diff -ruN squid-2.6.STABLE15/ChangeLog squid-2.6.STABLE16/ChangeLog
--- squid-2.6.STABLE15/ChangeLog Fri Aug 31 08:48:33 2007
+++ squid-2.6.STABLE16/ChangeLog Wed Sep 5 16:06:14 2007
@@ -1,3 +1,19 @@
+Changes to squid-2.6.STABLE16 (5 Sep 2007)
+
+ - Test for sys/capability.h linux include file to avoid failing on
+ linux systems missing libcap
+ - Release private objects on cache rebuild
+ - Segfault in clientBuildReplyHeader when http->entry == NULL
+ - Bug #2072: digest_pw_auth fails when using plaintext passwords
+ - Bug #2073: assertion failed: client_side.c:4175: "buf != NULL ||
+ !conn->body.request on POST
+ - Adjust default pconn timeouts to avoid shutting down connection while
+ child sends request
+ - Bug #1980: cache_peer monitortimeout not working
+ - Bug #1882: Parent responses are not cached if sibling returns 504
+ - More squid.conf reordering to get the dependencies between options
+ sorted proper
+
Changes to squid-2.6.STABLE15 (31 Aug 2007)
- The select() I/O loop got broken by the /dev/poll addition
diff -ruN squid-2.6.STABLE15/RELEASENOTES.html squid-2.6.STABLE16/RELEASENOTES.html
--- squid-2.6.STABLE15/RELEASENOTES.html Fri Aug 31 08:55:49 2007
+++ squid-2.6.STABLE16/RELEASENOTES.html Wed Sep 5 16:26:15 2007
@@ -2,12 +2,12 @@
- Squid 2.6.STABLE15 release notes
+ Squid 2.6.STABLE16 release notes
-Squid 2.6.STABLE15 release notes
+Squid 2.6.STABLE16 release notes
-Squid Developers
$Id: release-2.6.html,v 1.44.2.11 2007/08/31 14:53:26 hno Exp $
+Squid Developers
$Id: release-2.6.html,v 1.44.2.13 2007/09/05 22:25:23 hno Exp $
This document contains the release notes for version 2.6 of Squid.
Squid is a WWW Cache application developed by the Web Caching community.
@@ -72,6 +72,9 @@
+
+
+
@@ -720,6 +723,22 @@
Bug #2066: chdir after chroot
See also the list of
squid-2.6.STABLE15 changes and the
+ChangeLog file for details.
+
+
+
+
+
+
+
+- Bug #2073: assertion failed: client_side.c:4175: "buf != NULL ||
+!conn->body.request on POST
+- Test for sys/capability.h linux include file to avoid failing on
+linux systems missing libcap
+- More squid.conf reordering to get the dependencies between options
+sorted proper
+- See also the list of
+squid-2.6.STABLE16 changes and the
ChangeLog file for details.
diff -ruN squid-2.6.STABLE15/configure squid-2.6.STABLE16/configure
--- squid-2.6.STABLE15/configure Fri Aug 31 08:55:13 2007
+++ squid-2.6.STABLE16/configure Wed Sep 5 16:25:42 2007
@@ -1,7 +1,7 @@
#! /bin/sh
-# From configure.in Revision: 1.416.2.18 .
+# From configure.in Revision: 1.416.2.20 .
# Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.61 for Squid Web Proxy 2.6.STABLE15.
+# Generated by GNU Autoconf 2.61 for Squid Web Proxy 2.6.STABLE16.
#
# Report bugs to .
#
@@ -575,8 +575,8 @@
# Identity of this package.
PACKAGE_NAME='Squid Web Proxy'
PACKAGE_TARNAME='squid'
-PACKAGE_VERSION='2.6.STABLE15'
-PACKAGE_STRING='Squid Web Proxy 2.6.STABLE15'
+PACKAGE_VERSION='2.6.STABLE16'
+PACKAGE_STRING='Squid Web Proxy 2.6.STABLE16'
PACKAGE_BUGREPORT='http://www.squid-cache.org/bugs/'
ac_default_prefix=/usr/local/squid
@@ -1314,7 +1314,7 @@
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
-\`configure' configures Squid Web Proxy 2.6.STABLE15 to adapt to many kinds of systems.
+\`configure' configures Squid Web Proxy 2.6.STABLE16 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
@@ -1384,7 +1384,7 @@
if test -n "$ac_init_help"; then
case $ac_init_help in
- short | recursive ) echo "Configuration of Squid Web Proxy 2.6.STABLE15:";;
+ short | recursive ) echo "Configuration of Squid Web Proxy 2.6.STABLE16:";;
esac
cat <<\_ACEOF
@@ -1662,7 +1662,7 @@
test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then
cat <<\_ACEOF
-Squid Web Proxy configure 2.6.STABLE15
+Squid Web Proxy configure 2.6.STABLE16
generated by GNU Autoconf 2.61
Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
@@ -1676,7 +1676,7 @@
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
-It was created by Squid Web Proxy $as_me 2.6.STABLE15, which was
+It was created by Squid Web Proxy $as_me 2.6.STABLE16, which was
generated by GNU Autoconf 2.61. Invocation command line was
$ $0 $@
@@ -2349,7 +2349,7 @@
# Define the identity of the package.
PACKAGE='squid'
- VERSION='2.6.STABLE15'
+ VERSION='2.6.STABLE16'
cat >>confdefs.h <<_ACEOF
@@ -8014,6 +8014,7 @@
+
for ac_header in sys/types.h \
stddef.h \
limits.h \
@@ -8095,6 +8096,7 @@
db.h \
db_185.h \
aio.h \
+ sys/capability.h \
do
as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
@@ -27274,7 +27276,7 @@
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
-This file was extended by Squid Web Proxy $as_me 2.6.STABLE15, which was
+This file was extended by Squid Web Proxy $as_me 2.6.STABLE16, which was
generated by GNU Autoconf 2.61. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
@@ -27327,7 +27329,7 @@
_ACEOF
cat >>$CONFIG_STATUS <<_ACEOF
ac_cs_version="\\
-Squid Web Proxy config.status 2.6.STABLE15
+Squid Web Proxy config.status 2.6.STABLE16
configured by $0, generated by GNU Autoconf 2.61,
with options \\"`echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"
diff -ruN squid-2.6.STABLE15/configure.in squid-2.6.STABLE16/configure.in
--- squid-2.6.STABLE15/configure.in Fri Aug 31 08:55:13 2007
+++ squid-2.6.STABLE16/configure.in Wed Sep 5 16:25:42 2007
@@ -1,16 +1,16 @@
dnl
dnl Configuration input file for Squid
dnl
-dnl $Id: configure.in,v 1.416.2.18 2007/08/31 14:48:33 hno Exp $
+dnl $Id: configure.in,v 1.416.2.20 2007/09/05 22:06:14 hno Exp $
dnl
dnl
dnl
-AC_INIT(Squid Web Proxy, 2.6.STABLE15, http://www.squid-cache.org/bugs/, squid)
+AC_INIT(Squid Web Proxy, 2.6.STABLE16, http://www.squid-cache.org/bugs/, squid)
AC_PREREQ(2.52)
AM_CONFIG_HEADER(include/autoconf.h)
AC_CONFIG_AUX_DIR(cfgaux)
AM_INIT_AUTOMAKE
-AC_REVISION($Revision: 1.416.2.18 $)dnl
+AC_REVISION($Revision: 1.416.2.20 $)dnl
AC_PREFIX_DEFAULT(/usr/local/squid)
AM_MAINTAINER_MODE
@@ -1665,6 +1665,7 @@
db.h \
db_185.h \
aio.h \
+ sys/capability.h \
,,,[
#if HAVE_SYS_TYPES_H
#include
diff -ruN squid-2.6.STABLE15/helpers/digest_auth/password/text_backend.c squid-2.6.STABLE16/helpers/digest_auth/password/text_backend.c
--- squid-2.6.STABLE15/helpers/digest_auth/password/text_backend.c Mon May 15 19:21:29 2006
+++ squid-2.6.STABLE16/helpers/digest_auth/password/text_backend.c Sun Sep 2 20:45:38 2007
@@ -99,7 +99,7 @@
fprintf(stderr, "digest_pw_auth: ignoring invalid password for %s\n", user);
continue;
}
- u = xmalloc(sizeof(*u));
+ u = xcalloc(1, sizeof(*u));
if (realm) {
int len = strlen(user) + strlen(realm) + 2;
u->hash.key = malloc(len);
diff -ruN squid-2.6.STABLE15/include/autoconf.h.in squid-2.6.STABLE16/include/autoconf.h.in
--- squid-2.6.STABLE15/include/autoconf.h.in Sun Aug 12 06:41:06 2007
+++ squid-2.6.STABLE16/include/autoconf.h.in Sat Sep 1 18:14:59 2007
@@ -493,6 +493,9 @@
/* Define to 1 if you have the header file. */
#undef HAVE_SYS_BITYPES_H
+/* Define to 1 if you have the header file. */
+#undef HAVE_SYS_CAPABILITY_H
+
/* Define to 1 if you have the header file, and it defines `DIR'.
*/
#undef HAVE_SYS_DIR_H
diff -ruN squid-2.6.STABLE15/include/version.h squid-2.6.STABLE16/include/version.h
--- squid-2.6.STABLE15/include/version.h Fri Aug 31 08:55:13 2007
+++ squid-2.6.STABLE16/include/version.h Wed Sep 5 16:25:42 2007
@@ -9,5 +9,5 @@
*/
#ifndef SQUID_RELEASE_TIME
-#define SQUID_RELEASE_TIME 1188572108
+#define SQUID_RELEASE_TIME 1189031137
#endif
diff -ruN squid-2.6.STABLE15/src/Makefile.am squid-2.6.STABLE16/src/Makefile.am
--- squid-2.6.STABLE15/src/Makefile.am Fri Jun 22 06:07:35 2007
+++ squid-2.6.STABLE16/src/Makefile.am Wed Sep 5 15:50:15 2007
@@ -1,7 +1,7 @@
#
# Makefile for the Squid Object Cache server
#
-# $Id: Makefile.am,v 1.56.2.2 2007/06/22 12:07:35 adrian Exp $
+# $Id: Makefile.am,v 1.56.2.3 2007/09/05 21:50:15 hno Exp $
#
# Uncomment and customize the following to suit your needs:
#
@@ -310,6 +310,7 @@
EXTRA_DIST = \
cf_gen_defines \
cf.data.pre \
+ cf.data.depend \
mk-globals-c.pl \
mk-string-arrays.pl \
auth_modules.sh \
@@ -359,11 +360,12 @@
## If autodependency works well this is not needed anymore
cache_cf.o: cf_parser.h
+# squid.conf.default is built by cf_gen when making cf_parser.h
squid.conf.default: cf_parser.h
- $(SHELL) -c "test -f squid.conf.default || ./cf_gen cf.data"
+ true
cf_parser.h: cf.data cf_gen$(EXEEXT)
- ./cf_gen cf.data
+ ./cf_gen cf.data $(srcdir)/cf.data.depend
cf_gen_defines.h: $(srcdir)/cf_gen_defines $(srcdir)/cf.data.pre
awk -f $(srcdir)/cf_gen_defines <$(srcdir)/cf.data.pre >cf_gen_defines.h
diff -ruN squid-2.6.STABLE15/src/Makefile.in squid-2.6.STABLE16/src/Makefile.in
--- squid-2.6.STABLE15/src/Makefile.in Sun Aug 12 06:41:07 2007
+++ squid-2.6.STABLE16/src/Makefile.in Wed Sep 5 15:57:25 2007
@@ -17,7 +17,7 @@
#
# Makefile for the Squid Object Cache server
#
-# $Id: Makefile.in,v 1.281.2.3 2007/08/12 12:41:07 hno Exp $
+# $Id: Makefile.in,v 1.281.2.5 2007/09/05 21:57:25 hno Exp $
#
# Uncomment and customize the following to suit your needs:
#
@@ -610,6 +610,7 @@
EXTRA_DIST = \
cf_gen_defines \
cf.data.pre \
+ cf.data.depend \
mk-globals-c.pl \
mk-string-arrays.pl \
auth_modules.sh \
@@ -1221,11 +1222,12 @@
cache_cf.o: cf_parser.h
+# squid.conf.default is built by cf_gen when making cf_parser.h
squid.conf.default: cf_parser.h
- $(SHELL) -c "test -f squid.conf.default || ./cf_gen cf.data"
+ true
cf_parser.h: cf.data cf_gen$(EXEEXT)
- ./cf_gen cf.data
+ ./cf_gen cf.data $(srcdir)/cf.data.depend
cf_gen_defines.h: $(srcdir)/cf_gen_defines $(srcdir)/cf.data.pre
awk -f $(srcdir)/cf_gen_defines <$(srcdir)/cf.data.pre >cf_gen_defines.h
diff -ruN squid-2.6.STABLE15/src/cf.data.depend squid-2.6.STABLE16/src/cf.data.depend
--- squid-2.6.STABLE15/src/cf.data.depend Wed Dec 31 17:00:00 1969
+++ squid-2.6.STABLE16/src/cf.data.depend Wed Sep 5 15:50:15 2007
@@ -0,0 +1,54 @@
+# type dependencies
+access_log acl logformat
+acl external_acl_type auth_param
+acl_access acl
+acl_address acl
+acl_b_size_t acl
+acl_tos acl
+address
+authparam
+b_int64_t
+b_size_t
+cachedir cache_replacement_policy
+cachemgrpasswd
+debug
+delay_pool_access acl delay_class
+delay_pool_class delay_pools
+delay_pool_count
+delay_pool_rates delay_class
+denyinfo acl
+eol
+externalAclHelper auth_param
+hostdomain cache_peer
+hostdomaintype cache_peer
+http_header_access
+http_header_replace
+http_port_list
+https_port_list
+icap_access_type icap_class acl
+icap_class_type icap_service
+icap_service_type
+int
+kb_int64_t
+kb_size_t
+logformat
+onoff
+peer
+peer_access cache_peer acl
+refreshpattern
+removalpolicy
+size_t
+sockaddr_in_list
+string
+string
+time_t
+tristate
+uri_whitespace
+ushort
+wccp2_service
+wccp2_service_info
+wordlist
+body_size_t acl
+programline
+extension_method
+errormap
diff -ruN squid-2.6.STABLE15/src/cf.data.pre squid-2.6.STABLE16/src/cf.data.pre
--- squid-2.6.STABLE15/src/cf.data.pre Tue Aug 21 18:14:30 2007
+++ squid-2.6.STABLE16/src/cf.data.pre Wed Sep 5 15:50:15 2007
@@ -1,6 +1,6 @@
#
-# $Id: cf.data.pre,v 1.382.2.12 2007/08/22 00:14:30 hno Exp $
+# $Id: cf.data.pre,v 1.382.2.14 2007/09/05 21:50:15 hno Exp $
#
# SQUID Web Proxy Cache http://www.squid-cache.org/
# ----------------------------------------------------------
@@ -48,3269 +48,3291 @@
COMMENT_END
COMMENT_START
- NETWORK OPTIONS
+ OPTIONS FOR AUTHENTICATION
-----------------------------------------------------------------------------
COMMENT_END
-NAME: http_port ascii_port
-TYPE: http_port_list
+NAME: auth_param
+TYPE: authparam
+LOC: Config.authConfig
DEFAULT: none
-LOC: Config.Sockaddr.http
DOC_START
- Usage: port [options]
- hostname:port [options]
- 1.2.3.4:port [options]
-
- The socket addresses where Squid will listen for HTTP client
- requests. You may specify multiple socket addresses.
- There are three forms: port alone, hostname with port, and
- IP address with port. If you specify a hostname or IP
- address, Squid binds the socket to that specific
- address. This replaces the old 'tcp_incoming_address'
- option. Most likely, you do not need to bind to a specific
- address, so you can use the port number alone.
