Re: [squid-users] Squid cache youtube and other websites

2015-05-25 Thread Reet Vyas
Hi Yuri, Thanks for nice info. As I mentioned I have only tplink TL-R470T router and machine with configuration of Cent OS 6 HDD 1 TB RAM 32 GB So Is this possible with above router or do I have to change my router for same. I can do this using IPtables only On Mon, May 25, 2015 at 4:57 PM, Yu

Re: [squid-users] (no subject)

2015-05-25 Thread Antony Stone
On Monday 25 May 2015 at 21:50:12 (EU time), S Sarath kumar wrote: > Hi, > > below mentioned rules only applied > > acl Streaming rep_mime_type video/flv video/x-flv > acl mynetwork src 10.108.20.0/24 > > http_reply_access deny mynetwork Streaming > http_access allow mynetwork 1. Please reply

Re: [squid-users] (no subject)

2015-05-25 Thread Antony Stone
On Monday 25 May 2015 at 21:20:16 (EU time), S Sarath kumar wrote: > hi i have been using squid3 on ubuntu 14.04. > i want to block the stream content in my lan. > hence i written a acl like below. > this acl at the top. Please post the entire squid.conf (excluding blank lines / comments). That

[squid-users] (no subject)

2015-05-25 Thread S Sarath kumar
hi i have been using squid3 on ubuntu 14.04. i want to block the stream content in my lan. hence i written a acl like below. this acl at the top. but still it's not blocking. anybody help me ? acl Streaming rep_mime_type video/x-flv http_reply_access deny mynetwork Streaming Regards, Sarath ku

Re: [squid-users] Ssl-bump deep dive (self-signed certs in chain)

2015-05-25 Thread Yuri Voinov
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Ah, misunderstand. Error you got means that target server certificate's CA is not visible by Squid. Or for client. Huh. :) I had thought that Squid suddenly turned into a hackware :))) 25.05.15 22:26, James Lay пишет: > So following advi

Re: [squid-users] Ssl-bump deep dive (self-signed certs in chain)

2015-05-25 Thread Yuri Voinov
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hm. Interesting. You want to say, you uses ordinal server certificate, signed with external trusted CA? And users can't see MiTM? 25.05.15 22:26, James Lay пишет: > So following advice and instructions on this page: > > http://wiki.squid-cache.o

Re: [squid-users] [PATCH] SSL: Add suport for EECDH and disable client-initiated renegotiation

2015-05-25 Thread Paulo Matias
Hi Amos, On 25-05-2015 10:46, Amos Jeffries wrote: > Could you subscribe then please and post it (or the updated version > after below). This has effects that I'd like our SSL devs to double check. Thank you for your thorough review. I will prepare the updated version and post to the squid-dev ma

[squid-users] Ssl-bump deep dive (self-signed certs in chain)

2015-05-25 Thread James Lay
So following advice and instructions on this page: http://wiki.squid-cache.org/Features/DynamicSslCert I have set up my lab with explicit proxy by exporting http_proxy and https_proxy. After creating the self-signed root CA certificate above and creating the .der file for the client, here are my

Re: [squid-users] [PATCH] SSL: Add suport for EECDH and disable client-initiated renegotiation

2015-05-25 Thread Amos Jeffries
On 25/05/2015 11:30 p.m., Paulo Matias wrote: > Hi, > > Sorry for getting this sent to squid-users instead of the adequate > mailing list for patches (squid-dev). We have tried to send the > patch to squid-dev without a subscription (as recommended in > http://www.squid-cache.org/Support/mailing-l

[squid-users] [PATCH] SSL: Add suport for EECDH and disable client-initiated renegotiation

2015-05-25 Thread Paulo Matias
Hi, Sorry for getting this sent to squid-users instead of the adequate mailing list for patches (squid-dev). We have tried to send the patch to squid-dev without a subscription (as recommended in http://www.squid-cache.org/Support/mailing-lists.html#squid-dev), but perhaps the message did not get

Re: [squid-users] Squid cache youtube and other websites

2015-05-25 Thread Yuri Voinov
Look, Ma. ;) I'm a LumberJack :)) http://i.imgur.com/NGn6Ao4.png http://i.imgur.com/Uz0zXut.png Note, that Youtube now uses QUIC protocol (especially in Chrome), which cannot be processed by Squid ever. To cache Youtube, you must solve two tasks: 1. Completely force clients use HTTP/HTTPS

Re: [squid-users] Alternative ways of tracking users on unauthenticated proxy

2015-05-25 Thread Amos Jeffries
On 25/05/2015 8:38 p.m., Mr J Potter wrote: > Hi all, > > I'm setting up a system for using iPads in our school, and I'm stuck a bit > on tracking what the students are doing on them. > > First up, I reaaly don't want a Pop-up login box from a 407 response from a > proxy server, so I'm looking fo

Re: [squid-users] Ssl-bump deep dive (properly creating certs)

2015-05-25 Thread Amos Jeffries
On 25/05/2015 8:48 a.m., Jason Haar wrote: > On 25/05/15 04:25, James Lay wrote: >> My first question is about properly creating the certs. Looking at: >> >> http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit >> >> this mentions using crtd, but as I understand it, crtd isn't supp

Re: [squid-users] Alternative ways of tracking users on unauthenticated proxy

2015-05-25 Thread James Harper
> > Hi all, > > > I'm setting up a system for using iPads in our school, and I'm stuck a bit on > tracking what the students are doing on them. > > > First up, I reaaly don't want a Pop-up login box from a 407 response from a > proxy server, so I'm looking for some other way to track who is do

Re: [squid-users] squid Ldap problem

2015-05-25 Thread Amos Jeffries
On 24/05/2015 10:19 p.m., snakeeyes wrote: > Hi I have squid 3.5 with LDAP on liux server openldap > > > echo "user1" "123456" | /lib/squid/basic_ldap_auth -P -R -b "dc=abc,dc=com" > -D "cn=ldapadmin,dc=abc,dc=com" -w "123456" -f sAMAccountName=%s -h > 192.168.100.1 > > basic_ldap_auth: WARNI

[squid-users] Alternative ways of tracking users on unauthenticated proxy

2015-05-25 Thread Mr J Potter
Hi all, I'm setting up a system for using iPads in our school, and I'm stuck a bit on tracking what the students are doing on them. First up, I reaaly don't want a Pop-up login box from a 407 response from a proxy server, so I'm looking for some other way to track who is doing what. What i have

Re: [squid-users] Squid cache youtube and other websites

2015-05-25 Thread Reet Vyas
Hi Thanks Dan for info. I searched google about LUSCA and scripts available but I don't think it is working now. On Mon, May 25, 2015 at 12:21 PM, wrote: > Firstly, I think the biggest roadblocks you’re going to hit with caching > YouTube are: > > 1) It’s all encrypted now (thanks Google). Sq