For those of you lucky enough to be looking after multiple proxies, I have
developed a little utility that simplifies the maintenance of the
configuration files immensely.
I look after 6 state proxies that are actually neighboured together and
the configuration files are identical, expect for about 3 or so lines.
The solution was to combine them into ONE generic configuration file and
include 'special' comments of the form #IF value, #ELSE and #ENDIF ( also
#IFNOT ).
The generic configuration file is then run through a preprocessor, written
in nawk, to generate the configuration for a particular proxy.
I hope someone else can find it useful.
It certainly saves me heaps of time, and errors due to typos etc.
BTW - I plan to maintain the configuration centrally on a non-proxy
machine and have the proxies ftp their configurations, say, once a week
(before their weekly restart) to ensure they are all in sync.
Enjoy.
Steve Green
Oracle DBA/Squid head
CSIRO Canberra
Australia
#!/bin/sh
#
# Usage:
#
# genconf state
#
# Generate state proxy configuration from generic configuration.
# Configuration files are presumed to be in the ../etc path relative
# to this directory.
#
# History
# -------
# 3 Sep 1997 S.Green Written
#
cat ../etc/squid.conf | nawk -v state=$1 -f genconf.nawk > ../etc/squid.conf.$1
#
# genconf.nawk
#
# This nawk program reads a file from stdin and writes output to stdout.
# On the way it looks for the following commands.
#
# #IF value, #ELSE, #ENDIF and
# #IFNOT value, #ELSE, #ENDIF
#
# value is compared to the variable state, and if the same, in the case of
# #IF, then the lines in the TRUE branch are included in stdout ASIS, otherwise
# these lines are preceeded with a # to comment them out.
# #IFNOT operates similarly but with the logical inverse.
#
# Change History
# --------------
# 3 Sep 1997 S.Green Program Written
#
BEGIN {
including = 1
print "#"
state = toupper(state)
"date" | getline today
print "# Generated for " state " by genconf on " today
print "#"
}
{
if ( substr($1,1,1) == "#" ) {
command = substr($1,2)
condition = toupper($2)
if ( command == "IF" ) {
if ( state == condition )
including = 1
else
including = 0
}
else if ( command == "IFNOT" ) {
if ( state != condition )
including = 1
else
including = 0
}
else if ( command == "ELSE" )
if ( including )
including = 0
else
including = 1
else if ( command == "ENDIF" )
including = 1
}
if ( including == 0 ) {
if ( substr($1,1,1) != "#" )