+ This is used to define parameters for the various authentication
+ schemes supported by Squid.
- If you are running Squid in accelerator mode, you
- probably want to listen on port 80 also, or instead.
+ format: auth_param scheme parameter [setting]
- You may specify multiple socket addresses on multiple lines.
+ The order in which authentication schemes are presented to the client is
+ dependent on the order the scheme first appears in config file. IE
+ has a bug (it's not RFC 2617 compliant) in that it will use the basic
+ scheme if basic is the first entry presented, even if more secure
+ schemes are presented. For now use the order in the recommended
+ settings section below. If other browsers have difficulties (don't
+ recognize the schemes offered even if you are using basic) either
+ put basic first, or disable the other schemes (by commenting out their
+ program entry).
- Options:
+ Once an authentication scheme is fully configured, it can only be
+ shutdown by shutting squid down and restarting. Changes can be made on
+ the fly and activated with a reconfigure. I.E. You can change to a
+ different helper, but not unconfigure the helper completely.
- transparent Support for transparent interception of
- outgoing requests without browser settings.
+ Please note that while this directive defines how Squid processes
+ authentication it does not automatically activate authentication.
+ To use authentication you must in addition make use of ACLs based
+ on login name in http_access (proxy_auth, proxy_auth_regex or
+ external with %LOGIN used in the format tag). The browser will be
+ challenged for authentication on the first such acl encountered
+ in http_access processing and will also be re-challenged for new
+ login credentials if the request is being denied by a proxy_auth
+ type acl.
- tproxy Support Linux TPROXY for spoofing outgoing
- connections using the client IP address.
+ WARNING: authentication can't be used in a transparently intercepting
+ proxy as the client then thinks it is talking to an origin server and
+ not the proxy. This is a limitation of bending the TCP/IP protocol to
+ transparently intercepting port 80, not a limitation in Squid.
- accel Accelerator mode. Also needs at least one
- of vhost/vport/defaultsite.
+ === Parameters for the basic scheme follow. ===
- defaultsite=domainname
- What to use for the Host: header if it is not present
- in a request. Determines what site (not origin server)
- accelerators should consider the default.
- Implies accel.
+ "program" cmdline
+ Specify the command for the external authenticator. Such a program
+ reads a line containing "username password" and replies "OK" or
+ "ERR" in an endless loop. "ERR" responses may optionally be followed
+ by a error description available as %m in the returned error page.
- vhost Accelerator mode using Host header for virtual
- domain support. Implies accel.
+ By default, the basic authentication scheme is not used unless a
+ program is specified.
- vport Accelerator with IP based virtual host support.
- Implies accel.
+ If you want to use the traditional proxy authentication, jump over to
+ the helpers/basic_auth/NCSA directory and type:
+ % make
+ % make install
- vport=NN As above, but uses specified port number rather
- than the http_port number. Implies accel.
+ Then, set this line to something like
- urlgroup= Default urlgroup to mark requests with (see
- also acl urlgroup and url_rewrite_program)
+ auth_param basic program @DEFAULT_PREFIX@/libexec/ncsa_auth @DEFAULT_PREFIX@/etc/passwd
- protocol= Protocol to reconstruct accelerated requests with.
- Defaults to http.
+ "children" numberofchildren
+ The number of authenticator processes to spawn. If you start too few
+ squid will have to wait for them to process a backlog of credential
+ verifications, slowing it down. When credential verifications are
+ done via a (slow) network you are likely to need lots of
+ authenticator processes.
+ auth_param basic children 5
- no-connection-auth
- Prevent forwarding of Microsoft connection oriented
- authentication (NTLM, Negotiate and Kerberos)
+ "concurrency" numberofconcurrentrequests
+ The number of concurrent requests/channels the helper supports.
+ Changes the protocol used to include a channel number first on
+ the request/response line, allowing multiple requests to be sent
+ to the same helper in parallell without wating for the response.
+ Must not be set unless it's known the helper supports this.
- If you run Squid on a dual-homed machine with an internal
- and an external interface we recommend you to specify the
- internal address:port in http_port. This way Squid will only be
- visible on the internal address.
+ "realm" realmstring
+ Specifies the realm name which is to be reported to the client for
+ the basic proxy authentication scheme (part of the text the user
+ will see when prompted their username and password).
+ auth_param basic realm Squid proxy-caching web server
-NOCOMMENT_START
-# Squid normally listens to port 3128
-http_port @DEFAULT_HTTP_PORT@
-NOCOMMENT_END
-DOC_END
+ "credentialsttl" timetolive
+ Specifies how long squid assumes an externally validated
+ username:password pair is valid for - in other words how often the
+ helper program is called for that user. Set this low to force
+ revalidation with short lived passwords. Note that setting this high
+ does not impact your susceptibility to replay attacks unless you are
+ using an one-time password system (such as SecureID). If you are using
+ such a system, you will be vulnerable to replay attacks unless you
+ also use the max_user_ip ACL in an http_access rule.
+ auth_param basic credentialsttl 2 hours
-NAME: https_port
-IFDEF: USE_SSL
-TYPE: https_port_list
-DEFAULT: none
-LOC: Config.Sockaddr.https
-DOC_START
- Usage: [ip:]port cert=certificate.pem [key=key.pem] [options...]
+ "casesensitive" on|off
+ Specifies if usernames are case sensitive. Most user databases are
+ case insensitive allowing the same username to be spelled using both
+ lower and upper case letters, but some are case sensitive. This
+ makes a big difference for user_max_ip ACL processing and similar.
+ auth_param basic casesensitive off
- The socket address where Squid will listen for HTTPS client
- requests.
+ "blankpassword" on|off
+ Specifies if blank passwords should be supported. Defaults to off
+ as there is multiple authentication backends which handles blank
+ passwords as "guest" access.
- This is really only useful for situations where you are running
- squid in accelerator mode and you want to do the SSL work at the
- accelerator level.
+ === Parameters for the digest scheme follow ===
- You may specify multiple socket addresses on multiple lines,
- each with their own SSL certificate and/or options.
+ "program" cmdline
+ Specify the command for the external authenticator. Such a program
+ reads a line containing "username":"realm" and replies with the
+ appropriate H(A1) value hex encoded or ERR if the user (or his H(A1)
+ hash) does not exists. See RFC 2616 for the definition of H(A1).
+ "ERR" responses may optionally be followed by a error description
+ available as %m in the returned error page.
- Options:
+ By default, the digest authentication scheme is not used unless a
+ program is specified.
- accel Accelerator mode. Also needs at least one of
- defaultsite or vhost.
+ If you want to use a digest authenticator, jump over to the
+ helpers/digest_auth/ directory and choose the authenticator to use.
+ It it's directory type
+ % make
+ % make install
- defaultsite= The name of the https site presented on
- this port. Implies accel.
+ Then, set this line to something like
- vhost Accelerator mode using Host header for virtual
- domain support. Requires a wildcard certificate
- or other certificate valid for more than one domain.
- Implies accel.
+ auth_param digest program @DEFAULT_PREFIX@/libexec/digest_auth_pw @DEFAULT_PREFIX@/etc/digpass
- urlgroup= Default urlgroup to mark requests with (see
- also acl urlgroup and url_rewrite_program).
+ "children" numberofchildren
+ The number of authenticator processes to spawn. If you start too few
+ squid will have to wait for them to process a backlog of credential
+ verifications, slowing it down. When credential verifications are
+ done via a (slow) network you are likely to need lots of
+ authenticator processes.
+ auth_param digest children 5
- protocol= Protocol to reconstruct accelerated requests with.
- Defaults to https.
+ "concurrency" numberofconcurrentrequests
+ The number of concurrent requests/channels the helper supports.
+ Changes the protocol used to include a channel number first on
+ the request/response line, allowing multiple requests to be sent
+ to the same helper in parallell without wating for the response.
+ Must not be set unless it's known the helper supports this.
- cert= Path to SSL certificate (PEM format).
+ "realm" realmstring
+ Specifies the realm name which is to be reported to the client for the
+ digest proxy authentication scheme (part of the text the user will see
+ when prompted their username and password).
+ auth_param digest realm Squid proxy-caching web server
- key= Path to SSL private key file (PEM format)
- if not specified, the certificate file is
- assumed to be a combined certificate and
- key file.
+ "nonce_garbage_interval" timeinterval
+ Specifies the interval that nonces that have been issued to clients are
+ checked for validity.
+ auth_param digest nonce_garbage_interval 5 minutes
- version= The version of SSL/TLS supported
- 1 automatic (default)
- 2 SSLv2 only
- 3 SSLv3 only
- 4 TLSv1 only
+ "nonce_max_duration" timeinterval
+ Specifies the maximum length of time a given nonce will be valid for.
+ auth_param digest nonce_max_duration 30 minutes
- cipher= Colon separated list of supported ciphers.
+ "nonce_max_count" number
+ Specifies the maximum number of times a given nonce can be used.
+ auth_param digest nonce_max_count 50
- options= Various SSL engine options. The most important
- being:
- NO_SSLv2 Disallow the use of SSLv2
- NO_SSLv3 Disallow the use of SSLv3
- NO_TLSv1 Disallow the use of TLSv1
- SINGLE_DH_USE Always create a new key when using
- temporary/ephemeral DH key exchanges
- See src/ssl_support.c or OpenSSL SSL_CTX_set_options
- documentation for a complete list of options.
+ "nonce_strictness" on|off
+ Determines if squid requires strict increment-by-1 behavior for nonce
+ counts, or just incrementing (off - for use when useragents generate
+ nonce counts that occasionally miss 1 (ie, 1,2,4,6)).
+ auth_param digest nonce_strictness off
- clientca= File containing the list of CAs to use when
- requesting a client certificate.
+ "check_nonce_count" on|off
+ This directive if set to off can disable the nonce count check
+ completely to work around buggy digest qop implementations in certain
+ mainstream browser versions. Default on to check the nonce count to
+ protect from authentication replay attacks.
+ auth_param digest check_nonce_count on
- cafile= File containing additional CA certificates to
- use when verifying client certificates. If unset
- clientca will be used.
+ "post_workaround" on|off
+ This is a workaround to certain buggy browsers who sends an incorrect
+ request digest in POST requests when reusing the same nonce as acquired
+ earlier in response to a GET request.
+ auth_param digest post_workaround off
- capath= Directory containing additional CA certificates
- and CRL lists to use when verifying client certificates.
+ === NTLM scheme options follow ===
- crlfile= File of additional CRL lists to use when verifying
- the client certificate, in addition to CRLs stored in
- the capath. Implies VERIFY_CRL flag below.
-
- dhparams= File containing DH parameters for temporary/ephemeral
- DH key exchanges.
-
- sslflags= Various flags modifying the use of SSL:
- DELAYED_AUTH
- Don't request client certificates
- immediately, but wait until acl processing
- requires a certificate (not yet implemented).
- NO_DEFAULT_CA
- Don't use the default CA lists built in
- to OpenSSL.
- NO_SESSION_REUSE
- Don't allow for session reuse. Each connection
- will result in a new SSL session.
- VERIFY_CRL
- Verify CRL lists when accepting client
- certificates.
- VERIFY_CRL_ALL
- Verify CRL lists for all certificates in the
- client certificate chain.
+ "program" cmdline
+ Specify the command for the external NTLM authenticator. Such a
+ program participates in the NTLMSSP exchanges between Squid and the
+ client and reads commands according to the Squid NTLMSSP helper
+ protocol. See helpers/ntlm_auth/ for details. Recommended ntlm
+ authenticator is ntlm_auth from Samba-3.X, but a number of other
+ ntlm authenticators is available.
- sslcontext= SSL session ID context identifier.
+ By default, the ntlm authentication scheme is not used unless a
+ program is specified.
- vport Accelerator with IP based virtual host support.
+ auth_param ntlm program /path/to/samba/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
- vport=NN As above, but uses specified port number rather
- than the https_port number. Implies accel.
+ "children" numberofchildren
+ The number of authenticator processes to spawn. If you start too few
+ squid will have to wait for them to process a backlog of credential
+ verifications, slowing it down. When credential verifications are
+ done via a (slow) network you are likely to need lots of
+ authenticator processes.
+ auth_param ntlm children 5
-DOC_END
+ "keep_alive" on|off
+ This option enables the use of keep-alive on the initial
+ authentication request. It has been reported some versions of MSIE
+ have problems if this is enabled, but performance will be increased
+ if enabled.
-COMMENT_START
- SSL OPTIONS
- -----------------------------------------------------------------------------
-COMMENT_END
+ auth_param ntlm keep_alive on
-NAME: ssl_unclean_shutdown
-IFDEF: USE_SSL
-TYPE: onoff
-DEFAULT: off
-LOC: Config.SSL.unclean_shutdown
-DOC_START
- Some browsers (especially MSIE) bugs out on SSL shutdown
- messages.
-DOC_END
+ === Negotiate scheme options follow ===
-NAME: ssl_engine
-IFDEF: USE_SSL
-TYPE: string
-LOC: Config.SSL.ssl_engine
-DEFAULT: none
-DOC_START
- The OpenSSL engine to use. You will need to set this if you
- would like to use hardware SSL acceleration for example.
-DOC_END
+ "program" cmdline
+ Specify the command for the external Negotiate authenticator. Such a
+ program participates in the SPNEGO exchanges between Squid and the
+ client and reads commands according to the Squid ntlmssp helper
+ protocol. See helpers/ntlm_auth/ for details. Recommended SPNEGO
+ authenticator is ntlm_auth from Samba-4.X.
-NAME: sslproxy_client_certificate
-IFDEF: USE_SSL
-DEFAULT: none
-LOC: Config.ssl_client.cert
-TYPE: string
-DOC_START
- Client SSL Certificate to use when proxying https:// URLs
-DOC_END
+ By default, the Negotiate authentication scheme is not used unless a
+ program is specified.
-NAME: sslproxy_client_key
-IFDEF: USE_SSL
-DEFAULT: none
-LOC: Config.ssl_client.key
-TYPE: string
-DOC_START
- Client SSL Key to use when proxying https:// URLs
-DOC_END
+ auth_param negotiate program /path/to/samba/bin/ntlm_auth --helper-protocol=gss-spnego
-NAME: sslproxy_version
-IFDEF: USE_SSL
-DEFAULT: 1
-LOC: Config.ssl_client.version
-TYPE: int
-DOC_START
- SSL version level to use when proxying https:// URLs
-DOC_END
+ "children" numberofchildren
+ The number of authenticator processes to spawn. If you start too few
+ squid will have to wait for them to process a backlog of credential
+ verifications, slowing it down. When credential verifications are
+ done via a (slow) network you are likely to need lots of
+ authenticator processes.
+ auth_param negotiate children 5
-NAME: sslproxy_options
-IFDEF: USE_SSL
-DEFAULT: none
-LOC: Config.ssl_client.options
-TYPE: string
-DOC_START
- SSL engine options to use when proxying https:// URLs
-DOC_END
+ "keep_alive" on|off
+ If you experience problems with PUT/POST requests when using the
+ Negotiate authentication scheme then you can try setting this to
+ off. This will cause Squid to forcibly close the connection on
+ the initial requests where the browser asks which schemes are
+ supported by the proxy.
