<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=Content-Type content="text/html; charset=iso-8859-1"> <META content="MSHTML 6.00.5346.5" name=GENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=#ffffff> <DIV><FONT face=Arial size=2>Senhores, só dando retorno a uma questão que levantei semana passada... sobre o anulamento das acl's quando ativava o dansguardian.</FONT></DIV> <DIV><FONT face=Arial size=2></FONT> </DIV> <DIV><FONT face=Arial size=2><STRONG>### Squid.conf ###</STRONG></FONT></DIV> <DIV><FONT face=Arial size=2></FONT> </DIV> <DIV><FONT face=Arial size=2>http_port 192.168.0.254:3128 (estava 127.0.0.1:3128, acho que era devido a isso o anulamento das acls)</FONT></DIV> <DIV><FONT face=Arial size=2></FONT> </DIV> <DIV><FONT face=Arial size=2>acl all src 192.168.0.0/255.255.255.0<BR>acl manager proto cache_object<BR>acl localhost src 127.0.0.1/255.255.255.255<BR>acl to_localhost dst 127.0.0.0/8</FONT></DIV> <DIV> </DIV> <DIV><FONT face=Arial size=2>acl SSL_ports port 443 563<BR>acl Safe_ports port 80          # http<BR>acl Safe_ports port 21          # ftp<BR>acl Safe_ports port 443 563     # https, snews<BR>acl Safe_ports port 70          # gopher<BR>acl Safe_ports port 210         # wais<BR>acl Safe_ports port 1025-65535  # unregistered ports<BR>acl Safe_ports port 280         # http-mgmt<BR>acl Safe_ports port 488         # gss-http<BR>acl Safe_ports port 591         # filemaker<BR>acl Safe_ports port 777         # multiling http<BR>acl CONNECT method CONNECT<BR></FONT></DIV> <DIV><FONT face=Arial size=2># <STRONG>aqui ativo o malware_block_list</STRONG> (<A href="http://www.malware.com.br"><STRONG>www.malware.com.br</STRONG></A>)</DIV></FONT> <DIV><FONT face=Arial size=2>acl malware_block url_regex "/usr/local/focus/malware/malware_block_list.txt"<BR>http_access deny malware_block<BR>deny_info <A href="http://192.168.0.254/intranet/malware.htm">http://192.168.0.254/intranet/malware.htm</A> malware_block</FONT></DIV> <DIV><FONT face=Arial size=2></FONT> </DIV> <DIV><FONT face=Arial size=2>http_access allow Safe_ports<BR>http_access allow SSL_ports</FONT></DIV> <DIV> </DIV> <DIV><FONT face=Arial size=2>http_access allow manager localhost<BR>http_access deny manager<BR>http_access deny !Safe_ports<BR>http_access deny CONNECT !SSL_ports</FONT></DIV> <DIV><FONT face=Arial size=2></FONT> </DIV> <DIV><FONT face=Arial size=2>http_access deny all<BR></FONT></DIV> <DIV><FONT face=Arial size=2></FONT> </DIV> <DIV><FONT face=Arial size=2></FONT> </DIV> <DIV><FONT face=Arial size=2><STRONG>### DANSGUARDIAN.CONF ###</STRONG></FONT></DIV> <DIV><STRONG><FONT face=Arial size=2></FONT></STRONG> </DIV> <DIV><FONT face=Arial size=2># the port that DansGuardian listens to.<BR>filterport = 8080</FONT></DIV> <DIV> </DIV> <DIV><FONT face=Arial size=2># the ip of the proxy (default is the loopback - i.e. this server)<BR>proxyip = 192.168.0.254</FONT></DIV> <DIV> </DIV> <DIV><FONT face=Arial size=2># the port DansGuardian connects to proxy on<BR>proxyport = 3128<BR></DIV></FONT> <DIV><FONT face=Arial size=2></FONT> </DIV> <DIV><FONT face=Arial size=2></FONT> </DIV> <DIV><FONT face=Arial size=2><STRONG>### script para atualização do MBL ###</STRONG></FONT></DIV> <DIV><STRONG><FONT face=Arial size=2></FONT></STRONG> </DIV> <DIV><FONT face=Arial size=2>#!/bin/sh<BR>/usr/local/bin/wget -O - wget -O - "<A href="http://malware.hiperlinks.com.br/cgi/submit?action=list_squid&type=agressive">http://malware.hiperlinks.com.br/cgi/submit?action=list_squid&type=agressive</A>" > /usr/local/focus/malware/malware_block_list.txt<BR>/usr/local/sbin/squid -k reconfigure<BR></FONT></DIV> <DIV><FONT face=Arial size=2>Está funcionando perfeito, hoje recebi um tal "cartão virtual", quando cliquei para ver fui redirecionado para um site com o vírus, e o MBL bloqueou legal. :-)</FONT></DIV> <DIV><FONT face=Arial size=2></FONT> </DIV> <DIV><FONT face=Arial size=2>Como vocês observaram meu Dans ficou na porta 8080 (redireciono pelo firewall, proxy transparente), e agora a 3128 (squid) também fica aberta pra todos (antes era 127.0.0.1)... alguém poderia sugerir uma regra de IPFW para bloquear o acesso a 3128 de computadores diferente do meu freebsd (192.168.0.254)???</FONT></DIV> <DIV><FONT face=Arial size=2></FONT> </DIV> <DIV><FONT face=Arial size=2>Obrigado a todos.</FONT></DIV> <DIV><FONT face=Arial size=2> </DIV> <DIV><BR>-- <BR>Welkson Renny de Medeiros<BR>Focus Automação Comercial<BR>Desenvolvimento / Gerência de Redes<BR><A href="mailto:welkson@focusautomacao.com.br">welkson@focusautomacao.com.br</A></FONT></DIV></BODY></HTML>