config

http_port 3128

hierarchy_stoplist cgi-bin ?

acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY

hosts_file /etc/hosts

# LDAP
auth_param basic program /usr/lib/squid/ldap_auth -h 127.0.0.1 -D "cn=admin,dc=xxx" -w xxx -b "ou=squid_users,dc=xxx" -f (&(objectclass=account)(uid=%s)) 
auth_param basic realm Authentification requise !
auth_param basic children 10
auth_param basic credentialsttl 1 hour

# test groupes
external_acl_type ldap %LOGIN  /usr/lib/squid/squid_ldap_group -h 127.0.0.1 -D "cn=admin,dc=xxx" -w xxx -b "ou=squid_users,dc=xxx" -f (&(objectclass=account)(uid=%v)(groupMembership=cn=%a,ou=squid_users,dc=xxx))

acl vip external ldap vip 
acl normal external ldap normal 
acl full_vip external ldap full_vip 

acl ldapauth proxy_auth REQUIRED
http_access deny !ldapauth 

#acl google dstdomain www.google.fr
#http_access allow google normal

refresh_pattern ^ftp:		1440	20%	10080
refresh_pattern ^gopher:	1440	0%	1440
refresh_pattern .		0	20%	4320

#Recommended minimum configuration:
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 563	# https, snews
acl SSL_ports port 873		# rsync
acl Safe_ports port 80		# http
acl Safe_ports port 21		# ftp
acl Safe_ports port 443 563	# https, snews
acl Safe_ports port 70		# gopher
acl Safe_ports port 210		# wais
acl Safe_ports port 1025-65535	# unregistered ports
acl Safe_ports port 280		# http-mgmt
acl Safe_ports port 488		# gss-http
acl Safe_ports port 591		# filemaker
acl Safe_ports port 777		# multiling http
acl Safe_ports port 631		# cups
acl Safe_ports port 873		# rsync
acl Safe_ports port 901		# SWAT
acl purge method PURGE
acl CONNECT method CONNECT

acl our_networks src 192.168.30.0/24 192.168.31.0/24 192.168.32.0/24 192.168.33.0/24 192.168.34.0/24 192.168.35.0/24 192.168.36.0/24 192.168.37.0/24 192.168.38.0/24 192.168.39.0/24
acl google dstdomain www.google.fr .google.com

# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
# Only allow purge requests from localhost
http_access allow purge localhost
http_access deny purge
# Deny requests to unknown ports
http_access deny !Safe_ports
# Deny CONNECT to other than SSL ports
http_access deny CONNECT !SSL_ports

#
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
# http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS

http_access allow localhost

http_access allow normal google
http_access allow full_vip google
http_access allow vip google

# to finish
http_access deny all

# reply
http_reply_access allow all



#Allow ICP queries from everyone
icp_access allow all

coredump_dir /var/spool/squid

access_log /var/log/squid/access.log

debug_options ALL,1 33,2