-NAME: sslproxy_cipher
-IFDEF: USE_SSL
-DEFAULT: none
-LOC: Config.ssl_client.cipher
-TYPE: string
-DOC_START
- SSL cipher list to use when proxying https:// URLs
-DOC_END
+ auth_param negotiate keep_alive on
-NAME: sslproxy_cafile
-IFDEF: USE_SSL
-DEFAULT: none
-LOC: Config.ssl_client.cafile
-TYPE: string
-DOC_START
- file containing CA certificates to use when verifying server
- certificates while proxying https:// URLs
+NOCOMMENT_START
+#Recommended minimum configuration per scheme:
+#auth_param negotiate program
+#auth_param negotiate children 5
+#auth_param negotiate keep_alive on
+#auth_param ntlm program
+#auth_param ntlm children 5
+#auth_param ntlm keep_alive on
+#auth_param digest program
+#auth_param digest children 5
+#auth_param digest realm Squid proxy-caching web server
+#auth_param digest nonce_garbage_interval 5 minutes
+#auth_param digest nonce_max_duration 30 minutes
+#auth_param digest nonce_max_count 50
+#auth_param basic program
+#auth_param basic children 5
+#auth_param basic realm Squid proxy-caching web server
+#auth_param basic credentialsttl 2 hours
+#auth_param basic casesensitive off
+NOCOMMENT_END
DOC_END
-NAME: sslproxy_capath
-IFDEF: USE_SSL
-DEFAULT: none
-LOC: Config.ssl_client.capath
-TYPE: string
+NAME: authenticate_cache_garbage_interval
+TYPE: time_t
+DEFAULT: 1 hour
+LOC: Config.authenticateGCInterval
DOC_START
- directory containing CA certificates to use when verifying
- server certificates while proxying https:// URLs
+ The time period between garbage collection across the username cache.
+ This is a tradeoff between memory utilization (long intervals - say
+ 2 days) and CPU (short intervals - say 1 minute). Only change if you
+ have good reason to.
DOC_END
-NAME: sslproxy_flags
-IFDEF: USE_SSL
-DEFAULT: none
-LOC: Config.ssl_client.flags
-TYPE: string
+NAME: authenticate_ttl
+TYPE: time_t
+DEFAULT: 1 hour
+LOC: Config.authenticateTTL
DOC_START
- Various flags modifying the use of SSL while proxying https:// URLs:
- DONT_VERIFY_PEER Accept certificates even if they fail to
- verify.
- NO_DEFAULT_CA Don't use the default CA list built in
- to OpenSSL.
+ The time a user & their credentials stay in the logged in user cache
+ since their last request. When the garbage interval passes, all user
+ credentials that have passed their TTL are removed from memory.
DOC_END
-NAME: sslpassword_program
-IFDEF: USE_SSL
-DEFAULT: none
-LOC: Config.Program.ssl_password
-TYPE: string
+NAME: authenticate_ip_ttl
+TYPE: time_t
+LOC: Config.authenticateIpTTL
+DEFAULT: 0 seconds
DOC_START
- Specify a program used for entering SSL key passphrases
- when using encrypted SSL certificate keys. If not specified
- keys must either be unencrypted, or Squid started with the -N
- option to allow it to query interactively for the passphrase.
+ If you use proxy authentication and the 'max_user_ip' ACL, this
+ directive controls how long Squid remembers the IP addresses
+ associated with each user. Use a small value (e.g., 60 seconds) if
+ your users might change addresses quickly, as is the case with
+ dialups. You might be safe using a larger value (e.g., 2 hours) in a
+ corporate LAN environment with relatively static address assignments.
DOC_END
COMMENT_START
- OPTIONS WHICH AFFECT THE NEIGHBOR SELECTION ALGORITHM
+ ACCESS CONTROLS
-----------------------------------------------------------------------------
COMMENT_END
-NAME: cache_peer
-TYPE: peer
+NAME: external_acl_type
+TYPE: externalAclHelper
+LOC: Config.externalAclHelperList
DEFAULT: none
-LOC: Config.peers
DOC_START
- To specify other caches in a hierarchy, use the format:
-
- cache_peer hostname type http-port icp-port [options]
+ This option defines external acl classes using a helper program to
+ look up the status
- For example,
+ external_acl_type name [options] FORMAT.. /path/to/helper [helper arguments..]
- # proxy icp
- # hostname type port port options
- # -------------------- -------- ----- ----- -----------
- cache_peer parent.foo.net parent 3128 3130 proxy-only default
- cache_peer sib1.foo.net sibling 3128 3130 proxy-only
- cache_peer sib2.foo.net sibling 3128 3130 proxy-only
+ Options:
- type: either 'parent', 'sibling', or 'multicast'.
+ ttl=n TTL in seconds for cached results (defaults to 3600
+ for 1 hour)
+ negative_ttl=n
+ TTL for cached negative lookups (default same
+ as ttl)
+ children=n number of processes spawn to service external acl
+ lookups of this type. (default 5).
+ concurrency=n concurrency level per process. Only used with helpers
+ capable of processing more than one query at a time.
+ Note: see compatibility note below
+ cache=n result cache size, 0 is unbounded (default)
+ grace= Percentage remaining of TTL where a refresh of a
+ cached entry should be initiated without needing to
+ wait for a new reply. (default 0 for no grace period)
+ protocol=2.5 Compatibility mode for Squid-2.5 external acl helpers
- proxy-port: The port number where the cache listens for proxy
- requests.
+ FORMAT specifications
- icp-port: Used for querying neighbor caches about
- objects. To have a non-ICP neighbor
- specify '7' for the ICP port and make sure the
- neighbor machine has the UDP echo port
- enabled in its /etc/inetd.conf file.
- NOTE: Also requires icp_port option enabled to send/receive
- requests via this method.
+ %LOGIN Authenticated user login name
+ %EXT_USER Username from external acl
+ %IDENT Ident user name
+ %SRC Client IP
+ %SRCPORT Client source port
+ %DST Requested host
+ %PROTO Requested protocol
+ %PORT Requested port
+ %METHOD Request method
+ %MYADDR Squid interface address
+ %MYPORT Squid http_port number
+ %PATH Requested URL-path (including query-string if any)
+ %USER_CERT SSL User certificate in PEM format
+ %USER_CERTCHAIN SSL User certificate chain in PEM format
+ %USER_CERT_xx SSL User certificate subject attribute xx
+ %USER_CA_xx SSL User certificate issuer attribute xx
+ %{Header} HTTP request header
+ %{Hdr:member} HTTP request header list member
+ %{Hdr:;member}
+ HTTP request header list member using ; as
+ list separator. ; can be any non-alphanumeric
+ character.
+ %ACL The ACL name
+ %DATA The ACL arguments. If not used then any arguments
+ is automatically added at the end
- options: proxy-only
- weight=n
- ttl=n
- no-query
- default
- round-robin
- carp
- multicast-responder
- closest-only
- no-digest
- no-netdb-exchange
- no-delay
- login=user:password | PASS | *:password
- connect-timeout=nn
- digest-url=url
- allow-miss
- max-conn=n
- htcp
- htcp-oldsquid
- originserver
- userhash
- sourcehash
- name=xxx
- monitorurl=url
- monitorsize=sizespec
- monitorinterval=seconds
- monitortimeout=seconds
- forceddomain=name
- ssl
- sslcert=/path/to/ssl/certificate
- sslkey=/path/to/ssl/key
- sslversion=1|2|3|4
- sslcipher=...
- ssloptions=...
- front-end-https[=on|auto]
- connection-auth[=on|off|auto]
+ In addition to the above, any string specified in the referencing
+ acl will also be included in the helper request line, after the
+ specified formats (see the "acl external" directive)
- use 'proxy-only' to specify objects fetched
- from this cache should not be saved locally.
+ The helper receives lines per the above format specification,
+ and returns lines starting with OK or ERR indicating the validity
+ of the request and optionally followed by additional keywords with
+ more details.
- use 'weight=n' to affect the selection of a peer
- during any weighted peer-selection mechanisms.
- The weight must be an integer; default is 1,
- larger weights are favored more.
- This option does not affect parent selection if a peering
- protocol is not in use.
+ General result syntax:
- use 'ttl=n' to specify a IP multicast TTL to use
- when sending an ICP queries to this address.
- Only useful when sending to a multicast group.
- Because we don't accept ICP replies from random
- hosts, you must configure other group members as
- peers with the 'multicast-responder' option below.
+ OK/ERR keyword=value ...
- use 'no-query' to NOT send ICP queries to this
- neighbor.
+ Defined keywords:
- use 'default' if this is a parent cache which can
- be used as a "last-resort" if a peer cannot be located
- by any of the peer-selection mechanisms.
- If specified more than once, only the first is used.
+ user= The users name (login also understood)
+ password= The users password (for PROXYPASS login= cache_peer)
+ message= Error message or similar used as %o in error messages
+ (error also understood)
+ log= String to be logged in access.log. Available as
+ %ea in logformat specifications
- use 'round-robin' to define a set of parents which
- should be used in a round-robin fashion in the
- absence of any ICP queries.
+ If protocol=3.0 (the default) then URL escaping is used to protect
+ each value in both requests and responses.
- use 'carp' to define a set of parents which should
- be used as a CARP array. The requests will be
- distributed among the parents based on the CARP load
- balancing hash function based on their weight.
+ If using protocol=2.5 then all values need to be enclosed in quotes
+ if they may contain whitespace, or the whitespace escaped using \.
+ And quotes or \ characters within the keyword value must be \ escaped.
- 'multicast-responder' indicates the named peer
- is a member of a multicast group. ICP queries will
- not be sent directly to the peer, but ICP replies
- will be accepted from it.
+ When using the concurrency= option the protocol is changed by
+ introducing a query channel tag infront of the request/response.
+ The query channel tag is a number between 0 and concurrency-1.
- 'closest-only' indicates that, for ICP_OP_MISS
- replies, we'll only forward CLOSEST_PARENT_MISSes
- and never FIRST_PARENT_MISSes.
+ Compatibility Note: The children= option was named concurrency= in
+ Squid-2.5.STABLE3 and earlier, and was accepted as an alias for the
+ duration of the Squid-2.5 releases to keep compatibility. However,
+ the meaning of concurrency= option has changed in Squid-2.6 to match
+ that of Squid-3 and the old syntax no longer works.
+DOC_END
- use 'no-digest' to NOT request cache digests from
- this neighbor.
+NAME: acl
+TYPE: acl
+LOC: Config.aclList
+DEFAULT: none
+DOC_START
+ Defining an Access List
- 'no-netdb-exchange' disables requesting ICMP
- RTT database (NetDB) from the neighbor.
+ acl aclname acltype string1 ...
+ acl aclname acltype "file" ...
- use 'no-delay' to prevent access to this neighbor
- from influencing the delay pools.
+ when using "file", the file should contain one item per line
- use 'login=user:password' if this is a personal/workgroup
- proxy and your parent requires proxy authentication.
- Note: The string can include URL escapes (i.e. %20 for
- spaces). This also means % must be written as %%.
+ acltype is one of the types described below
- use 'login=PASS' if users must authenticate against
- the upstream proxy or in the case of a reverse proxy
- configuration, the origin web server. This will pass
- the users credentials as they are to the peer.
- Note: To combine this with local authentication the Basic
- authentication scheme must be used, and both servers must
- share the same user database as HTTP only allows for
- a single login (one for proxy, one for origin server).
- Also be warned this will expose your users proxy
- password to the peer. USE WITH CAUTION
+ By default, regular expressions are CASE-SENSITIVE. To make
+ them case-insensitive, use the -i option.
- use 'login=*:password' to pass the username to the
- upstream cache, but with a fixed password. This is meant
- to be used when the peer is in another administrative
- domain, but it is still needed to identify each user.
- The star can optionally be followed by some extra
- information which is added to the username. This can
- be used to identify this proxy to the peer, similar to
- the login=username:password option above.
+ acl aclname src ip-address/netmask ... (clients IP address)
+ acl aclname src addr1-addr2/netmask ... (range of addresses)
+ acl aclname dst ip-address/netmask ... (URL host's IP address)
+ acl aclname myip ip-address/netmask ... (local socket IP address)
- use 'connect-timeout=nn' to specify a peer
- specific connect timeout (also see the
- peer_connect_timeout directive)
+ acl aclname arp mac-address ... (xx:xx:xx:xx:xx:xx notation)
+ # The arp ACL requires the special configure option --enable-arp-acl.
+ # Furthermore, the arp ACL code is not portable to all operating systems.
+ # It works on Linux, Solaris, FreeBSD and some other *BSD variants.
+ #
+ # NOTE: Squid can only determine the MAC address for clients that are on
+ # the same subnet. If the client is on a different subnet, then Squid cannot
+ # find out its MAC address.
- use 'digest-url=url' to tell Squid to fetch the cache
- digest (if digests are enabled) for this host from
- the specified URL rather than the Squid default
- location.
+ acl aclname srcdomain .foo.com ... # reverse lookup, client IP
+ acl aclname dstdomain .foo.com ... # Destination server from URL
+ acl aclname srcdom_regex [-i] xxx ... # regex matching client name
+ acl aclname dstdom_regex [-i] xxx ... # regex matching server
+ # For dstdomain and dstdom_regex a reverse lookup is tried if a IP
+ # based URL is used and no match is found. The name "none" is used
+ # if the reverse lookup fails.
- use 'allow-miss' to disable Squid's use of only-if-cached
- when forwarding requests to siblings. This is primarily
- useful when icp_hit_stale is used by the sibling. To
- extensive use of this option may result in forwarding
- loops, and you should avoid having two-way peerings
- with this option. (for example to deny peer usage on
- requests from peer by denying cache_peer_access if the
- source is a peer)
+ acl aclname time [day-abbrevs] [h1:m1-h2:m2]
+ day-abbrevs:
+ S - Sunday
+ M - Monday
+ T - Tuesday
+ W - Wednesday
+ H - Thursday
+ F - Friday
+ A - Saturday
+ h1:m1 must be less than h2:m2
+ acl aclname url_regex [-i] ^http:// ... # regex matching on whole URL
+ acl aclname urlpath_regex [-i] \.gif$ ... # regex matching on URL path
+ acl aclname urllogin [-i] [^a-zA-Z0-9] ... # regex matching on URL login field
+ acl aclname port 80 70 21 ...
+ acl aclname port 0-1024 ... # ranges allowed
+ acl aclname myport 3128 ... # (local socket TCP port)
+ acl aclname proto HTTP FTP ...
+ acl aclname method GET POST ...
+ acl aclname browser [-i] regexp ...
+ # pattern match on User-Agent header (see also req_header below)
+ acl aclname referer_regex [-i] regexp ...
+ # pattern match on Referer header
+ # Referer is highly unreliable, so use with care
+ acl aclname ident username ...
+ acl aclname ident_regex [-i] pattern ...
+ # string match on ident output.
+ # use REQUIRED to accept any non-null ident.
+ acl aclname src_as number ...
+ acl aclname dst_as number ...
+ # Except for access control, AS numbers can be used for
+ # routing of requests to specific caches. Here's an
+ # example for routing all requests for AS#1241 and only
+ # those to mycache.mydomain.net:
+ # acl asexample dst_as 1241
+ # cache_peer_access mycache.mydomain.net allow asexample
+ # cache_peer_access mycache_mydomain.net deny all
- use 'max-conn=n' to limit the amount of connections Squid
- may open to this peer.
+ acl aclname proxy_auth [-i] username ...
+ acl aclname proxy_auth_regex [-i] pattern ...
+ # list of valid usernames
+ # use REQUIRED to accept any valid username.
+ #
+ # NOTE: when a Proxy-Authentication header is sent but it is not
+ # needed during ACL checking the username is NOT logged
+ # in access.log.
+ #
+ # NOTE: proxy_auth requires a EXTERNAL authentication program
+ # to check username/password combinations (see
+ # auth_param directive).
+ #
+ # NOTE: proxy_auth can't be used in a transparent proxy as
+ # the browser needs to be configured for using a proxy in order
+ # to respond to proxy authentication.
+
+ acl aclname snmp_community string ...
+ # A community string to limit access to your SNMP Agent
+ # Example:
+ #
+ # acl snmppublic snmp_community public
+
+ acl aclname maxconn number
+ # This will be matched when the client's IP address has
+ # more than HTTP connections established.
+
+ acl aclname max_user_ip [-s] number
+ # This will be matched when the user attempts to log in from more
+ # than different ip addresses. The authenticate_ip_ttl
+ # parameter controls the timeout on the ip entries.