print "#" $0
else
print $0
}
else
print $0
}
#
# Generic Squid configuration for CSIROs state proxies
#
# DO NOT USE ASIS!
#
# Generate the configuration for your state proxy vie the command:
#
# genconf STATE
#
# E.G. genconf ACT
# will generate a file called squid.conf.act
#
# This file must then be moved to /usr/local/squid/etc and renamed
# squid.conf and the squid deamon must then be restarted to load the
# new configuration.
#
# If is planned to perform this generate/upload function automatically,
# once a week, before the weekly logs get removed and squid is restarted.
#
# The rules
# =========
#
# Common lines will be included asis in the target config file, these include
# regular comments, commencing with a single hash, and non-comment lines.
#
# Conditional lines commence with a # and an IF or NOT, followed by a state
# label. More than one #IF or #IFNOT statement can be included in the one
# block. #IF and #IFNOT can be mixed within the one block. All #IF[NOT]
# blocks MUST end with an #ENDIF
#
# Conditional = #IF[NOT] label
# lines to include if condition met
# [#IF[NOT] label
# lines to include if new condition met
# #ENDIF
# E.G.
#
# The following lines will cause the cache_hosts to be setup as the
# proxies that this one isn't. E.I. ACT neighbours with NSW and VIC, and
# NSW neighbours with ACT and VIC.
#
# #IFNOT ACT
# cache_host act-proxy.csiro.au 8080 3130
# #IFNOT NSW
# cache_host nsw-proxy.csiro.au 8080 3130
# #IFNOT VIC
# cache_host vic-proxy.csiro.au 8080 3130
# #ENDIF
#
# Change History
# --------------
#
# 2 Sep 1997 S. Green Generic config file created from ACT config
# 27 Aug 1997 S. Green Add 203.4.145.0 nsw net
# 18 Aug 1997 S. Green Add vic-proxy and wa-proxy to neighbourhood
# 12 Aug 1997 S. Green Add nsw-proxy to neighbouring
# 11 Aug 1997 S. Green start neighbouring with other CSIRO proxies
# (currently only qld-proxy and sa-proxy)
# proxies acl list contains IP addresses of these
# deny all ICP except from other proxies
# TAG: http_port
# The port number where squid will listen for HTTP client
# requests. Default is 3128, for httpd-accel mode use port 80.
# May be overridden with -a on the command line.
#
http_port 8080
# TAG: icp_port
# The port number where squid send and receive ICP requests to
# and from neighbor caches. Default is 3130. To disable use
# "0". May be overridden with -u on the command line.
#
icp_port 3130
# TAG: mcast_groups
# This tag specifies a list of multicast groups which your
# server should join to receive multicasted ICP requests.
#
# Usage: mcast_groups 239.128.16.128 224.0.1.20
#
# By default, squid doesn't listen on any multicast groups.
#
#mcast_groups 239.128.16.128
# TAG: tcp_incoming_address
# TAG: tcp_outgoing_address
# TAG: udp_incoming_address
# TAG: udp_outgoing_address
#
# Usage: tcp_incoming_address 10.20.30.40
# udp_outgoing_address fully.qualified.domain.name
#
# These tags have replaced 'bind_address' and 'outbound_address'
# to provide more control for multihomed hosts.
#
# tcp_incoming_address is used for the HTTP socket which accepts
# connections from clients and other caches.
# tcp_outgoing_address is used for connections made to remote
# servers and other caches.
# udp_incoming_address is used for the ICP socket receiving packets
# from other caches.
# udp_outgoing_address is used for ICP packets sent out to other
# caches.
#
# The defaults behaviour is to not bind to any specific address.
#
# NOTE, udp_incoming_address and udp_outgoing_address can not have
# the same value since they both use port 3130.
#
#tcp_incoming_address 0.0.0.0
#tcp_outgoing_address 0.0.0.0
#udp_incoming_address 0.0.0.0
#udp_outgoing_address 0.0.0.0
# OPTIONS WHICH AFFECT THE NEIGHBOR SELECTION ALGORITHM
#-----------------------------------------------------------------------------
