags= Various flags modifying the use of SSL: # DELAYED_AUTH # Don't request client certificates # immediately, but wait until acl processing # requires a certificate (not yet implemented) #Default: # none # TAG: ssl_unclean_shutdown # Note: This option is only available if Squid is rebuilt with the # --enable-ssl option # # Some browsers (especially MSIE) bugs out on SSL shutdown # messages. # #Default: # ssl_unclean_shutdown off # TAG: ssl_engine # Note: This option is only available if Squid is rebuilt with the # --enable-ssl option # # The OpenSSL engine to use. You will need to set this if you # would like to use hardware SSL acceleration for example. # #Default: # none # TAG: sslproxy_client_certificate # Note: This option is only available if Squid is rebuilt with the # --enable-ssl option #Default: # none # TAG: sslproxy_client_key # Note: This option is only available if Squid is rebuilt with the # --enable-ssl option # # Client SSL Key to use when proxying https:// URLs # #Default: # none # TAG: sslproxy_version # Note: This option is only available if Squid is rebuilt with the # --enable-ssl option # # SSL version level to use when proxying https:// URLs # #Default: # sslproxy_version 1 # TAG: sslproxy_options # Note: This option is only available if Squid is rebuilt with the # --enable-ssl option # # SSL engine options to use when proxying https:// URLs # #Default: # none # TAG: sslproxy_cipher # Note: This option is only available if Squid is rebuilt with the # --enable-ssl option # # SSL cipher list to use when proxying https:// URLs # #Default: # none # TAG: sslproxy_cafile # Note: This option is only available if Squid is rebuilt with the #Default: cache_mem 8 MB # TAG: cache_swap_low (percent, 0-100) # TAG: cache_swap_high (percent, 0-100) # # The low- and high-water marks for cache object replacement. # Replacement begins when the swap (disk) usage is above the # low-water mark and attempts to maintain utilization near the # low-water mark. As swap utilization gets close to high-water # mark object eviction becomes more aggressive. If utilization is # close to the low-water mark less replacement is done each time. # # Defaults are 90% and 95%. If you have a large cache, 5% could be # hundreds of MB. If this is the case you may wish to set these # numbers closer together. # #Default: cache_swap_low 90 cache_swap_high 95 #Default: cache_dir ufs /usr/local/squid/var/cache 100 16 256 # To log the request via syslog specify a filepath of "syslog" access_log /usr/local/squid/var/logs/access.log squid #Default: cache_log /usr/local/squid/var/logs/cache.log #Default: cache_store_log /usr/local/squid/var/logs/store.log #Default: # http_access deny all # #Recommended minimum configuration: # # Only allow cachemgr access from localhost http_access allow manager localhost http_access deny manager # Deny requests to unknown ports http_access deny !Safe_ports # Deny CONNECT to other than SSL ports http_access deny CONNECT !SSL_ports # # We strongly recommend the following be uncommented to protect innocent # web applications running on the proxy server who think the only # one who can access services on "localhost" is a local user #http_access deny to_localhost # # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS # Example rule allowing access from your local networks. Adapt # to list your (internal) IP networks from where browsing should # be allowed #acl our_networks src 192.168.1.0/24 192.168.2.0/24 #http_access allow our_networks # And finally deny all other access to this proxy http_access allow all # if not specified, the certificate file is