+ # If -s is specified the limit is strict, denying browsing
+ # from any further IP addresses until the ttl has expired. Without
+ # -s Squid will just annoy the user by "randomly" denying requests.
+ # (the counter is reset each time the limit is reached and a
+ # request is denied)
+ # NOTE: in acceleration mode or where there is mesh of child proxies,
+ # clients may appear to come from multiple addresses if they are
+ # going through proxy farms, so a limit of 1 may cause user problems.
+
+ acl aclname req_mime_type mime-type1 ...
+ # regex match against the mime type of the request generated
+ # by the client. Can be used to detect file upload or some
+ # types HTTP tunneling requests.
+ # NOTE: This does NOT match the reply. You cannot use this
+ # to match the returned file type.
+
+ acl aclname req_header header-name [-i] any\.regex\.here
+ # regex match against any of the known request headers. May be
+ # thought of as a superset of "browser", "referer" and "mime-type"
+ # ACLs.
+
+ acl aclname rep_mime_type mime-type1 ...
+ # regex match against the mime type of the reply received by
+ # squid. Can be used to detect file download or some
+ # types HTTP tunneling requests.
+ # NOTE: This has no effect in http_access rules. It only has
+ # effect in rules that affect the reply data stream such as
+ # http_reply_access.
+
+ acl aclname rep_header header-name [-i] any\.regex\.here
+ # regex match against any of the known reply headers. May be
+ # thought of as a superset of "browser", "referer" and "mime-type"
+ # ACLs.
+ #
+ # Example:
+ #
+ # acl many_spaces rep_header Content-Disposition -i [[:space:]]{3,}
+
+ acl acl_name external class_name [arguments...]
+ # external ACL lookup via a helper class defined by the
+ # external_acl_type directive.
+
+ acl urlgroup group1 ...
+ # match against the urlgroup as indicated by redirectors
+
+ acl aclname user_cert attribute values...
+ # match against attributes in a user SSL certificate
+ # attribute is one of DN/C/O/CN/L/ST
+
+ acl aclname ca_cert attribute values...
+ # match against attributes a users issuing CA SSL certificate
+ # attribute is one of DN/C/O/CN/L/ST
+
+ acl aclname ext_user username ...
+ acl aclname ext_user_regex [-i] pattern ...
+ # string match on username returned by external acl helper
+ # use REQUIRED to accept any non-null user name.
+
+Examples:
+acl macaddress arp 09:00:2b:23:45:67
+acl myexample dst_as 1241
+acl password proxy_auth REQUIRED
+acl fileupload req_mime_type -i ^multipart/form-data$
+acl javascript rep_mime_type -i ^application/x-javascript$
+
+NOCOMMENT_START
+#Recommended minimum configuration:
+acl all src 0.0.0.0/0.0.0.0
+acl manager proto cache_object
+acl localhost src 127.0.0.1/255.255.255.255
+acl to_localhost dst 127.0.0.0/8
+acl SSL_ports port 443
+acl Safe_ports port 80 # http
+acl Safe_ports port 21 # ftp
+acl Safe_ports port 443 # https
+acl Safe_ports port 70 # gopher
+acl Safe_ports port 210 # wais
+acl Safe_ports port 1025-65535 # unregistered ports
+acl Safe_ports port 280 # http-mgmt
+acl Safe_ports port 488 # gss-http
+acl Safe_ports port 591 # filemaker
+acl Safe_ports port 777 # multiling http
+acl CONNECT method CONNECT
+NOCOMMENT_END
+DOC_END
+
+NAME: http_access
+TYPE: acl_access
+LOC: Config.accessList.http
+DEFAULT: none
+DEFAULT_IF_NONE: deny all
+DOC_START
+ Allowing or Denying access based on defined access lists
+
+ Access to the HTTP port:
+ http_access allow|deny [!]aclname ...
+
+ NOTE on default values:
+
+ If there are no "access" lines present, the default is to deny
+ the request.
+
+ If none of the "access" lines cause a match, the default is the
+ opposite of the last line in the list. If the last line was
+ deny, the default is allow. Conversely, if the last line
+ is allow, the default will be deny. For these reasons, it is a
+ good idea to have an "deny all" or "allow all" entry at the end
+ of your access lists to avoid potential confusion.
+
+NOCOMMENT_START
+#Recommended minimum configuration:
+#
+# Only allow cachemgr access from localhost
+http_access allow manager localhost
+http_access deny manager
+# Deny requests to unknown ports
+http_access deny !Safe_ports
+# Deny CONNECT to other than SSL ports
+http_access deny CONNECT !SSL_ports
+#
+# We strongly recommend the following be uncommented to protect innocent
+# web applications running on the proxy server who think the only
+# one who can access services on "localhost" is a local user
+#http_access deny to_localhost
+#
+# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
+
+# Example rule allowing access from your local networks. Adapt
+# to list your (internal) IP networks from where browsing should
+# be allowed
+#acl our_networks src 192.168.1.0/24 192.168.2.0/24
+#http_access allow our_networks
- use 'htcp' to send HTCP, instead of ICP, queries
- to the neighbor. You probably also want to
- set the "icp port" to 4827 instead of 3130.
+# And finally deny all other access to this proxy
+http_access deny all
+NOCOMMENT_END
+DOC_END
- use 'htcp-oldsquid' to send HTCP to old Squid versions
+NAME: http_access2
+TYPE: acl_access
+LOC: Config.accessList.http2
+DEFAULT: none
+DOC_START
+ Allowing or Denying access based on defined access lists
- 'originserver' causes this parent peer to be contacted as
- a origin server. Meant to be used in accelerator setups.
+ Identical to http_access, but runs after redirectors. If not set
+ then only http_access is used.
+DOC_END
- use 'userhash' to load-balance amongst a set of parents
- based on the client proxy_auth or ident username.
+NAME: http_reply_access
+TYPE: acl_access
+LOC: Config.accessList.reply
+DEFAULT: none
+DEFAULT_IF_NONE: allow all
+DOC_START
+ Allow replies to client requests. This is complementary to http_access.
- use 'sourcehash' to load-balance amongst a set of parents
- based on the client source ip.
+ http_reply_access allow|deny [!] aclname ...
- use 'name=xxx' if you have multiple peers on the same
- host but different ports. This name can be used to
- differentiate the peers in cache_peer_access and similar
- directives.
+ NOTE: if there are no access lines present, the default is to allow
+ all replies
- use 'monitorurl=url' to have periodically request a given
- URL from the peer, and only consider the peer as alive
- if this monitoring is successful (default none)
+ If none of the access lines cause a match the opposite of the
+ last line will apply. Thus it is good practice to end the rules
+ with an "allow all" or "deny all" entry.
+DOC_END
- use 'monitorsize=min[-max]' to limit the size range of
- 'monitorurl' replies considered valid. Defaults to 0 to
- accept any size replies as valid.
+NAME: icp_access
+TYPE: acl_access
+LOC: Config.accessList.icp
+DEFAULT: none
+DEFAULT_IF_NONE: deny all
+DOC_START
+ Allowing or Denying access to the ICP port based on defined
+ access lists
- use 'monitorinterval=seconds' to change frequency of
- how often the peer is monitored with 'monitorurl'
- (default 300 for a 5 minute interval). If set to 0
- then monitoring is disabled even if a URL is defined.
+ icp_access allow|deny [!]aclname ...
- use 'monitortimeout=seconds' to change the timeout of
- 'monitorurl'. Defaults to 'monitorinterval'.
+ See http_access for details
- use 'forceddomain=name' to forcibly set the Host header
- of requests forwarded to this peer. Useful in accelerator
- setups where the server (peer) expects a certain domain
- name and using redirectors to feed this domain name
- is not feasible.
+NOCOMMENT_START
+#Allow ICP queries from everyone
+icp_access allow all
+NOCOMMENT_END
+DOC_END
- use 'ssl' to indicate connections to this peer should
- be SSL/TLS encrypted.
+NAME: htcp_access
+IFDEF: USE_HTCP
+TYPE: acl_access
+LOC: Config.accessList.htcp
+DEFAULT: none
+DEFAULT_IF_NONE: deny all
+DOC_START
+ Allowing or Denying access to the HTCP port based on defined
+ access lists
- use 'sslcert=/path/to/ssl/certificate' to specify a client
- SSL certificate to use when connecting to this peer.
+ htcp_access allow|deny [!]aclname ...
- use 'sslkey=/path/to/ssl/key' to specify the private SSL
- key corresponding to sslcert above. If 'sslkey' is not
- specified 'sslcert' is assumed to reference a
- combined file containing both the certificate and the key.
+ See http_access for details
- use sslversion=1|2|3|4 to specify the SSL version to use
- when connecting to this peer
- 1 = automatic (default)
- 2 = SSL v2 only
- 3 = SSL v3 only
- 4 = TLS v1 only
+#Allow HTCP queries from everyone
+htcp_access allow all
+DOC_END
- use sslcipher=... to specify the list of valid SSL ciphers
- to use when connecting to this peer.
+NAME: htcp_clr_access
+IFDEF: USE_HTCP
+TYPE: acl_access
+LOC: Config.accessList.htcp_clr
+DEFAULT: none
+DEFAULT_IF_NONE: deny all
+DOC_START
+ Allowing or Denying access to purge content using HTCP based
+ on defined access lists
- use ssloptions=... to specify various SSL engine options:
- NO_SSLv2 Disallow the use of SSLv2
- NO_SSLv3 Disallow the use of SSLv3
- NO_TLSv1 Disallow the use of TLSv1
- See src/ssl_support.c or the OpenSSL documentation for
- a more complete list.
+ htcp_clr_access allow|deny [!]aclname ...
- use sslcafile=... to specify a file containing
- additional CA certificates to use when verifying the
- peer certificate.
+ See http_access for details
- use sslcapath=... to specify a directory containing
- additional CA certificates to use when verifying the
- peer certificate.
+#Allow HTCP CLR requests from trusted peers
+acl htcp_clr_peer src 172.16.1.2
+htcp_clr_access allow htcp_clr_peer
+DOC_END
- use sslcrlfile=... to specify a certificate revocation
- list file to use when verifying the peer certificate.
+NAME: miss_access
+TYPE: acl_access
+LOC: Config.accessList.miss
+DEFAULT: none
+DOC_START
+ Use to force your neighbors to use you as a sibling instead of
+ a parent. For example:
- use sslflags=... to specify various flags modifying the
- SSL implementation:
- DONT_VERIFY_PEER
- Accept certificates even if they fail to
- verify.
- NO_DEFAULT_CA
- Don't use the default CA list built in
- to OpenSSL.
+ acl localclients src 172.16.0.0/16
+ miss_access allow localclients
+ miss_access deny !localclients
- use ssldomain= to specify the peer name as advertised
- in it's certificate. Used for verifying the correctness
- of the received peer certificate. If not specified the
- peer hostname will be used.
+ This means only your local clients are allowed to fetch
+ MISSES and all other clients can only fetch HITS.
- use front-end-https to enable the "Front-End-Https: On"
- header needed when using Squid as a SSL frontend in front
- of Microsoft OWA. See MS KB document Q307347 for details
- on this header. If set to auto the header will
- only be added if the request is forwarded as a https://
- URL.
+ By default, allow all clients who passed the http_access rules
+ to fetch MISSES from us.
- use connection-auth=off to tell Squid that this peer does
- not support Microsoft connection oriented authentication,
- and any such challenges received from there should be
- ignored. Default is auto to automatically determine the
- status of the peer.
+NOCOMMENT_START
+#Default setting:
+# miss_access allow all
+NOCOMMENT_END
DOC_END
-NAME: cache_peer_domain cache_host_domain
-TYPE: hostdomain
+NAME: ident_lookup_access
+TYPE: acl_access
+IFDEF: USE_IDENT
DEFAULT: none
-LOC: none
+DEFAULT_IF_NONE: deny all
+LOC: Config.accessList.identLookup
DOC_START
- Use to limit the domains for which a neighbor cache will be
- queried. Usage:
+ A list of ACL elements which, if matched, cause an ident
+ (RFC931) lookup to be performed for this request. For
+ example, you might choose to always perform ident lookups
+ for your main multi-user Unix boxes, but not for your Macs
+ and PCs. By default, ident lookups are not performed for
+ any requests.
- cache_peer_domain cache-host domain [domain ...]
- cache_peer_domain cache-host !domain
+ To enable ident lookups for specific client addresses, you
+ can follow this example:
- For example, specifying
+ acl ident_aware_hosts src 198.168.1.0/255.255.255.0
+ ident_lookup_access allow ident_aware_hosts
+ ident_lookup_access deny all
- cache_peer_domain parent.foo.net .edu
+ Only src type ACL checks are fully supported. A src_domain
+ ACL might work at times, but it will not always provide
+ the correct result.
+DOC_END
- has the effect such that UDP query packets are sent to
- 'bigserver' only when the requested object exists on a
- server in the .edu domain. Prefixing the domain name
- with '!' means the cache will be queried for objects
- NOT in that domain.
+NAME: reply_header_max_size
+COMMENT: (KB)
+TYPE: b_size_t
+DEFAULT: 20 KB
+LOC: Config.maxReplyHeaderSize
+DOC_START
+ This specifies the maximum size for HTTP headers in a reply.
+ Reply headers are usually relatively small (about 512 bytes).
+ Placing a limit on the reply header size will catch certain
+ bugs (for example with persistent connections) and possibly
+ buffer-overflow or denial-of-service attacks.
+DOC_END
- NOTE: * Any number of domains may be given for a cache-host,
- either on the same or separate lines.
- * When multiple domains are given for a particular
- cache-host, the first matched domain is applied.
- * Cache hosts with no domain restrictions are queried
- for all requests.
- * There are no defaults.
- * There is also a 'cache_peer_access' tag in the ACL
- section.
+NAME: reply_body_max_size
+COMMENT: bytes allow|deny acl acl...
+TYPE: body_size_t
+DEFAULT: none
+DEFAULT_IF_NONE: 0 allow all
+LOC: Config.ReplyBodySize
+DOC_START
+ This option specifies the maximum size of a reply body in bytes.
+ It can be used to prevent users from downloading very large files,
+ such as MP3's and movies. When the reply headers are received,
+ the reply_body_max_size lines are processed, and the first line with
+ a result of "allow" is used as the maximum body size for this reply.
+ This size is checked twice. First when we get the reply headers,
+ we check the content-length value. If the content length value exists
+ and is larger than the allowed size, the request is denied and the
+ user receives an error message that says "the request or reply
+ is too large." If there is no content-length, and the reply
+ size exceeds this limit, the client's connection is just closed
+ and they will receive a partial reply.
+
+ WARNING: downstream caches probably can not detect a partial reply
+ if there is no content-length header, so they will cache
+ partial responses and give them out as hits. You should NOT
+ use this option if you have downstream caches.
+
+ If you set this parameter to zero (the default), there will be
+ no limit imposed.
DOC_END
-NAME: neighbor_type_domain
-TYPE: hostdomaintype
+COMMENT_START
+ OPTIONS FOR X-Forwarded-For
+ -----------------------------------------------------------------------------
+COMMENT_END
+
+NAME: follow_x_forwarded_for
+TYPE: acl_access
+IFDEF: FOLLOW_X_FORWARDED_FOR
+LOC: Config.accessList.followXFF
DEFAULT: none
-LOC: none
+DEFAULT_IF_NONE: deny all
DOC_START
- usage: neighbor_type_domain neighbor parent|sibling domain domain ...
+ Allowing or Denying the X-Forwarded-For header to be followed to
+ find the original source of a request.
- Modifying the neighbor type for specific domains is now
- possible. You can treat some domains differently than the the
- default neighbor type specified on the 'cache_peer' line.
- Normally it should only be necessary to list domains which
- should be treated differently because the default neighbor type
- applies for hostnames which do not match domains listed here.
+ Requests may pass through a chain of several other proxies
+ before reaching us. The X-Forwarded-For header will contain a
+ comma-separated list of the IP addresses in the chain, with the
+ rightmost address being the most recent.