# TAG: cache_host
# To specify other caches in a hierarchy, use the format:
#
# hostname type http_port icp_port
#
# For example,
#
# # proxy icp
# # hostname type port port options
# # -------------------- -------- ----- ----- -----------
# cache_host bigserver.usc.edu parent 3128 3130 [proxy-only]
# cache_host littleguy1.usc.edu sibling 3128 3130 [proxy-only]
# cache_host littleguy1.usc.edu sibling 3128 3130 [proxy-only]
#
# type: either 'parent' or 'sibling'.
#
# proxy_port: The port number where the cache listens for proxy
# requests.
#
# icp_port: Used for querying neighbor caches about
# objects. To have a non-ICP neighbor
# specify '7' for the ICP port and make sure the
# neighbor machine has the UDP echo port
# enabled in its /etc/inetd.conf file.
#
# options: proxy-only
# weight=n
# ttl=n
# no-query
# default
#
# use 'proxy-only' to specify that objects fetched
# from this cache should not be saved locally.
#
# use 'weight=n' to specify a weighted parent.
# The weight must be an integer. The default weight
# is 1, larger weights are favored more.
#
# use 'ttl=n' to specify a IP multicast TTL to use
# when sending an ICP request to this address.
# Only useful when sending to a multicast group.
# multicast groups are treated like regular parents and
# neighbo[u]rs, except that we don't expect to see any
# replies from them.
#
# use 'no-query' to NOT send ICP queries to this
# neighbor.
#
# use 'default' if this is a parent cache which can
# be used as a "last-resort." You should probably
# only use 'default' in situations where you cannot
# use ICP with your parent cache(s).
#
# NOTE: non-ICP neighbors must be specified as 'parent'.
#
#cache_host hostname type 3128 3130
# PARENT caches for AARNET-2
# Not yet implemented!
#IF ACT
#cache_host act-aarnet-proxy parent 8080 3130
#IF NSW
#cache_host nsw-aarnet-proxy parent 8080 3130
#IF VIC
#cache_host vic-aarnet-proxy parent 8080 3130
#IF QLD
#cache_host qld-aarnet-proxy parent 8080 3130
#IF WA
#cache_host wa-aarnet-proxy parent 8080 3130
#IF SA
#cache_host sa-aarnet-proxy parent 8080 3130
#ENDIF
# CSIRO Neighbour caches
#IFNOT ACT
cache_host act-proxy.csiro.au sibling 8080 3130
#IFNOT NSW
cache_host nsw-proxy.csiro.au sibling 8080 3130
#IFNOT QLD
cache_host qld-proxy.csiro.au sibling 8080 3130
#IFNOT SA
cache_host sa-proxy.csiro.au sibling 8080 3130
#IFNOT VIC
cache_host vic-proxy.csiro.au sibling 8080 3130
#IFNOT WA
cache_host wa-proxy.csiro.au sibling 8080 3130
#ENDIF
# TAG: cache_host_domain
# Use to limit the domains for which a neighbor cache will be queried.
# Usage:
#
# cache_host_domain cache-host domain [domain ...]
# cache_host_domain cache-host !domain
#
# For example, specifying
#
# cache_host_domain bigserver.usc.edu .edu
#
# has the effect such that UDP query packets are sent to
# 'bigserver' only when the requested object exists on a
# server in the .edu domain. Prefixing the domainname
# with '!' means that the cache will be queried for objects
# NOT in that domain.
#
# NOTE: * Any number of domains may be given for a cache-host,
# either on the same or separate lines.
# * When multiple domains are given for a particular
# cache-host, the first matched domain is applied.
# * Cache hosts with no domain restrictions are queried
# for all requests.
# * There are no defaults.
# * There is also a 'cache_host_acl' tag in the ACL
# section.
# TAG: neighbor_type_domain
#
# usage: neighbor_type_domain parent|sibling domain domain ...
#
# Modifying the neighbor type for specific domains is now
# possible. You can treat some domains differently than the the
# default neighbor type specified on the 'cache_host' line.
# Normally it should only be necessary to list domains which
# should be treated differently because the default neighbor type
# applies for hostnames which do not match domains listed here.
#
#EXAMPLE:
# cache_host parent cache.foo.org 3128 3130
# neighbor_type_domain cache.foo.org sibling .com .net
# neighbor_type_domain cache.foo.org sibling .au .de
# TAG: inside_firewall
# This tag specifies a list of domains inside your Internet
# firewall.
#
# Usage: inside_firewall my.domain [ my.other.domain ...]
#
# The use of this tag affects the server selection algorithm in
# two ways. Objects which do not match any of the listed domains
# will be considered "beyond the firewall." For these:"
# - There will be no DNS lookups for the URL-host.
# - The object will always be fetched from one of
# the parent or neighbor caches.
#
# As a special case you may specify the domain as 'none' to force
# all requests to be fetched from neghbors and parents.
#
#inside_firewall topsecret.com
# TAG: local_domain
# This tag specifies a list of domains local to your organization.
#
# Usage: local_domain my.domain [ my.other.domain ...]
#
# For URLs which are in one of the local domains, the object
# is always fetched directly from the source and never from a
# neighbor or parent.
#
# local_domain its.csiro.au
# TAG: local_ip
# This tag specifies a list of network addresses local to your
# organization.
#
# Usage: local_ip ip-address
#
# This tag is similar to local_domain, except that the IP-address
# of the URL-host is checked. This requires that a DNS lookup
# be done on the URL-host. For this reason, local_domain is
# preferred over local_ip. By using local_domain it may be
# possible to avoid the DNS lookup altogether and deliver the
# object with less delay.
#
#local_ip 10.0.0.0
#local_ip 172.16.0.0
# TAG: firewall_ip
#
# Just like 'inside_firewall' but for IP addresses. NOTE:
# firewall_ip and local_ip are mutually exclusive. If you
# use firewall_ip then local_ip will be ignored.
#
#firewall_ip 10.0.0.0
#firewall_ip 172.16.0.0
# TAG: single_parent_bypass
# This tag specifies that it is okay to bypass the hierarchy
# "Pinging" when there is only a single parent for a given URL.
#
# Usage: single_parent_bypass on|off
#
# Before actually sending ICP "ping" packets to parents and
# neighbors, we figure out which hosts would be pinged based
# on the cache_host_domain rules, etc. Often it may be the
# case that only a single parent cache would be pinged.
#
# Since there is only a single parent, there is a very good
# chance that we will end up fetching the object from that
# parent. For this reason, it may be beneficial to avoid
# the ping and just fetch the object anyway.
#
# However, if we avoid the ping, we will be assuming that the
# parent host is reachable and that the cache process is running.
# By using the ping, we can be reasonably sure that the parent
# host will be able to handle our request. If the ping fails then
# it may be possible to fetch the object directly from the source.
#
# To favor the resiliency provided by the ping algorithm,
# single_parent_bypass is 'off' by default.
#
#single_parent_bypass off
# TAG: source_ping
# If source_ping is enabled, then squid will include the source
# provider site in its selection algorithm. This is accomplished
# by sending ICP "HIT" packets to the UDP echo port of the source
# host. Note that using source_ping may send a fair amount of UDP
# traffic out on the Internet and may irritate paranoid network
# administrators.
#
# Note that source_ping is incompatible with inside_firewall.
# For hosts beyond the firewall, source_ping packets will never
# be sent.
#
# By default, source_ping is off.
#
#source_ping off
# TAG: neighbor_timeout (seconds)
# This controls how long to wait for replies from neighbor caches.
# If none of the parent or neighbor caches reply before this many
# seconds (due to dropped packets or slow links), then the object
# request will be satisfied from the default source. The default
# timeout is two seconds.
#
#neighbor_timeout 2
# TAG: hierarchy_stoplist
# A list of words which, if found in a URL, cause the object to
# be handled directly by this cache. In other words, use this
# to not query neighbor caches for certain objects. You may
# list this option multiple times.
#
# The default is to directly fetch URLs containing 'cgi-bin' or '?'.
#
hierarchy_stoplist cgi-bin ? admin.its.csiro.au chameleon.its.csiro.au
