WELCOME TO SQUID 2.6.STABLE12
# ----------------------------
#
# This is the default Squid configuration file. You may wish
# to look at the Squid home page (http://www.squid-cache.org/)
# for the FAQ and other documentation.
#
# The default Squid config file shows what the defaults for
# various options happen to be. If you don't need to change the
# default, you shouldn't uncomment the line. Doing so may cause
# run-time problems. In some cases "none" refers to no default
# setting at all, while in other cases it refers to a valid
# option - the comments for that keyword indicate if this is the
# case.
#
# NETWORK OPTIONS
# -----------------------------------------------------------------------------
# TAG: http_port
# Usage: port [options]
# hostname:port [options]
# 1.2.3.4:port [options]
#
# The socket addresses where Squid will listen for HTTP client
# requests. You may specify multiple socket addresses.
# There are three forms: port alone, hostname with port, and
# IP address with port. If you specify a hostname or IP
# address, Squid binds the socket to that specific
# address. This replaces the old 'tcp_incoming_address'
# option. Most likely, you do not need to bind to a specific
# address, so you can use the port number alone.
#
# The default port number is 3128.
#
# If you are running Squid in accelerator mode, you
# probably want to listen on port 80 also, or instead.
#
# The -a command line option will override the *first* port
# number listed here. That option will NOT override an IP
# address, however.
You may specify multiple socket addresses on multiple lines.