-EXAMPLE:
- cache_peer parent cache.foo.org 3128 3130
- neighbor_type_domain cache.foo.org sibling .com .net
- neighbor_type_domain cache.foo.org sibling .au .de
-DOC_END
+ If a request reaches us from a source that is allowed by this
+ configuration item, then we consult the X-Forwarded-For header
+ to see where that host received the request from. If the
+ X-Forwarded-For header contains multiple addresses, and if
+ acl_uses_indirect_client is on, then we continue backtracking
+ until we reach an address for which we are not allowed to
+ follow the X-Forwarded-For header, or until we reach the first
+ address in the list. (If acl_uses_indirect_client is off, then
+ it's impossible to backtrack through more than one level of
+ X-Forwarded-For addresses.)
-NAME: dead_peer_timeout
-COMMENT: (seconds)
-DEFAULT: 10 seconds
-TYPE: time_t
-LOC: Config.Timeout.deadPeer
-DOC_START
- This controls how long Squid waits to declare a peer cache
- as "dead." If there are no ICP replies received in this
- amount of time, Squid will declare the peer dead and not
- expect to receive any further ICP replies. However, it
- continues to send ICP queries, and will mark the peer as
- alive upon receipt of the first subsequent ICP reply.
+ The end result of this process is an IP address that we will
+ refer to as the indirect client address. This address may
+ be treated as the client address for access control, delay
+ pools and logging, depending on the acl_uses_indirect_client,
+ delay_pool_uses_indirect_client and log_uses_indirect_client
+ options.
- This timeout also affects when Squid expects to receive ICP
- replies from peers. If more than 'dead_peer' seconds have
- passed since the last ICP reply was received, Squid will not
- expect to receive an ICP reply on the next query. Thus, if
- your time between requests is greater than this timeout, you
- will see a lot of requests sent DIRECT to origin servers
- instead of to your parents.
+ SECURITY CONSIDERATIONS:
+
+ Any host for which we follow the X-Forwarded-For header
+ can place incorrect information in the header, and Squid
+ will use the incorrect information as if it were the
+ source address of the request. This may enable remote
+ hosts to bypass any access control restrictions that are
+ based on the client's source addresses.
+
+ For example:
+
+ acl localhost src 127.0.0.1
+ acl my_other_proxy srcdomain .proxy.example.com
+ follow_x_forwarded_for allow localhost
+ follow_x_forwarded_for allow my_other_proxy
DOC_END
-NAME: hierarchy_stoplist
-TYPE: wordlist
-DEFAULT: none
-LOC: Config.hierarchy_stoplist
+NAME: acl_uses_indirect_client
+COMMENT: on|off
+TYPE: onoff
+IFDEF: FOLLOW_X_FORWARDED_FOR
+DEFAULT: on
+LOC: Config.onoff.acl_uses_indirect_client
DOC_START
- A list of words which, if found in a URL, cause the object to
- be handled directly by this cache. In other words, use this
- to not query neighbor caches for certain objects. You may
- list this option multiple times. Note: never_direct overrides
- this option.
-NOCOMMENT_START
-#We recommend you to use at least the following line.
-hierarchy_stoplist cgi-bin ?
-NOCOMMENT_END
+ Controls whether the indirect client address
+ (see follow_x_forwarded_for) is used instead of the
+ direct client address in acl matching.
DOC_END
-NAME: cache no_cache
-TYPE: acl_access
-DEFAULT: none
-LOC: Config.accessList.noCache
+NAME: delay_pool_uses_indirect_client
+COMMENT: on|off
+TYPE: onoff
+IFDEF: FOLLOW_X_FORWARDED_FOR && DELAY_POOLS
+DEFAULT: on
+LOC: Config.onoff.delay_pool_uses_indirect_client
DOC_START
- A list of ACL elements which, if matched, cause the request to
- not be satisfied from the cache and the reply to not be cached.
- In other words, use this to force certain objects to never be cached.
-
- You must use the word 'DENY' to indicate the ACL names which should
- NOT be cached.
-
- Default is to allow all to be cached
-NOCOMMENT_START
-#We recommend you to use the following two lines.
-acl QUERY urlpath_regex cgi-bin \?
-cache deny QUERY
-NOCOMMENT_END
+ Controls whether the indirect client address
+ (see follow_x_forwarded_for) is used instead of the
+ direct client address in delay pools.
DOC_END
-NAME: wais_relay_host
-TYPE: string
-DEFAULT: none
-LOC: Config.Wais.relayHost
-DOC_NONE
-
-NAME: wais_relay_port
-TYPE: ushort
-DEFAULT: 0
-LOC: Config.Wais.relayPort
+NAME: log_uses_indirect_client
+COMMENT: on|off
+TYPE: onoff
+IFDEF: FOLLOW_X_FORWARDED_FOR
+DEFAULT: on
+LOC: Config.onoff.log_uses_indirect_client
DOC_START
- Relay WAIS request to host (1st arg) at port (2 arg).
+ Controls whether the indirect client address
+ (see follow_x_forwarded_for) is used instead of the
+ direct client address in the access log.
DOC_END
COMMENT_START
- MEMORY CACHE OPTIONS
+ NETWORK OPTIONS
-----------------------------------------------------------------------------
COMMENT_END
-NAME: cache_mem
-COMMENT: (bytes)
-TYPE: b_size_t
-DEFAULT: 8 MB
-LOC: Config.memMaxSize
+NAME: http_port ascii_port
+TYPE: http_port_list
+DEFAULT: none
+LOC: Config.Sockaddr.http
DOC_START
- NOTE: THIS PARAMETER DOES NOT SPECIFY THE MAXIMUM PROCESS SIZE.
- IT ONLY PLACES A LIMIT ON HOW MUCH ADDITIONAL MEMORY SQUID WILL
- USE AS A MEMORY CACHE OF OBJECTS. SQUID USES MEMORY FOR OTHER
- THINGS AS WELL. SEE THE SQUID FAQ SECTION 8 FOR DETAILS.
+ Usage: port [options]
+ hostname:port [options]
+ 1.2.3.4:port [options]
- 'cache_mem' specifies the ideal amount of memory to be used
- for:
- * In-Transit objects
- * Hot Objects
- * Negative-Cached objects
+ The socket addresses where Squid will listen for HTTP client
+ requests. You may specify multiple socket addresses.
+ There are three forms: port alone, hostname with port, and
+ IP address with port. If you specify a hostname or IP
+ address, Squid binds the socket to that specific
+ address. This replaces the old 'tcp_incoming_address'
+ option. Most likely, you do not need to bind to a specific
+ address, so you can use the port number alone.
- Data for these objects are stored in 4 KB blocks. This
- parameter specifies the ideal upper limit on the total size of
- 4 KB blocks allocated. In-Transit objects take the highest
- priority.
+ If you are running Squid in accelerator mode, you
+ probably want to listen on port 80 also, or instead.
- In-transit objects have priority over the others. When
- additional space is needed for incoming data, negative-cached
- and hot objects will be released. In other words, the
- negative-cached and hot objects will fill up any unused space
- not needed for in-transit objects.
+ You may specify multiple socket addresses on multiple lines.
- If circumstances require, this limit will be exceeded.
- Specifically, if your incoming request rate requires more than
- 'cache_mem' of memory to hold in-transit objects, Squid will
- exceed this limit to satisfy the new requests. When the load
- decreases, blocks will be freed until the high-water mark is
- reached. Thereafter, blocks will be used to store hot
- objects.
-DOC_END
+ Options:
-NAME: maximum_object_size_in_memory
-COMMENT: (bytes)
-TYPE: b_size_t
-DEFAULT: 8 KB
-LOC: Config.Store.maxInMemObjSize
-DOC_START
- Objects greater than this size will not be attempted to kept in
- the memory cache. This should be set high enough to keep objects
- accessed frequently in memory to improve performance whilst low
- enough to keep larger objects from hoarding cache_mem.
-DOC_END
+ transparent Support for transparent interception of
+ outgoing requests without browser settings.
-NAME: memory_replacement_policy
-TYPE: removalpolicy
-LOC: Config.memPolicy
-DEFAULT: lru
-DOC_START
- The memory replacement policy parameter determines which
- objects are purged from memory when memory space is needed.
+ tproxy Support Linux TPROXY for spoofing outgoing
+ connections using the client IP address.
- See cache_replacement_policy for details.
+ accel Accelerator mode. Also needs at least one
+ of vhost/vport/defaultsite.
+
+ defaultsite=domainname
+ What to use for the Host: header if it is not present
+ in a request. Determines what site (not origin server)
+ accelerators should consider the default.
+ Implies accel.
+
+ vhost Accelerator mode using Host header for virtual
+ domain support. Implies accel.
+
+ vport Accelerator with IP based virtual host support.
+ Implies accel.
+
+ vport=NN As above, but uses specified port number rather
+ than the http_port number. Implies accel.
+
+ urlgroup= Default urlgroup to mark requests with (see
+ also acl urlgroup and url_rewrite_program)
+
+ protocol= Protocol to reconstruct accelerated requests with.
+ Defaults to http.
+
+ no-connection-auth
+ Prevent forwarding of Microsoft connection oriented
+ authentication (NTLM, Negotiate and Kerberos)
+
+ If you run Squid on a dual-homed machine with an internal
+ and an external interface we recommend you to specify the
+ internal address:port in http_port. This way Squid will only be
+ visible on the internal address.
+
+NOCOMMENT_START
+# Squid normally listens to port 3128
+http_port @DEFAULT_HTTP_PORT@
+NOCOMMENT_END
DOC_END
-COMMENT_START
- DISK CACHE OPTIONS
- -----------------------------------------------------------------------------
-COMMENT_END
-
-NAME: cache_dir
-TYPE: cachedir
+NAME: https_port
+IFDEF: USE_SSL
+TYPE: https_port_list
DEFAULT: none
-DEFAULT_IF_NONE: ufs @DEFAULT_SWAP_DIR@ 100 16 256
-LOC: Config.cacheSwap
+LOC: Config.Sockaddr.https
DOC_START
- Usage:
+ Usage: [ip:]port cert=certificate.pem [key=key.pem] [options...]
- cache_dir Type Directory-Name Fs-specific-data [options]
+ The socket address where Squid will listen for HTTPS client
+ requests.
- You can specify multiple cache_dir lines to spread the
- cache among different disk partitions.
+ This is really only useful for situations where you are running
+ squid in accelerator mode and you want to do the SSL work at the
+ accelerator level.
- Type specifies the kind of storage system to use. Only "ufs"
- is built by default. To enable any of the other storage systems
- see the --enable-storeio configure option.
+ You may specify multiple socket addresses on multiple lines,
+ each with their own SSL certificate and/or options.
- 'Directory' is a top-level directory where cache swap
- files will be stored. If you want to use an entire disk
- for caching, this can be the mount-point directory.
- The directory must exist and be writable by the Squid
- process. Squid will NOT create this directory for you.
- Only using COSS, a raw disk device or a stripe file can
- be specified, but the configuration of the "cache_swap_log"
- tag is mandatory.
+ Options:
- The ufs store type:
+ accel Accelerator mode. Also needs at least one of
+ defaultsite or vhost.
- "ufs" is the old well-known Squid storage format that has always
- been there.
+ defaultsite= The name of the https site presented on
+ this port. Implies accel.
- cache_dir ufs Directory-Name Mbytes L1 L2 [options]
+ vhost Accelerator mode using Host header for virtual
+ domain support. Requires a wildcard certificate
+ or other certificate valid for more than one domain.
+ Implies accel.
- 'Mbytes' is the amount of disk space (MB) to use under this
- directory. The default is 100 MB. Change this to suit your
- configuration. Do NOT put the size of your disk drive here.
- Instead, if you want Squid to use the entire disk drive,
- subtract 20% and use that value.
+ urlgroup= Default urlgroup to mark requests with (see
+ also acl urlgroup and url_rewrite_program).
- 'Level-1' is the number of first-level subdirectories which
- will be created under the 'Directory'. The default is 16.
+ protocol= Protocol to reconstruct accelerated requests with.
+ Defaults to https.
- 'Level-2' is the number of second-level subdirectories which
- will be created under each first-level directory. The default
- is 256.
+ cert= Path to SSL certificate (PEM format).
- The aufs store type:
+ key= Path to SSL private key file (PEM format)
+ if not specified, the certificate file is
+ assumed to be a combined certificate and
+ key file.
- "aufs" uses the same storage format as "ufs", utilizing
- POSIX-threads to avoid blocking the main Squid process on
- disk-I/O. This was formerly known in Squid as async-io.
+ version= The version of SSL/TLS supported
+ 1 automatic (default)
+ 2 SSLv2 only
+ 3 SSLv3 only
+ 4 TLSv1 only
- cache_dir aufs Directory-Name Mbytes L1 L2 [options]
+ cipher= Colon separated list of supported ciphers.
- see argument descriptions under ufs above
+ options= Various SSL engine options. The most important
+ being:
+ NO_SSLv2 Disallow the use of SSLv2
+ NO_SSLv3 Disallow the use of SSLv3
+ NO_TLSv1 Disallow the use of TLSv1
+ SINGLE_DH_USE Always create a new key when using
+ temporary/ephemeral DH key exchanges
+ See src/ssl_support.c or OpenSSL SSL_CTX_set_options
+ documentation for a complete list of options.
- The diskd store type:
+ clientca= File containing the list of CAs to use when
+ requesting a client certificate.
- "diskd" uses the same storage format as "ufs", utilizing a
- separate process to avoid blocking the main Squid process on
- disk-I/O.
+ cafile= File containing additional CA certificates to
+ use when verifying client certificates. If unset
+ clientca will be used.
- cache_dir diskd Directory-Name Mbytes L1 L2 [options] [Q1=n] [Q2=n]
+ capath= Directory containing additional CA certificates
+ and CRL lists to use when verifying client certificates.
- see argument descriptions under ufs above
+ crlfile= File of additional CRL lists to use when verifying
+ the client certificate, in addition to CRLs stored in
+ the capath. Implies VERIFY_CRL flag below.
- Q1 specifies the number of unacknowledged I/O requests when Squid
- stops opening new files. If this many messages are in the queues,
- Squid won't open new files. Default is 64
+ dhparams= File containing DH parameters for temporary/ephemeral
+ DH key exchanges.
- Q2 specifies the number of unacknowledged messages when Squid
- starts blocking. If this many messages are in the queues,
- Squid blocks until it receives some replies. Default is 72
+ sslflags= Various flags modifying the use of SSL:
+ DELAYED_AUTH
+ Don't request client certificates
+ immediately, but wait until acl processing
+ requires a certificate (not yet implemented).
+ NO_DEFAULT_CA
+ Don't use the default CA lists built in
+ to OpenSSL.
+ NO_SESSION_REUSE
+ Don't allow for session reuse. Each connection
+ will result in a new SSL session.
+ VERIFY_CRL
+ Verify CRL lists when accepting client
+ certificates.
+ VERIFY_CRL_ALL
+ Verify CRL lists for all certificates in the
+ client certificate chain.
- When Q1 < Q2 (the default), the cache directory is optimized
- for lower response time at the expense of a decrease in hit
- ratio. If Q1 > Q2, the cache directory is optimized for
- higher hit ratio at the expense of an increase in response
- time.
+ sslcontext= SSL session ID context identifier.
- The coss store type:
+ vport Accelerator with IP based virtual host support.
- block-size=n defines the "block size" for COSS cache_dir's.
- Squid uses file numbers as block numbers. Since file numbers
- are limited to 24 bits, the block size determines the maximum
- size of the COSS partition. The default is 512 bytes, which
- leads to a maximum cache_dir size of 512<<24, or 8 GB. Note
- you should not change the COSS block size after Squid
- has written some objects to the cache_dir.
+ vport=NN As above, but uses specified port number rather
+ than the https_port number. Implies accel.