# TAG: cache_stoplist
# A list of words which, if found in a URL, cause the object to
# immediately removed from the cache. In other words, use this
# to force certain objects to never be cached. You may list this
# option multiple times.
#
# The default is to not cache URLs containing 'cgi-bin' or '?'.
#
cache_stoplist cgi-bin ? admin.its.csiro.au chameleon.its.csiro.au
# TAG: cache_stoplist_pattern # case sensitive
# TAG: cache_stoplist_pattern/i # case insensitive
#
# Just like 'cache_stoplist' but you can use regular expressions
# instead of simple string matching. There is no default.
#
#cache_stoplist_pattern
# OPTIONS WHICH AFFECT THE CACHE SIZE
#-----------------------------------------------------------------------------
#
# TAG: cache_mem (in megabytes)
# Maximum amout of VM used to store objects in memory.
# This includes:
# in-transit objects,
# negative-cached objects,
# "hot" objects
# The value of cache_mem is an upper limit on the size of the
# "in-memory object data" pool. This is a pool of 4k pages used
# to hold object data.
#
# In-transit objects have priority over the others. When
# additional space is needed for incoming data, negative-cached
# and hot objects will be released. In other words, the
# negative-cached and hot objects will fill up any unused space
# not needed for in-transit objects.
#
# The values of cache_mem_low and cache_mem_high (below) can be
# used to tune the use of the memory pool. When the high mark is
# reached, in-transit and hot objects will be released to clear
# space. When an object transfer is completed, it will remain in
# memory only if the current memory usage is below the low water
# mark.
#
# The default is 8 Megabytes.
#
cache_mem 32
# TAG: cache_swap (in megabytes)
# Maximum about of disk space used by the cache. The default is
# 100 megabytes. When the disk usage gets to this size, the cache
# uses LRU replacement to evict objects as new objects are cached.
# Note that cache_swap is set to:
# max(cache_mem, cache_swap_specified)
# to guard against users' accidentally specifying a smaller
# cache_swap than cache_mem size.
#
#IF VIC
# Victorias cache is only 2GB at this stage
cache_swap 2000
#ELSE
# All other states use 4GB
cache_swap 4000
#ENDIF
# TAG: cache_swap_low (percent, 0-100)
# TAG: cache_swap_high (percent, 0-100)
# The low- and high-water marks for cache LRU replacement.
# LRU replacement begins when the high-water mark is reached
# and ends when enough objects have been removed and the low-water
# mark is reached. Defaults are 75% and 90%.
#
cache_swap_low 70
cache_swap_high 80
# TAG: cache_mem_low (in percent, 0-100)
# TAG: cache_mem_high (in percent, 0-100)
# The low- and high-water mark for cache memory storage. When
# the amount of RAM used by the hot-object RAM cache reaches this
# point, the cache starts throwing objects out of the RAM cache
# (but they remain on disk). Defaults are 75% and 90%.
#
cache_mem_low 70
cache_mem_high 80
# TAG: maximum_object_size
# Objects larger than this size will NOT be saved on disk. The
# value is specified in kilobytes, and the default is 4MB.
#
maximum_object_size 32768
# TAG: ipcache_size (number of entries)
# TAG: ipcache_low (percent)
# TAG: ipcache_high (percent)
# The size, low-, and high-water marks for the IP cache.
#
#ipcache_size 1024
#ipcache_low 90
#ipcache_high 95
# LOGFILE PATHNAMES AND CACHE DIRECTORIES
#-----------------------------------------------------------------------------
# TAG: cache_dir
# Directory for on-disk cache storage. The cache will change into
# this directory when running. The default is
# /usr/local/squid/cache.
#
# You can specify multiple cache_dir lines to spread the
# cache among different disk partitions.
#
#cache_dir /usr/local/squid/cache
cache_dir /cache1
cache_dir /cache2
# TAG: cache_access_log
# Logs the client request activity. Contains an entry for
# every HTTP and ICP request received.
#
cache_access_log /usr/local/squid/logs/access.log
# TAG: cache_log
# Cache logging file. Set logging levels with "debug_options" below.
#
cache_log /usr/local/squid/logs/cache.log
# TAG: cache_store_log
# Logs the activities of the storage manager. Shows which
# objects are ejected from the cache, and which objects are
# saved and for how long. To disable, enter "none".
#
cache_store_log none
# TAG: cache_swap_log
# Location for the cache "swap log." This log file holds the
# metadata of objects saved on disk. It is used to rebuild the
# cache during startup. Normally this file resides in the first
# 'cache_dir' directory, but you may specify an alternate
# pathname here. Note you must give a full filename, not just
# a directory.
#
#cache_swap_log