#
# options are:
#
# transparent Support for transparent interception of
# outgoing requests without browser settings
#
# accel Accelerator mode. Also needs at least one
# of vhost/vport/defaultsite.
#
# defaultsite= Main web site name for accelerators. Implies
# accel.
#
# vhost Accelerator using the Host header for
# virtual domain support. Implies accel.
#
# vport Accelerator with IP based virtual host support.
# Implies accel.
#
# vport= As above, but uses specified port number
# rather than the http_port number. Implies accel.
#
# urlgroup= Default urlgroup to mark requests
# with (see also acl urlgroup and
# url_rewrite_program)
#
# protocol= Protocol to reconstruct accelerated
# requests with. Defaults to http.
#
# no-connection-auth
# Prevent forwarding of Microsoft
# connection oriented authentication
# (NTLM, Negotiate and Kerberos)
#
# tproxy Support Linux TPROXY for spoofing
# outgoing connections using the client
# IP address.
#
# If you run Squid on a dual-homed machine with an internal
# and an external interface we recommend you to specify the
# internal address:port in http_port. This way Squid will only be
# visible on the internal address.
# Squid normally listens to port 3128
http_port 8080 transparent
# TAG: https_port
# Note: This option is only available if Squid is rebuilt with the
# --enable-ssl option
#
# Usage: [ip:]port cert=certificate.pem [key=key.pem] [options...]
#
# The socket address where Squid will listen for HTTPS client
# requests.
#
# This is really only useful for situations where you are running
# squid in accelerator mode and you want to do the SSL work at the
# accelerator level.
#
# You may specify multiple socket addresses on multiple lines,
# each with their own SSL certificate and/or options.
#
# Options:
#
# accel Accelerator mode. Also needs at least one of
# defaultsite or vhost.
#
# defaultsite= The name of the https site presented on
# this port. Implies accel.
#
# vhost Domain based virtual host support. Useful
# in combination with a wildcard certificate or
# other certificates valid for more than one domain.
# Implies accel.
#
# urlgroup= Default urlgroup to mark requests with (see
# also acl urlgroup and url_rewrite_program)
#
# protocol= Protocol to reconstruct accelerated requests
# with. Defaults to https.
#
# cert= Path to SSL certificate (PEM format)
#
# key= Path to SSL private key file (PEM format) assumed to be a combined certificate and
# key file
#
# version= The version of SSL/TLS supported
# 1 automatic (default)
# 2 SSLv2 only
# 3 SSLv3 only
# 4 TLSv1 only
#
# cipher= Colon separated list of supported ciphers
#
# options= Various SSL engine options. The most important
# being:
# NO_SSLv2 Disallow the use of SSLv2
# NO_SSLv3 Disallow the use of SSLv3
# NO_TLSv1 Disallow the use of TLSv1
# SINGLE_DH_USE Always create a new key when using
# temporary/ephemeral DH key exchanges
# See src/ssl_support.c or OpenSSL SSL_CTX_set_options
# documentation for a complete list of options.
#
# clientca= File containing the list of CAs to use when
# requesting a client certificate
#
# cafile= File containing additional CA certificates to
# use when verifying client certificates. If unset
# clientca will be used.
#
# capath= Directory containing additional CA certificates
# and CRL lists to use when verifying client certificates
#
# crlfile= File of additional CRL lists to use when verifying
# the client certificate, in addition to CRLs stored in
# the capath. Implies VERIFY_CRL flag below.
#
# dhparams= File containing DH parameters for temporary/ephemeral
# DH key exchanges
#
# sslflags= Various flags modifying the use of SSL:
# DELAYED_AUTH
# Don't request client certificates
# immediately, but wait until acl processing
# requires a certificate (not yet implemented)
#Default:
# none
# TAG: ssl_unclean_shutdown
# Note: This option is only available if Squid is rebuilt with the
# --enable-ssl option
#
# Some browsers (especially MSIE) bugs out on SSL shutdown
# messages.
#
#Default:
# ssl_unclean_shutdown off
# TAG: ssl_engine
# Note: This option is only available if Squid is rebuilt with the
# --enable-ssl option
#
# The OpenSSL engine to use. You will need to set this if you
# would like to use hardware SSL acceleration for example.
#
#Default:
# none
# TAG: sslproxy_client_certificate
# Note: This option is only available if Squid is rebuilt with the
# --enable-ssl option
#Default:
# none
# TAG: sslproxy_client_key
# Note: This option is only available if Squid is rebuilt with the
# --enable-ssl option
#
# Client SSL Key to use when proxying https:// URLs
#
#Default:
# none
# TAG: sslproxy_version
# Note: This option is only available if Squid is rebuilt with the
# --enable-ssl option
#
# SSL version level to use when proxying https:// URLs
#
#Default:
# sslproxy_version 1
# TAG: sslproxy_options
# Note: This option is only available if Squid is rebuilt with the
# --enable-ssl option
#
# SSL engine options to use when proxying https:// URLs
#
#Default:
# none
# TAG: sslproxy_cipher
# Note: This option is only available if Squid is rebuilt with the
# --enable-ssl option
#
# SSL cipher list to use when proxying https:// URLs
#
#Default:
# none
# TAG: sslproxy_cafile
# Note: This option is only available if Squid is rebuilt with the
#Default:
cache_mem 8 MB
# TAG: cache_swap_low (percent, 0-100)
# TAG: cache_swap_high (percent, 0-100)
#
# The low- and high-water marks for cache object replacement.
# Replacement begins when the swap (disk) usage is above the
# low-water mark and attempts to maintain utilization near the
# low-water mark. As swap utilization gets close to high-water
# mark object eviction becomes more aggressive. If utilization is
# close to the low-water mark less replacement is done each time.
#
# Defaults are 90% and 95%. If you have a large cache, 5% could be
# hundreds of MB. If this is the case you may wish to set these
# numbers closer together.
#
#Default:
cache_swap_low 90
cache_swap_high 95
#Default:
cache_dir ufs /usr/local/squid/var/cache 100 16 256
# To log the request via syslog specify a filepath of "syslog"
access_log /usr/local/squid/var/logs/access.log squid
#Default:
cache_log /usr/local/squid/var/logs/cache.log
#Default:
cache_store_log /usr/local/squid/var/logs/store.log
#Default:
# http_access deny all
#
#Recommended minimum configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
# Deny requests to unknown ports
http_access deny !Safe_ports
# Deny CONNECT to other than SSL ports
http_access deny CONNECT !SSL_ports
#
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
# Example rule allowing access from your local networks. Adapt
# to list your (internal) IP networks from where browsing should
# be allowed
#acl our_networks src 192.168.1.0/24 192.168.2.0/24
#http_access allow our_networks
# And finally deny all other access to this proxy
http_access allow all
# if not specified, the certificate file is