- overwrite-percent=n defines the percentage of disk that COSS
- must write to before a given object will be moved to the
- current stripe. A value of "n" closer to 100 will cause COSS
- to waste less disk space by having multiple copies of an object
- on disk, but will increase the chances of overwriting a popular
- object as COSS overwrites stripes. A value of "n" close to 0
- will cause COSS to keep all current objects in the current COSS
- stripe at the expense of the hit rate. The default value of 50
- will allow any given object to be stored on disk a maximum of
- 2 times.
+DOC_END
- max-stripe-waste=n defines the maximum amount of space that COSS
- will waste in a given stripe (in bytes). When COSS writes data
- to disk, it will potentially waste up to "max-size" worth of disk
- space for each 1MB of data written. If "max-size" is set to a
- large value (ie >256k), this could potentially result in large
- amounts of wasted disk space. Setting this value to a lower value
- (ie 64k or 32k) will result in a COSS disk refusing to cache
- larger objects until the COSS stripe has been filled to within
- "max-stripe-waste" of the maximum size (1MB).
+NAME: tcp_outgoing_tos tcp_outgoing_ds tcp_outgoing_dscp
+TYPE: acl_tos
+DEFAULT: none
+LOC: Config.accessList.outgoing_tos
+DOC_START
+ Allows you to select a TOS/Diffserv value to mark outgoing
+ connections with, based on the username or source address
+ making the request.
- membufs=n defines the number of "memory-only" stripes that COSS
- will use. When an cache hit is performed on a COSS stripe before
- COSS has reached the overwrite-percent value for that object,
- COSS will use a series of memory buffers to hold the object in
- while the data is sent to the client. This will define the maximum
- number of memory-only buffers that COSS will use. The default value
- is 10, which will use a maximum of 10MB of memory for buffers.
+ tcp_outgoing_tos ds-field [!]aclname ...
- maxfullbufs=n defines the maximum number of stripes a COSS partition
- will have in memory waiting to be freed (either because the disk is
- under load and the stripe is unwritten, or because clients are still
- transferring data from objects using the memory). In order to try
- and maintain a good hit rate under load, COSS will reserve the last
- 2 full stripes for object hits. (ie a COSS cache_dir will reject
- new objects when the number of full stripes is 2 less than maxfullbufs)
+ Example where normal_service_net uses the TOS value 0x00
+ and normal_service_net uses 0x20
- The null store type:
+ acl normal_service_net src 10.0.0.0/255.255.255.0
+ acl good_service_net src 10.0.1.0/255.255.255.0
+ tcp_outgoing_tos 0x00 normal_service_net 0x00
+ tcp_outgoing_tos 0x20 good_service_net
- no options are allowed or required
+ TOS/DSCP values really only have local significance - so you should
+ know what you're specifying. For more information, see RFC2474 and
+ RFC3260.
- Common options:
+ The TOS/DSCP byte must be exactly that - a octet value 0 - 255, or
+ "default" to use whatever default your host has. Note that in
+ practice often only values 0 - 63 is usable as the two highest bits
+ have been redefined for use by ECN (RFC3168).
- read-only, no new objects should be stored to this cache_dir
+ Processing proceeds in the order specified, and stops at first fully
+ matching line.
- min-size=n, refers to the min object size this storedir will accept.
- It's used to restrict a storedir to only store large objects
- (e.g. aufs) while other storedirs are optimized for smaller objects
- (e.g. COSS). Defaults to 0.
+ Note: The use of this directive using client dependent ACLs is
+ incompatible with the use of server side persistent connections. To
+ ensure correct results it is best to set server_persisten_connections
+ to off when using this directive in such configurations.
+DOC_END
- max-size=n, refers to the max object size this storedir supports.
- It is used to initially choose the storedir to dump the object.
- Note: To make optimal use of the max-size limits you should order
- the cache_dir lines with the smallest max-size value first and the
- ones with no max-size specification last.
+NAME: tcp_outgoing_address
+TYPE: acl_address
+DEFAULT: none
+LOC: Config.accessList.outgoing_address
+DOC_START
+ Allows you to map requests to different outgoing IP addresses
+ based on the username or source address of the user making
+ the request.
+
+ tcp_outgoing_address ipaddr [[!]aclname] ...
+
+ Example where requests from 10.0.0.0/24 will be forwarded
+ with source address 10.1.0.1, 10.0.2.0/24 forwarded with
+ source address 10.1.0.2 and the rest will be forwarded with
+ source address 10.1.0.3.
+
+ acl normal_service_net src 10.0.0.0/255.255.255.0
+ acl good_service_net src 10.0.1.0/255.255.255.0
+ tcp_outgoing_address 10.0.0.1 normal_service_net
+ tcp_outgoing_address 10.0.0.2 good_service_net
+ tcp_outgoing_address 10.0.0.3
+
+ Processing proceeds in the order specified, and stops at first fully
+ matching line.
+
+ Note: The use of this directive using client dependent ACLs is
+ incompatible with the use of server side persistent connections. To
+ ensure correct results it is best to set server_persistent_connections
+ to off when using this directive in such configurations.
+DOC_END
+
+COMMENT_START
+ SSL OPTIONS
+ -----------------------------------------------------------------------------
+COMMENT_END
- Note that for coss, max-size must be less than COSS_MEMBUF_SZ
- (hard coded at 1 MB).
+NAME: ssl_unclean_shutdown
+IFDEF: USE_SSL
+TYPE: onoff
+DEFAULT: off
+LOC: Config.SSL.unclean_shutdown
+DOC_START
+ Some browsers (especially MSIE) bugs out on SSL shutdown
+ messages.
DOC_END
-NAME: store_dir_select_algorithm
+NAME: ssl_engine
+IFDEF: USE_SSL
TYPE: string
-LOC: Config.store_dir_select_algorithm
-DEFAULT: least-load
+LOC: Config.SSL.ssl_engine
+DEFAULT: none
DOC_START
- Set this to 'round-robin' as an alternative.
+ The OpenSSL engine to use. You will need to set this if you
+ would like to use hardware SSL acceleration for example.
DOC_END
-NAME: max_open_disk_fds
-TYPE: int
-LOC: Config.max_open_disk_fds
-DEFAULT: 0
+NAME: sslproxy_client_certificate
+IFDEF: USE_SSL
+DEFAULT: none
+LOC: Config.ssl_client.cert
+TYPE: string
DOC_START
- To avoid having disk as the I/O bottleneck Squid can optionally
- bypass the on-disk cache if more than this amount of disk file
- descriptors are open.
-
- A value of 0 indicates no limit.
+ Client SSL Certificate to use when proxying https:// URLs
DOC_END
-NAME: cache_replacement_policy
-TYPE: removalpolicy
-LOC: Config.replPolicy
-DEFAULT: lru
+NAME: sslproxy_client_key
+IFDEF: USE_SSL
+DEFAULT: none
+LOC: Config.ssl_client.key
+TYPE: string
DOC_START
- The cache replacement policy parameter determines which
- objects are evicted (replaced) when disk space is needed.
-
- lru : Squid's original list based LRU policy
- heap GDSF : Greedy-Dual Size Frequency
- heap LFUDA: Least Frequently Used with Dynamic Aging
- heap LRU : LRU policy implemented using a heap
-
- Applies to any cache_dir lines listed below this.
-
- The LRU policies keeps recently referenced objects.
-
- The heap GDSF policy optimizes object hit rate by keeping smaller
- popular objects in cache so it has a better chance of getting a
- hit. It achieves a lower byte hit rate than LFUDA though since
- it evicts larger (possibly popular) objects.
-
- The heap LFUDA policy keeps popular objects in cache regardless of
- their size and thus optimizes byte hit rate at the expense of
- hit rate since one large, popular object will prevent many
- smaller, slightly less popular objects from being cached.
-
- Both policies utilize a dynamic aging mechanism that prevents
- cache pollution that can otherwise occur with frequency-based
- replacement policies.
-
- NOTE: if using the LFUDA replacement policy you should increase
- the value of maximum_object_size above its default of 4096 KB to
- to maximize the potential byte hit rate improvement of LFUDA.
-
- For more information about the GDSF and LFUDA cache replacement
- policies see http://www.hpl.hp.com/techreports/1999/HPL-1999-69.html
- and http://fog.hpl.external.hp.com/techreports/98/HPL-98-173.html.
+ Client SSL Key to use when proxying https:// URLs
DOC_END
-NAME: minimum_object_size
-COMMENT: (bytes)
-TYPE: b_size_t
-DEFAULT: 0 KB
-LOC: Config.Store.minObjectSize
+NAME: sslproxy_version
+IFDEF: USE_SSL
+DEFAULT: 1
+LOC: Config.ssl_client.version
+TYPE: int
DOC_START
- Objects smaller than this size will NOT be saved on disk. The
- value is specified in kilobytes, and the default is 0 KB, which
- means there is no minimum.
+ SSL version level to use when proxying https:// URLs
DOC_END
-NAME: maximum_object_size
-COMMENT: (bytes)
-TYPE: b_size_t
-DEFAULT: 4096 KB
-LOC: Config.Store.maxObjectSize
+NAME: sslproxy_options
+IFDEF: USE_SSL
+DEFAULT: none
+LOC: Config.ssl_client.options
+TYPE: string
DOC_START
- Objects larger than this size will NOT be saved on disk. The
- value is specified in kilobytes, and the default is 4MB. If
- you wish to get a high BYTES hit ratio, you should probably
- increase this (one 32 MB object hit counts for 3200 10KB
- hits). If you wish to increase speed more than your want to
- save bandwidth you should leave this low.
+ SSL engine options to use when proxying https:// URLs
+DOC_END
- NOTE: if using the LFUDA replacement policy you should increase
- this value to maximize the byte hit rate improvement of LFUDA!
- See replacement_policy below for a discussion of this policy.
+NAME: sslproxy_cipher
+IFDEF: USE_SSL
+DEFAULT: none
+LOC: Config.ssl_client.cipher
+TYPE: string
+DOC_START
+ SSL cipher list to use when proxying https:// URLs
DOC_END
-NAME: cache_swap_low
-COMMENT: (percent, 0-100)
-TYPE: int
-DEFAULT: 90
-LOC: Config.Swap.lowWaterMark
-DOC_NONE
+NAME: sslproxy_cafile
+IFDEF: USE_SSL
+DEFAULT: none
+LOC: Config.ssl_client.cafile
+TYPE: string
+DOC_START
+ file containing CA certificates to use when verifying server
+ certificates while proxying https:// URLs
+DOC_END
-NAME: cache_swap_high
-COMMENT: (percent, 0-100)
-TYPE: int
-DEFAULT: 95
-LOC: Config.Swap.highWaterMark
+NAME: sslproxy_capath
+IFDEF: USE_SSL
+DEFAULT: none
+LOC: Config.ssl_client.capath
+TYPE: string
DOC_START
+ directory containing CA certificates to use when verifying
+ server certificates while proxying https:// URLs
+DOC_END
- The low- and high-water marks for cache object replacement.
- Replacement begins when the swap (disk) usage is above the
- low-water mark and attempts to maintain utilization near the
- low-water mark. As swap utilization gets close to high-water
- mark object eviction becomes more aggressive. If utilization is
- close to the low-water mark less replacement is done each time.
+NAME: sslproxy_flags
+IFDEF: USE_SSL
+DEFAULT: none
+LOC: Config.ssl_client.flags
+TYPE: string
+DOC_START
+ Various flags modifying the use of SSL while proxying https:// URLs:
+ DONT_VERIFY_PEER Accept certificates even if they fail to
+ verify.
+ NO_DEFAULT_CA Don't use the default CA list built in
+ to OpenSSL.
+DOC_END
- Defaults are 90% and 95%. If you have a large cache, 5% could be
- hundreds of MB. If this is the case you may wish to set these
- numbers closer together.
+NAME: sslpassword_program
+IFDEF: USE_SSL
+DEFAULT: none
+LOC: Config.Program.ssl_password
+TYPE: string
+DOC_START
+ Specify a program used for entering SSL key passphrases
+ when using encrypted SSL certificate keys. If not specified
+ keys must either be unencrypted, or Squid started with the -N
+ option to allow it to query interactively for the passphrase.
DOC_END
COMMENT_START
- LOGFILE OPTIONS
+ OPTIONS WHICH AFFECT THE NEIGHBOR SELECTION ALGORITHM
-----------------------------------------------------------------------------
COMMENT_END
-NAME: logformat
-TYPE: logformat
-LOC: Config.Log.logformats
+NAME: cache_peer
+TYPE: peer
DEFAULT: none
+LOC: Config.peers
DOC_START
- Usage:
-
- logformat
+ To specify other caches in a hierarchy, use the format:
- Defines an access log format.
+ cache_peer hostname type http-port icp-port [options]
- The is a string with embedded % format codes
+ For example,
- % format codes all follow the same basic structure where all but
- the formatcode is optional. Output strings are automatically escaped
- as required according to their context and the output format
- modifiers are usually not needed, but can be specified if an explicit
- output format is desired.
+ # proxy icp
+ # hostname type port port options
+ # -------------------- -------- ----- ----- -----------
+ cache_peer parent.foo.net parent 3128 3130 proxy-only default
+ cache_peer sib1.foo.net sibling 3128 3130 proxy-only
+ cache_peer sib2.foo.net sibling 3128 3130 proxy-only
- % ["|[|'|#] [-] [[0]width] [{argument}] formatcode
+ type: either 'parent', 'sibling', or 'multicast'.
- " output in quoted string format
- [ output in squid text log format as used by log_mime_hdrs
- # output in URL quoted format
- ' output as-is
+ proxy-port: The port number where the cache listens for proxy
+ requests.
- - left aligned
- width field width. If starting with 0 the
- output is zero padded
- {arg} argument such as header name etc
+ icp-port: Used for querying neighbor caches about
+ objects. To have a non-ICP neighbor
+ specify '7' for the ICP port and make sure the
+ neighbor machine has the UDP echo port
+ enabled in its /etc/inetd.conf file.
+ NOTE: Also requires icp_port option enabled to send/receive
+ requests via this method.
- Format codes:
+ options: proxy-only
+ weight=n
+ ttl=n
+ no-query
+ default
+ round-robin
+ carp
+ multicast-responder
+ closest-only
+ no-digest
+ no-netdb-exchange
+ no-delay
+ login=user:password | PASS | *:password
+ connect-timeout=nn
+ digest-url=url
+ allow-miss
+ max-conn=n
+ htcp
+ htcp-oldsquid
+ originserver
+ userhash
+ sourcehash
+ name=xxx
+ monitorurl=url
+ monitorsize=sizespec
+ monitorinterval=seconds
+ monitortimeout=seconds
+ forceddomain=name
+ ssl
+ sslcert=/path/to/ssl/certificate
+ sslkey=/path/to/ssl/key
+ sslversion=1|2|3|4
+ sslcipher=...
+ ssloptions=...
+ front-end-https[=on|auto]
+ connection-auth[=on|off|auto]
- >a Client source IP address
- >A Client FQDN
- >p Client source port
- h Request header. Optional header name argument
- on the format header[:[separator]element]
- h
- un User name
- ul User name from authentication
- ui User name from ident
- us User name from SSL
- ue User name from external acl helper
- Hs HTTP status code
- Ss Squid request status (TCP_MISS etc)
- Sh Squid hierarchy status (DEFAULT_PARENT etc)
- mt MIME content type
- rm Request method (GET/POST etc)
- ru Request URL
- rv Request protocol version
- ea Log string returned by external acl
- st Request size including HTTP headers
- st Request+Reply size including HTTP headers
- % a literal % character
+ use 'proxy-only' to specify objects fetched
+ from this cache should not be saved locally.
-logformat squid %ts.%03tu %6tr %>a %Ss/%03Hs %a %Ss/%03Hs %h] [%a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %h" "%{User-Agent}>h" %Ss:%Sh
-DOC_END
+ use 'weight=n' to affect the selection of a peer
+ during any weighted peer-selection mechanisms.