# TAG: emulate_httpd_log
# The Cache can emulate the log file format which many 'httpd'
# programs use. To disable/enable this emulation, set
# emulate_httpd_log to 'off' or 'on'. The default
# is to use the native log format.
#
#emulate_httpd_log off
# TAG: log_mime_hdrs
# The Cache can record both the request and the response
# MIME headers for each HTTP transaction. The headers are
# encoded safely and will appear as two bracketed fields
# at the end of the access log (for either the native
# or httpd-emulated log formats). To enable this logging
# set log_mime_hdrs to 'on'.
#
# NOTE: support for this may require you to define
# LOG_FULL_HEADERS before compiling.
#
#log_mime_hdrs off
# TAG: useragent_log
# If compiled with "-DUSE_USERAGENT_LOG=1" Squid will write
# the User-Agent field from HTTP requests to the filename
# specified here. By default useragent_log is disabled.
#
#useragent_log none
# TAG: pid_filename
# A pathname to write the process-id to. To disable, enter "none".
#
pid_filename /usr/local/squid/logs/squid.pid
# TAG: debug_options
# Logging options are set as section,level where each source file
# is assigned a unique section. Lower levels result in less
# output, Full debugging (level 9) can result in a very large
# log file, so be careful. The magic word "ALL" sets debugging
# levels for all sections. We recommend normally running with
# "ALL,1".
#
debug_options ALL,1
# TAG: ident_lookup
# If you wish to make an RFC931/ident lookup of the client username
# for each connection, enable this. It is off by default.
#
#ident_lookup off
# TAG: log_fqdn
# Turn this on if you wish to log fully qualified domain names
# in the access.log.
#
#log_fqdn off
# TAG: client_netmask
# A netmask for client addresses in logfiles and cachemgr output.
# Change this to protect the privacy of your cache clients.
#
#client_netmask 255.255.255.255
# OPTIONS FOR EXTERNAL SUPPORT PROGRAMS
#-----------------------------------------------------------------------------
# TAG: ftpget_program
# Where to find the 'ftpget' program that retrieves FTP data (HTTP
# and Gopher protocol support are built into the cache).
#
# To disable ftpget and the ability to retrieve FTP objects, set
# this to "none". Note that ftpget is automatically disabled for
# http_accel mode.
#
ftpget_program /usr/local/squid/bin/ftpget
# TAG: ftpget_options
# Options for the 'ftpget' program. Please run 'ftpget' without
# any arguments to see a list of options. The default is
# no options. An example is
#
# ftpget_options -n 60 -R -W
#
#ftpget_options
ftpget_options -n 60 -R -W
# If you want the anonymous login password to be more informative
# (and enable the use of picky ftp servers), set this to something
# resonable for your domain, like wwwuser@somewhere.net
#
# The reason why this is domainless by default is that the
# request can be made on the behalf of a user in any domain,
# depending on how the cache is used.
# Some ftp server also validate that the email address is valid
# (for example perl.com).
#
ftp_user squid-ftp@its.csiro.au
# TAG: cache_dns_program
# Specify the location of the executable for dnslookup process.
#
#cache_dns_program /usr/local/squid/bin/dnsserver
# TAG: dns_children
# The number of processes spawn to service DNS name lookups.
# For heavily loaded caches on large servers, you should
# probably increase this value to at least 10. The maximum
# is 32. The default is 5.
#
# To disable dnsservers, set this to 0. NOTE, this is very
# strongly discouraged. If you disable dnsservers your Squid
# process will BLOCK on DNS lookups!
#
dns_children 8
# TAG: redirect_program
# Specify the location of the executable for the URL redirector.
# Currently, you must provide your own redirector program.
# See the Release-Notes for how to write one.
# By default, the redirector is not used.
#
#redirect_program /bin/false
# TAG: redirect_children
# The number of redirector processes to spawn.
#
#redirect_children 5
# OPTIONS FOR TUNING THE CACHE
#-----------------------------------------------------------------------------
# TAG: wais_relay
# Relay WAIS request to host (1st arg) at port (2 arg).
#
#wais_relay localhost 8000
