Am Freitag 19 Oktober 2007 schrieb José L. Redrejo Rodríguez: > acl no_ie browser MSIE > http_access deny no_ie > #allowing windowsupdate with ie: > acl windowsupdate dstdomain .windowsupdate.com > acl windowsupdate dstdomain .microsoft.com > acl windowsupdate dstdomain .public-trust.com > acl windowsupdate dstdomain .windows.com > acl windowsupdate dstdomain .webiqonline.com > acl windowsupdate dstdomain 207.46.224.158 > acl windowsupdate dstdomain .msn.com > always_direct allow windowsupdate > http_access allow windowsupdate
Thanks José, following your suggestion, I am glad to report successful implementation. Two additional things: - I added a dedicated error page explaining the danger of IE (and linking to http://www.webdevout.net/ie-is-dangerous) - I added a allow rule for opera: > acl opera browser Opera > http_access allow opera Note, that the allow rule needs to be after blacklist, otherwise Opera users could surf all the web. In the same turn I may suggest adding this default rules to our default configuration: acl schoolnet src 10.0.2.0/255.255.254.0 acl ltspnet src 192.168.0.0/255.255.255.0 acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl SSL_ports port 443 563 acl SSL_ports port 873 acl Safe_ports port 80,8080 acl Safe_ports port 21 acl Safe_ports port 443 563 acl Safe_ports port 70 acl Safe_ports port 210 acl Safe_ports port 1025-65535 acl Safe_ports port 280 acl Safe_ports port 488 acl Safe_ports port 591 acl Safe_ports port 777 acl Safe_ports port 631 acl Safe_ports port 873 acl Safe_ports port 901 acl purge method PURGE acl CONNECT method CONNECT acl blacklist url_regex "/etc/squid/blacklist" acl whitelist url_regex "/etc/squid/whitelist" acl ltspserver00 src 10.0.2.10-10.0.2.10/255.255.255.255 acl tjener srcdomain tjener intern acl lockedhosts src "/etc/squid/lockedhosts" acl openhosts src "7etc/squid/openhosts" acl no_ie browser MSIE acl opera browser Opera http_access allow manager localhost http_access deny manager http_access allow purge localhost http_access deny purge http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow whitelist http_access deny blacklist http_access deny lockedhosts http_access allow opera http_access deny no_ie http_access allow tjener http_access allow schoolnet http_access allow ltspnet http_access allow localhost http_access deny all http_reply_access allow all icp_access allow all cachemgr_passwd mySecret all error_directory /usr/share/squid/errors/English coredump_dir /var/spool/squid deny_info no_ie.html no_ie ------ some files that are used here should be delivered empty or with sample entries. This can help users to find a start. Kind regards Ralf