+ The weight must be an integer; default is 1,
+ larger weights are favored more.
+ This option does not affect parent selection if a peering
+ protocol is not in use.
-NAME: access_log cache_access_log
-TYPE: access_log
-LOC: Config.Log.accesslogs
-DEFAULT: none
-DOC_START
- These files log client request activities. Has a line every HTTP or
- ICP request. The format is:
- access_log [ [acl acl ...]]
- access_log none [acl acl ...]]
+ use 'ttl=n' to specify a IP multicast TTL to use
+ when sending an ICP queries to this address.
+ Only useful when sending to a multicast group.
+ Because we don't accept ICP replies from random
+ hosts, you must configure other group members as
+ peers with the 'multicast-responder' option below.
- Will log to the specified file using the specified format (which
- must be defined in a logformat directive) those entries which match
- ALL the acl's specified (which must be defined in acl clauses).
- If no acl is specified, all requests will be logged to this file.
+ use 'no-query' to NOT send ICP queries to this
+ neighbor.
- To disable logging of a request use the filepath "none", in which case
- a logformat name should not be specified.
+ use 'default' if this is a parent cache which can
+ be used as a "last-resort" if a peer cannot be located
+ by any of the peer-selection mechanisms.
+ If specified more than once, only the first is used.
- To log the request via syslog specify a filepath of "syslog":
+ use 'round-robin' to define a set of parents which
+ should be used in a round-robin fashion in the
+ absence of any ICP queries.
- access_log syslog[:facility.priority] [format [acl1 [acl2 ....]]]
- where facility could be any of:
- authpriv, daemon, local0 .. local7 or user.
+ use 'carp' to define a set of parents which should
+ be used as a CARP array. The requests will be
+ distributed among the parents based on the CARP load
+ balancing hash function based on their weight.
- And priority could be any of:
- err, warning, notice, info, debug.
+ 'multicast-responder' indicates the named peer
+ is a member of a multicast group. ICP queries will
+ not be sent directly to the peer, but ICP replies
+ will be accepted from it.
- Note: 2.6.STABLE14 and earlier only supports a slightly different
- and undocumented format with all uppercase LOG_FACILITY|LOG_PRIORITY
-NOCOMMENT_START
-access_log @DEFAULT_ACCESS_LOG@ squid
-NOCOMMENT_END
-DOC_END
+ 'closest-only' indicates that, for ICP_OP_MISS
+ replies, we'll only forward CLOSEST_PARENT_MISSes
+ and never FIRST_PARENT_MISSes.
-NAME: cache_log
-TYPE: string
-DEFAULT: @DEFAULT_CACHE_LOG@
-LOC: Config.Log.log
-DOC_START
- Cache logging file. This is where general information about
- your cache's behavior goes. You can increase the amount of data
- logged to this file with the "debug_options" tag below.
-DOC_END
+ use 'no-digest' to NOT request cache digests from
+ this neighbor.
-NAME: cache_store_log
-TYPE: string
-DEFAULT: @DEFAULT_STORE_LOG@
-LOC: Config.Log.store
-DOC_START
- Logs the activities of the storage manager. Shows which
- objects are ejected from the cache, and which objects are
- saved and for how long. To disable, enter "none". There are
- not really utilities to analyze this data, so you can safely
- disable it.
-DOC_END
+ 'no-netdb-exchange' disables requesting ICMP
+ RTT database (NetDB) from the neighbor.
-NAME: cache_swap_state cache_swap_log
-TYPE: string
-LOC: Config.Log.swap
-DEFAULT: none
-DOC_START
- Location for the cache "swap.state" file. This index file holds
- the metadata of objects saved on disk. It is used to rebuild
- the cache during startup. Normally this file resides in each
- 'cache_dir' directory, but you may specify an alternate
- pathname here. Note you must give a full filename, not just
- a directory. Since this is the index for the whole object
- list you CANNOT periodically rotate it!
+ use 'no-delay' to prevent access to this neighbor
+ from influencing the delay pools.
- If %s can be used in the file name it will be replaced with a
- a representation of the cache_dir name where each / is replaced
- with '.'. This is needed to allow adding/removing cache_dir
- lines when cache_swap_log is being used.
+ use 'login=user:password' if this is a personal/workgroup
+ proxy and your parent requires proxy authentication.
+ Note: The string can include URL escapes (i.e. %20 for
+ spaces). This also means % must be written as %%.
- If have more than one 'cache_dir', and %s is not used in the name
- these swap logs will have names such as:
+ use 'login=PASS' if users must authenticate against
+ the upstream proxy or in the case of a reverse proxy
+ configuration, the origin web server. This will pass
+ the users credentials as they are to the peer.
+ Note: To combine this with local authentication the Basic
+ authentication scheme must be used, and both servers must
+ share the same user database as HTTP only allows for
+ a single login (one for proxy, one for origin server).
+ Also be warned this will expose your users proxy
+ password to the peer. USE WITH CAUTION
- cache_swap_log.00
- cache_swap_log.01
- cache_swap_log.02
+ use 'login=*:password' to pass the username to the
+ upstream cache, but with a fixed password. This is meant
+ to be used when the peer is in another administrative
+ domain, but it is still needed to identify each user.
+ The star can optionally be followed by some extra
+ information which is added to the username. This can
+ be used to identify this proxy to the peer, similar to
+ the login=username:password option above.
- The numbered extension (which is added automatically)
- corresponds to the order of the 'cache_dir' lines in this
- configuration file. If you change the order of the 'cache_dir'
- lines in this file, these index files will NOT correspond to
- the correct 'cache_dir' entry (unless you manually rename
- them). We recommend you do NOT use this option. It is
- better to keep these index files in each 'cache_dir' directory.
-DOC_END
+ use 'connect-timeout=nn' to specify a peer
+ specific connect timeout (also see the
+ peer_connect_timeout directive)
-NAME: logfile_rotate
-TYPE: int
-DEFAULT: 10
-LOC: Config.Log.rotateNumber
-DOC_START
- Specifies the number of logfile rotations to make when you
- type 'squid -k rotate'. The default is 10, which will rotate
- with extensions 0 through 9. Setting logfile_rotate to 0 will
- disable the file name rotation, but the logfiles are still closed
- and re-opened. This will enable you to rename the logfiles
- yourself just before sending the rotate signal.
+ use 'digest-url=url' to tell Squid to fetch the cache
+ digest (if digests are enabled) for this host from
+ the specified URL rather than the Squid default
+ location.
- Note, the 'squid -k rotate' command normally sends a USR1
- signal to the running squid process. In certain situations
- (e.g. on Linux with Async I/O), USR1 is used for other
- purposes, so -k rotate uses another signal. It is best to get
- in the habit of using 'squid -k rotate' instead of 'kill -USR1
- '.
-DOC_END
+ use 'allow-miss' to disable Squid's use of only-if-cached
+ when forwarding requests to siblings. This is primarily
+ useful when icp_hit_stale is used by the sibling. To
+ extensive use of this option may result in forwarding
+ loops, and you should avoid having two-way peerings
+ with this option. (for example to deny peer usage on
+ requests from peer by denying cache_peer_access if the
+ source is a peer)
-NAME: emulate_httpd_log
-COMMENT: on|off
-TYPE: onoff
-DEFAULT: off
-LOC: Config.onoff.common_log
-DOC_START
- The Cache can emulate the log file format which many 'httpd'
- programs use. To disable/enable this emulation, set
- emulate_httpd_log to 'off' or 'on'. The default
- is to use the native log format since it includes useful
- information Squid-specific log analyzers use.
-DOC_END
+ use 'max-conn=n' to limit the amount of connections Squid
+ may open to this peer.
-NAME: log_ip_on_direct
-COMMENT: on|off
-TYPE: onoff
-DEFAULT: on
-LOC: Config.onoff.log_ip_on_direct
-DOC_START
- Log the destination IP address in the hierarchy log tag when going
- direct. Earlier Squid versions logged the hostname here. If you
- prefer the old way set this to off.
-DOC_END
+ use 'htcp' to send HTCP, instead of ICP, queries
+ to the neighbor. You probably also want to
+ set the "icp port" to 4827 instead of 3130.
-NAME: mime_table
-TYPE: string
-DEFAULT: @DEFAULT_MIME_TABLE@
-LOC: Config.mimeTablePathname
-DOC_START
- Pathname to Squid's MIME table. You shouldn't need to change
- this, but the default file contains examples and formatting
- information if you do.
-DOC_END
+ use 'htcp-oldsquid' to send HTCP to old Squid versions
-NAME: log_mime_hdrs
-COMMENT: on|off
-TYPE: onoff
-LOC: Config.onoff.log_mime_hdrs
-DEFAULT: off
-DOC_START
- The Cache can record both the request and the response MIME
- headers for each HTTP transaction. The headers are encoded
- safely and will appear as two bracketed fields at the end of
- the access log (for either the native or httpd-emulated log
- formats). To enable this logging set log_mime_hdrs to 'on'.
-DOC_END
+ 'originserver' causes this parent peer to be contacted as
+ a origin server. Meant to be used in accelerator setups.
-NAME: useragent_log
-TYPE: string
-LOC: Config.Log.useragent
-DEFAULT: none
-IFDEF: USE_USERAGENT_LOG
-DOC_START
- Squid will write the User-Agent field from HTTP requests
- to the filename specified here. By default useragent_log
- is disabled.
-DOC_END
+ use 'userhash' to load-balance amongst a set of parents
+ based on the client proxy_auth or ident username.
-NAME: referer_log referrer_log
-TYPE: string
-LOC: Config.Log.referer
-DEFAULT: none
-IFDEF: USE_REFERER_LOG
-DOC_START
- Squid will write the Referer field from HTTP requests to the
- filename specified here. By default referer_log is disabled.
- Note that "referer" is actually a misspelling of "referrer"
- however the misspelt version has been accepted into the HTTP RFCs
- and we accept both.
-DOC_END
+ use 'sourcehash' to load-balance amongst a set of parents
+ based on the client source ip.
-NAME: pid_filename
-TYPE: string
-DEFAULT: @DEFAULT_PID_FILE@
-LOC: Config.pidFilename
-DOC_START
- A filename to write the process-id to. To disable, enter "none".
-DOC_END
+ use 'name=xxx' if you have multiple peers on the same
+ host but different ports. This name can be used to
+ differentiate the peers in cache_peer_access and similar
+ directives.
-NAME: debug_options
-TYPE: eol
-DEFAULT: ALL,1
-LOC: Config.debugOptions
-DOC_START
- Logging options are set as section,level where each source file
- is assigned a unique section. Lower levels result in less
- output, Full debugging (level 9) can result in a very large
- log file, so be careful. The magic word "ALL" sets debugging
- levels for all sections. We recommend normally running with
- "ALL,1".
-DOC_END
+ use 'monitorurl=url' to have periodically request a given
+ URL from the peer, and only consider the peer as alive
+ if this monitoring is successful (default none)
-NAME: log_fqdn
-COMMENT: on|off
-TYPE: onoff
-DEFAULT: off
-LOC: Config.onoff.log_fqdn
-DOC_START
- Turn this on if you wish to log fully qualified domain names
- in the access.log. To do this Squid does a DNS lookup of all
- IP's connecting to it. This can (in some situations) increase
- latency, which makes your cache seem slower for interactive
- browsing.
-DOC_END
+ use 'monitorsize=min[-max]' to limit the size range of
+ 'monitorurl' replies considered valid. Defaults to 0 to
+ accept any size replies as valid.
-NAME: client_netmask
-TYPE: address
-LOC: Config.Addrs.client_netmask
-DEFAULT: 255.255.255.255
-DOC_START
- A netmask for client addresses in logfiles and cachemgr output.
- Change this to protect the privacy of your cache clients.
- A netmask of 255.255.255.0 will log all IP's in that range with
- the last digit set to '0'.
-DOC_END
+ use 'monitorinterval=seconds' to change frequency of
+ how often the peer is monitored with 'monitorurl'
+ (default 300 for a 5 minute interval). If set to 0
+ then monitoring is disabled even if a URL is defined.
-NAME: forward_log
-IFDEF: WIP_FWD_LOG
-TYPE: string
-DEFAULT: none
-LOC: Config.Log.forward
-DOC_START
- Logs the server-side requests.
+ use 'monitortimeout=seconds' to change the timeout of
+ 'monitorurl'. Defaults to 'monitorinterval'.
- This is currently work in progress.
-DOC_END
+ use 'forceddomain=name' to forcibly set the Host header
+ of requests forwarded to this peer. Useful in accelerator
+ setups where the server (peer) expects a certain domain
+ name and using redirectors to feed this domain name
+ is not feasible.
-NAME: strip_query_terms
-TYPE: onoff
-LOC: Config.onoff.strip_query_terms
-DEFAULT: on
-DOC_START
- By default, Squid strips query terms from requested URLs before
- logging. This protects your user's privacy.
-DOC_END
+ use 'ssl' to indicate connections to this peer should
+ be SSL/TLS encrypted.
-NAME: buffered_logs
-COMMENT: on|off
-TYPE: onoff
-DEFAULT: off
-LOC: Config.onoff.buffered_logs
-DOC_START
- cache.log log file is written with stdio functions, and as such
- it can be buffered or unbuffered. By default it will be unbuffered.
- Buffering it can speed up the writing slightly (though you are
- unlikely to need to worry unless you run with tons of debugging
- enabled in which case performance will suffer badly anyway..).
-DOC_END
+ use 'sslcert=/path/to/ssl/certificate' to specify a client
+ SSL certificate to use when connecting to this peer.
-COMMENT_START
- OPTIONS FOR EXTERNAL SUPPORT PROGRAMS
- -----------------------------------------------------------------------------
-COMMENT_END
+ use 'sslkey=/path/to/ssl/key' to specify the private SSL
+ key corresponding to sslcert above. If 'sslkey' is not
+ specified 'sslcert' is assumed to reference a
+ combined file containing both the certificate and the key.
-NAME: ftp_user
-TYPE: string
-DEFAULT: Squid@
-LOC: Config.Ftp.anon_user
-DOC_START
- If you want the anonymous login password to be more informative
- (and enable the use of picky ftp servers), set this to something
- reasonable for your domain, like wwwuser@somewhere.net
+ use sslversion=1|2|3|4 to specify the SSL version to use
+ when connecting to this peer
+ 1 = automatic (default)
+ 2 = SSL v2 only
+ 3 = SSL v3 only
+ 4 = TLS v1 only
- The reason why this is domainless by default is the
- request can be made on the behalf of a user in any domain,
- depending on how the cache is used.
- Some ftp server also validate the email address is valid
- (for example perl.com).
-DOC_END
+ use sslcipher=... to specify the list of valid SSL ciphers
+ to use when connecting to this peer.
-NAME: ftp_list_width
-TYPE: int
-DEFAULT: 32
-LOC: Config.Ftp.list_width
-DOC_START
- Sets the width of ftp listings. This should be set to fit in
- the width of a standard browser. Setting this too small
- can cut off long filenames when browsing ftp sites.
-DOC_END
+ use ssloptions=... to specify various SSL engine options:
+ NO_SSLv2 Disallow the use of SSLv2
+ NO_SSLv3 Disallow the use of SSLv3
+ NO_TLSv1 Disallow the use of TLSv1
+ See src/ssl_support.c or the OpenSSL documentation for
+ a more complete list.
-NAME: ftp_passive
-TYPE: onoff
-DEFAULT: on
-LOC: Config.Ftp.passive
-DOC_START
- If your firewall does not allow Squid to use passive
- connections, turn off this option.
-DOC_END
+ use sslcafile=... to specify a file containing
+ additional CA certificates to use when verifying the
+ peer certificate.
