Re: [squid-users] squid-users Digest, Vol 27, Issue 28

2016-11-15 Thread Amos Jeffries
On 16/11/2016 1:28 p.m., vze2k...@verizon.net wrote: On 15/11/2016 9:05 a.m., Patrick Flaherty wrote: Hello, Can anyone tell me if the 'HIER_NONE' entries below is Squid not able to connect to www.website.com? The 21 sec timeout is a classic Windows TCP connection timeout. I just need

Re: [squid-users] is ACL conditional directive possible ?

2016-11-15 Thread Garri Djavadyan
On 2016-11-15 22:31, AUBERT Thibaud wrote: Hi Guys, Ok, QoS might help to control traffic on the internet access side, but it won't help between the source, client on a small remote office/output, and the proxy. It might also be difficult to split this traffic between what is intended to

Re: [squid-users] is ACL conditional directive possible ?

2016-11-15 Thread AUBERT Thibaud
Hi Guys, Ok, QoS might help to control traffic on the internet access side, but it won't help between the source, client on a small remote office/output, and the proxy. It might also be difficult to split this traffic between what is intended to internet or just internal. Example : 1Gb/sec

Re: [squid-users] Trusted CA Certificate with ssl_bump

2016-11-15 Thread Yuri Voinov
15.11.2016 22:28, Alex Crow пишет: > On 15/11/16 16:22, Yuri Voinov wrote: >> >>> You can if you have control over the clients, ie install your CA into >>> the browser/OS. >> ... and this can be illegal ;) >> > > YMMV (depending on where you live/work)! AFAIK Spying for users without they

Re: [squid-users] Trusted CA Certificate with ssl_bump

2016-11-15 Thread Alex Crow
On 15/11/16 16:22, Yuri Voinov wrote: You can if you have control over the clients, ie install your CA into the browser/OS. ... and this can be illegal ;) YMMV (depending on where you live/work)! -- This message is intended only for the addressee and may contain confidential information.

Re: [squid-users] Trusted CA Certificate with ssl_bump

2016-11-15 Thread Yuri Voinov
15.11.2016 20:43, Alex Crow пишет: > > > On 15/11/16 14:28, Yuri Voinov wrote: >> >> >> So, you can't do SSL bump without users notification. > > You can if you have control over the clients, ie install your CA into > the browser/OS. ... and this can be illegal ;) > > Alex > -- > This message

Re: [squid-users] Trusted CA Certificate with ssl_bump

2016-11-15 Thread Alex Crow
On 15/11/16 14:28, Yuri Voinov wrote: So, you can't do SSL bump without users notification. You can if you have control over the clients, ie install your CA into the browser/OS. Alex -- This message is intended only for the addressee and may contain confidential information. Unless you

Re: [squid-users] Trusted CA Certificate with ssl_bump

2016-11-15 Thread Alex Crow
On 15/11/16 14:22, Sergio Belkin wrote: Hi, When using something like that: http_port 8080 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/home/proxy/ssl_cert/example.com.cert key=/home/proxy/ssl_cert/example.com.private Is possible to use a

Re: [squid-users] Trusted CA Certificate with ssl_bump

2016-11-15 Thread Yuri Voinov
15.11.2016 20:22, Sergio Belkin пишет: > Hi, > > When using something like that: > > http_port 8080 intercept ssl-bump generate-host-certificates=on > dynamic_cert_mem_cache_size=4MB > cert=/home/proxy/ssl_cert/example.com.cert > key=/home/proxy/ssl_cert/example.com.private > > > Is possible to

[squid-users] Trusted CA Certificate with ssl_bump

2016-11-15 Thread Sergio Belkin
Hi, When using something like that: http_port 8080 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/home/proxy/ssl_cert/example.com.cert key=/home/proxy/ssl_cert/example.com.private Is possible to use a certificate generated by a trusted CA? Thanks in

[squid-users] ssl , TAG_NONE/503 0 CONNECT

2016-11-15 Thread Dmitry Melekhov
Hello! User complained that he can't access https://es.ciur.ru/auth/login-page over squid. I tried, and all I see in log is: 1479206688.068 59865 192.168.22.229 TAG_NONE/503 0 CONNECT es.ciur.ru:443 - HIER_NONE/- - Direct connection from browser works OK. Squid 3.5.22, compiled from

Re: [squid-users] is ACL conditional directive possible ?

2016-11-15 Thread Garri Djavadyan
On Tue, 2016-11-15 at 22:48 +1300, Amos Jeffries wrote: > Then you integrate Squid with those system QoS controls by using the > tcp_outgoing_tos directive with ACLs to send the appropriate TOS > label for the client IP. Hi Amos, AFAIK, the directive 'tcp_outgoing_tos' is applied only for

Re: [squid-users] is ACL conditional directive possible ?

2016-11-15 Thread Amos Jeffries
On 15/11/2016 11:01 p.m., AUBERT Thibaud wrote: > Hi Amos, > > Sounds like a pretty interesting approach. Getting in touch with my > network colleagues and convince them to change their Infra/routers > configuration will be quiet a challenge through. > Okay. Network-wide would be best as it

Re: [squid-users] is ACL conditional directive possible ?

2016-11-15 Thread Amos Jeffries
On 15/11/2016 10:19 p.m., AUBERT Thibaud wrote: > Hi, > > I'm currently stuck on a study that consist to set different > ''reply_body_max_size" directives, depending on the source IP. > > Here's the current proxy Infra : I have some corporate proxy > (v3.5.19) used by some small and remote

[squid-users] is ACL conditional directive possible ?

2016-11-15 Thread AUBERT Thibaud
Hi, I'm currently stuck on a study that consist to set different ''reply_body_max_size" directives, depending on the source IP. Here's the current proxy Infra : I have some corporate proxy (v3.5.19) used by some small and remote offices, with a small link (8mbits/sec). Those proxy are often