-NAME: ftp_sanitycheck
-TYPE: onoff
-DEFAULT: on
-LOC: Config.Ftp.sanitycheck
-DOC_START
- For security and data integrity reasons Squid by default performs
- sanity checks of the addresses of FTP data connections ensure the
- data connection is to the requested server. If you need to allow
- FTP connections to servers using another IP address for the data
- connection turn this off.
-DOC_END
+ use sslcapath=... to specify a directory containing
+ additional CA certificates to use when verifying the
+ peer certificate.
-NAME: ftp_telnet_protocol
-TYPE: onoff
-DEFAULT: on
-LOC: Config.Ftp.telnet
-DOC_START
- The FTP protocol is officially defined to use the telnet protocol
- as transport channel for the control connection. However, many
- implementations are broken and does not respect this aspect of
- the FTP protocol.
+ use sslcrlfile=... to specify a certificate revocation
+ list file to use when verifying the peer certificate.
- If you have trouble accessing files with ASCII code 255 in the
- path or similar problems involving this ASCII code you can
- try setting this directive to off. If that helps, report to the
- operator of the FTP server in question that their FTP server
- is broken and does not follow the FTP standard.
-DOC_END
+ use sslflags=... to specify various flags modifying the
+ SSL implementation:
+ DONT_VERIFY_PEER
+ Accept certificates even if they fail to
+ verify.
+ NO_DEFAULT_CA
+ Don't use the default CA list built in
+ to OpenSSL.
-NAME: diskd_program
-TYPE: string
-DEFAULT: @DEFAULT_DISKD@
-LOC: Config.Program.diskd
-DOC_START
- Specify the location of the diskd executable.
- Note this is only useful if you have compiled in
- diskd as one of the store io modules.
-DOC_END
+ use ssldomain= to specify the peer name as advertised
+ in it's certificate. Used for verifying the correctness
+ of the received peer certificate. If not specified the
+ peer hostname will be used.
-NAME: unlinkd_program
-IFDEF: USE_UNLINKD
-TYPE: string
-DEFAULT: @DEFAULT_UNLINKD@
-LOC: Config.Program.unlinkd
-DOC_START
- Specify the location of the executable for file deletion process.
-DOC_END
+ use front-end-https to enable the "Front-End-Https: On"
+ header needed when using Squid as a SSL frontend in front
+ of Microsoft OWA. See MS KB document Q307347 for details
+ on this header. If set to auto the header will
+ only be added if the request is forwarded as a https://
+ URL.
-NAME: pinger_program
-TYPE: string
-DEFAULT: @DEFAULT_PINGER@
-LOC: Config.Program.pinger
-IFDEF: USE_ICMP
-DOC_START
- Specify the location of the executable for the pinger process.
+ use connection-auth=off to tell Squid that this peer does
+ not support Microsoft connection oriented authentication,
+ and any such challenges received from there should be
+ ignored. Default is auto to automatically determine the
+ status of the peer.
DOC_END
-NAME: url_rewrite_program redirect_program
-TYPE: programline
-LOC: Config.Program.url_rewrite.command
+NAME: cache_peer_domain cache_host_domain
+TYPE: hostdomain
DEFAULT: none
+LOC: none
DOC_START
- Specify the location of the executable for the URL rewriter.
- Since they can perform almost any function there isn't one included.
-
- For each requested URL rewriter will receive on line with the format
-
- URL client_ip "/" fqdn user method urlgroup
-
- And the rewriter may return a rewritten URL. The other components of
- the request line does not need to be returned (ignored if they are).
+ Use to limit the domains for which a neighbor cache will be
+ queried. Usage:
- The rewriter can also indicate that a client-side redirect should
- be performed to the new URL. This is done by prefixing the returned
- URL with "301:" (moved permanently) or 302: (moved temporarily).
+ cache_peer_domain cache-host domain [domain ...]
+ cache_peer_domain cache-host !domain
- It can also return a "urlgroup" that can subsequently be matched
- in cache_peer_access and similar ACL driven rules. An urlgroup is
- returned by prefixing the returned url with "!urlgroup!"
+ For example, specifying
- By default, a URL rewriter is not used.
-DOC_END
+ cache_peer_domain parent.foo.net .edu
-NAME: url_rewrite_children redirect_children
-TYPE: int
-DEFAULT: 5
-LOC: Config.Program.url_rewrite.children
-DOC_START
- The number of redirector processes to spawn. If you start
- too few Squid will have to wait for them to process a backlog of
- URLs, slowing it down. If you start too many they will use RAM
- and other system resources.
-DOC_END
+ has the effect such that UDP query packets are sent to
+ 'bigserver' only when the requested object exists on a
+ server in the .edu domain. Prefixing the domain name
+ with '!' means the cache will be queried for objects
+ NOT in that domain.
-NAME: url_rewrite_concurrency redirect_concurrency
-TYPE: int
-DEFAULT: 0
-LOC: Config.Program.url_rewrite.concurrency
-DOC_START
- The number of requests each redirector helper can handle in
- parallel. Defaults to 0 which indicates the redirector
- is a old-style single threaded redirector.
+ NOTE: * Any number of domains may be given for a cache-host,
+ either on the same or separate lines.
+ * When multiple domains are given for a particular
+ cache-host, the first matched domain is applied.
+ * Cache hosts with no domain restrictions are queried
+ for all requests.
+ * There are no defaults.
+ * There is also a 'cache_peer_access' tag in the ACL
+ section.
DOC_END
-NAME: url_rewrite_host_header redirect_rewrites_host_header
-TYPE: onoff
-DEFAULT: on
-LOC: Config.onoff.redir_rewrites_host
+NAME: cache_peer_access
+TYPE: peer_access
+DEFAULT: none
+LOC: none
DOC_START
- By default Squid rewrites any Host: header in redirected
- requests. If you are running an accelerator this may
- not be a wanted effect of a redirector.
+ Similar to 'cache_peer_domain' but provides more flexibility by
+ using ACL elements.
- WARNING: Entries are cached on the result of the URL rewriting
- process, so be careful if you have domain-virtual hosts.
-DOC_END
+ cache_peer_access cache-host allow|deny [!]aclname ...
-NAME: url_rewrite_access redirector_access
-TYPE: acl_access
-DEFAULT: none
-LOC: Config.accessList.url_rewrite
-DOC_START
- If defined, this access list specifies which requests are
- sent to the redirector processes. By default all requests
- are sent.
+ The syntax is identical to 'http_access' and the other lists of
+ ACL elements. See the comments for 'http_access' below, or
+ the Squid FAQ (http://www.squid-cache.org/FAQ/FAQ-10.html).
DOC_END
-NAME: location_rewrite_program
-TYPE: programline
-LOC: Config.Program.location_rewrite.command
+NAME: neighbor_type_domain
+TYPE: hostdomaintype
DEFAULT: none
+LOC: none
DOC_START
- Specify the location of the executable for the Location rewriter,
- used to rewrite server generated redirects. Usually used in
- conjunction with a url_rewrite_program
-
- For each Location header received the location rewriter will receive
- one line with the format:
-
- location URL requested URL urlgroup
+ usage: neighbor_type_domain neighbor parent|sibling domain domain ...
- And the rewriter may return a rewritten Location URL or a blank line.
- The other components of the request line does not need to be returned
- (ignored if they are).
+ Modifying the neighbor type for specific domains is now
+ possible. You can treat some domains differently than the the
+ default neighbor type specified on the 'cache_peer' line.
+ Normally it should only be necessary to list domains which
+ should be treated differently because the default neighbor type
+ applies for hostnames which do not match domains listed here.
- By default, a Location rewriter is not used.
+EXAMPLE:
+ cache_peer parent cache.foo.org 3128 3130
+ neighbor_type_domain cache.foo.org sibling .com .net
+ neighbor_type_domain cache.foo.org sibling .au .de
DOC_END
-NAME: location_rewrite_children
-TYPE: int
-DEFAULT: 5
-LOC: Config.Program.location_rewrite.children
+NAME: dead_peer_timeout
+COMMENT: (seconds)
+DEFAULT: 10 seconds
+TYPE: time_t
+LOC: Config.Timeout.deadPeer
DOC_START
- The number of location rewriting processes to spawn. If you start
- too few Squid will have to wait for them to process a backlog of
- URLs, slowing it down. If you start too many they will use RAM
- and other system resources.
-DOC_END
+ This controls how long Squid waits to declare a peer cache
+ as "dead." If there are no ICP replies received in this
+ amount of time, Squid will declare the peer dead and not
+ expect to receive any further ICP replies. However, it
+ continues to send ICP queries, and will mark the peer as
+ alive upon receipt of the first subsequent ICP reply.
-NAME: location_rewrite_concurrency
-TYPE: int
-DEFAULT: 0
-LOC: Config.Program.location_rewrite.concurrency
-DOC_START
- The number of requests each Location rewriter helper can handle in
- parallel. Defaults to 0 which indicates that the helper
- is a old-style singlethreaded helper.
+ This timeout also affects when Squid expects to receive ICP
+ replies from peers. If more than 'dead_peer' seconds have
+ passed since the last ICP reply was received, Squid will not
+ expect to receive an ICP reply on the next query. Thus, if
+ your time between requests is greater than this timeout, you
+ will see a lot of requests sent DIRECT to origin servers
+ instead of to your parents.
DOC_END
-NAME: location_rewrite_access
-TYPE: acl_access
+NAME: hierarchy_stoplist
+TYPE: wordlist
DEFAULT: none
-LOC: Config.accessList.location_rewrite
+LOC: Config.hierarchy_stoplist
DOC_START
- If defined, this access list specifies which requests are
- sent to the location rewriting processes. By default all Location
- headers are sent.
+ A list of words which, if found in a URL, cause the object to
+ be handled directly by this cache. In other words, use this
+ to not query neighbor caches for certain objects. You may
+ list this option multiple times. Note: never_direct overrides
+ this option.
+NOCOMMENT_START
+#We recommend you to use at least the following line.
+hierarchy_stoplist cgi-bin ?
+NOCOMMENT_END
DOC_END
-NAME: auth_param
-TYPE: authparam
-LOC: Config.authConfig
+NAME: cache no_cache
+TYPE: acl_access
DEFAULT: none
+LOC: Config.accessList.noCache
DOC_START
- This is used to define parameters for the various authentication
- schemes supported by Squid.
-
- format: auth_param scheme parameter [setting]
-
- The order in which authentication schemes are presented to the client is
- dependent on the order the scheme first appears in config file. IE
- has a bug (it's not RFC 2617 compliant) in that it will use the basic
- scheme if basic is the first entry presented, even if more secure
- schemes are presented. For now use the order in the recommended
- settings section below. If other browsers have difficulties (don't
- recognize the schemes offered even if you are using basic) either
- put basic first, or disable the other schemes (by commenting out their
- program entry).
-
- Once an authentication scheme is fully configured, it can only be
- shutdown by shutting squid down and restarting. Changes can be made on
- the fly and activated with a reconfigure. I.E. You can change to a
- different helper, but not unconfigure the helper completely.
-
- Please note that while this directive defines how Squid processes
- authentication it does not automatically activate authentication.
- To use authentication you must in addition make use of ACLs based
- on login name in http_access (proxy_auth, proxy_auth_regex or
- external with %LOGIN used in the format tag). The browser will be
- challenged for authentication on the first such acl encountered
- in http_access processing and will also be re-challenged for new
- login credentials if the request is being denied by a proxy_auth
- type acl.
-
- WARNING: authentication can't be used in a transparently intercepting
- proxy as the client then thinks it is talking to an origin server and
- not the proxy. This is a limitation of bending the TCP/IP protocol to
- transparently intercepting port 80, not a limitation in Squid.
-
- === Parameters for the basic scheme follow. ===
-
- "program" cmdline
- Specify the command for the external authenticator. Such a program
- reads a line containing "username password" and replies "OK" or
- "ERR" in an endless loop. "ERR" responses may optionally be followed
- by a error description available as %m in the returned error page.
-
- By default, the basic authentication scheme is not used unless a
- program is specified.
-
- If you want to use the traditional proxy authentication, jump over to
- the helpers/basic_auth/NCSA directory and type:
- % make
- % make install
-
- Then, set this line to something like
-
- auth_param basic program @DEFAULT_PREFIX@/libexec/ncsa_auth @DEFAULT_PREFIX@/etc/passwd
-
- "children" numberofchildren
- The number of authenticator processes to spawn. If you start too few
- squid will have to wait for them to process a backlog of credential
- verifications, slowing it down. When credential verifications are
- done via a (slow) network you are likely to need lots of
- authenticator processes.
- auth_param basic children 5
+ A list of ACL elements which, if matched, cause the request to
+ not be satisfied from the cache and the reply to not be cached.
+ In other words, use this to force certain objects to never be cached.
- "concurrency" numberofconcurrentrequests
- The number of concurrent requests/channels the helper supports.
- Changes the protocol used to include a channel number first on
- the request/response line, allowing multiple requests to be sent
- to the same helper in parallell without wating for the response.
- Must not be set unless it's known the helper supports this.
+ You must use the word 'DENY' to indicate the ACL names which should
+ NOT be cached.
- "realm" realmstring
- Specifies the realm name which is to be reported to the client for
- the basic proxy authentication scheme (part of the text the user
- will see when prompted their username and password).
- auth_param basic realm Squid proxy-caching web server
+ Default is to allow all to be cached
+NOCOMMENT_START
+#We recommend you to use the following two lines.
+acl QUERY urlpath_regex cgi-bin \?
+cache deny QUERY
+NOCOMMENT_END
+DOC_END
- "credentialsttl" timetolive
- Specifies how long squid assumes an externally validated
- username:password pair is valid for - in other words how often the
- helper program is called for that user. Set this low to force
- revalidation with short lived passwords. Note that setting this high
- does not impact your susceptibility to replay attacks unless you are
- using an one-time password system (such as SecureID). If you are using
- such a system, you will be vulnerable to replay attacks unless you
- also use the max_user_ip ACL in an http_access rule.
- auth_param basic credentialsttl 2 hours
+COMMENT_START
+ MEMORY CACHE OPTIONS
+ -----------------------------------------------------------------------------
+COMMENT_END
- "casesensitive" on|off
- Specifies if usernames are case sensitive. Most user databases are
- case insensitive allowing the same username to be spelled using both
- lower and upper case letters, but some are case sensitive. This
- makes a big difference for user_max_ip ACL processing and similar.
- auth_param basic casesensitive off
+NAME: cache_mem
+COMMENT: (bytes)
+TYPE: b_size_t
+DEFAULT: 8 MB
+LOC: Config.memMaxSize
+DOC_START
+ NOTE: THIS PARAMETER DOES NOT SPECIFY THE MAXIMUM PROCESS SIZE.
+ IT ONLY PLACES A LIMIT ON HOW MUCH ADDITIONAL MEMORY SQUID WILL
+ USE AS A MEMORY CACHE OF OBJECTS. SQUID USES MEMORY FOR OTHER
+ THINGS AS WELL. SEE THE SQUID FAQ SECTION 8 FOR DETAILS.
- "blankpassword" on|off
- Specifies if blank passwords should be supported. Defaults to off
- as there is multiple authentication backends which handles blank
- passwords as "guest" access.
+ 'cache_mem' specifies the ideal amount of memory to be used
+ for:
+ * In-Transit objects
+ * Hot Objects
+ * Negative-Cached objects
- === Parameters for the digest scheme follow ===
+ Data for these objects are stored in 4 KB blocks. This
+ parameter specifies the ideal upper limit on the total size of
+ 4 KB blocks allocated. In-Transit objects take the highest
+ priority.
- "program" cmdline
- Specify the command for the external authenticator. Such a program
- reads a line containing "username":"realm" and replies with the
- appropriate H(A1) value hex encoded or ERR if the user (or his H(A1)
- hash) does not exists. See RFC 2616 for the definition of H(A1).
- "ERR" responses may optionally be followed by a error description
- available as %m in the returned error page.
+ In-transit objects have priority over the others. When
+ additional space is neede