# TAG: request_size
# Maximum allowed request size in kilobytes. If people are using
# POST to upload files, then set this to the largest acceptable
# filesize plus a few extra kbytes.
#
#request_size 100
# TAG: refresh_pattern # case sensitive
# TAG: refresh_pattern/i # case insensitive
#
# usage: refresh_pattern regex min percent max
#
# min and max are specified in MINUTES.
# percent is an integer number.
#
# Please see the file doc/Release-Notes-1.1.txt for a full
# description of Squid's refresh algorithm. Basically a
# cached object is:
#
# FRESH if age < min
# STALE if expires < now
# STALE if age > max
# FRESH if lm-factor < percent
#
# The refresh_pattern lines are checked in the order listed here.
# The first entry which matches is used. If none of the entries
# match, then the default will be used.
#
#Default:
refresh_pattern/i \.gif$ 30 80% 43200
refresh_pattern/i \.jpg$ 30 80% 43200
refresh_pattern/i \.jpeg$ 30 80% 43200
refresh_pattern/i \.mpg$ 30 80% 43200
refresh_pattern/i \.mpeg$ 30 80% 43200
refresh_pattern/i \.exe$ 30 80% 43200
refresh_pattern/i \.csi$ 30 80% 43200
refresh_pattern/i \.gz$ 30 80% 43200
refresh_pattern/i \.zip$ 30 80% 43200
refresh_pattern/i \.wav$ 30 80% 43200
refresh_pattern/i \.au$ 30 80% 43200
refresh_pattern/i \.avi$ 30 80% 43200
refresh_pattern/i \.pdf$ 30 80% 43200
refresh_pattern/i \.hqx$ 30 80% 43200
refresh_pattern/i \.mid$ 30 80% 43200
refresh_pattern/i \.z$ 30 80% 43200
refresh_pattern/i \.tar$ 30 80% 43200
refresh_pattern/i \.aiff$ 30 80% 43200
refresh_pattern/i \.sit$ 30 80% 43200
refresh_pattern/i \.bin$ 30 80% 43200
refresh_pattern/i \.tgz$ 30 80% 43200
refresh_pattern/i \.ps$ 30 80% 43200
refresh_pattern/i \.microsoft\.com 1440 40% 20160
refresh_pattern/i admin\.its 0 0% 0
refresh_pattern/i chameleon\.its 0 0% 0
refresh_pattern/i \.csiro\.au 30 20% 10080
refresh_pattern ^http:// 30 40% 20160
refresh_pattern ^ftp:// 30 50% 20160
refresh_pattern ^gopher:// 30 40% 20160
refresh_pattern . 30 40% 20160
# TAG: reference_age (in minutes)
# If set, objects which have not been referenced for this amount
# of time will be purged from the cache. This is the only
# parameter for removing cache objects except when the disk space
# reaches the high water mark. By default reference_age is
# computed dynamically so that the store swap size stays within
# the low and high water mark limits.
#reference_age 0
# TAG: quick_abort
# By default the cache continues to retrieve objects from
# aborted requests. This may be undesirable on slow (e.g. SLIP)
# links and/or very busy caches. Impatient users may tie up
# file descriptors by repeatedly aborting and re-requesting
# non-cachable objects.
#
# Usage: quick_abort min-kbytes percent max-kbytes
#
# When the user aborts a request, Squid will check the
# quick_abort values to the amount of data transfered until
# then.
#
# If the transfer has less than 'min-kbytes' remaining, it
# will finish the retrieval. Setting minlength to -1 will
# disable the quick_abort feature.
#
# If the transfer has more than 'max-kbytes' remaining, it
# will abort the retrieval.
#
# If more than 'percent' of the transfer has completed, it will
# finish the retrieval.
#
#quick_abort -1 0 0
# TAG: negative_ttl (in minutes)
# Time-to-Live (TTL) for failed requests. Certain types of
# failures (such as "connection refused" and "404 Not Found") are
# negatively-cached for a small amount of time. The default is 5
# minutes. Note that this is different from negative caching of
# DNS lookups.
#
#negative_ttl 5
#
# TAG: positive_dns_ttl (in minutes)
# Time-to-Live (TTL) for positive caching of successful DNS lookups.
# Default is 6 hours (360 minutes). If you want to minimize the
# use of Squid's ipcache, set this to 1, not 0.
#
#positive_dns_ttl 360
# TAG: negative_dns_ttl (in minutes)
# Time-to-Live (TTL) for negative caching of failed DNS lookups.
#
#negative_dns_ttl 5
# TIMEOUTS
#-----------------------------------------------------------------------------
# TAG: connect_timeout (in seconds)
# Some systems (notably Linux) can not be relied upon to properly
# time out connect(2) requests. Therefore the squid process
# enforces its own timeout on server connections. This parameter
# specifies how long to wait for the connect to complete. The
# default is two minutes (120 seconds).
#
#connect_timeout 120
# TAG: read_timeout (in minutes)
# An active connection will be aborted after read_timeout minutes
# of no activity on that connection (i.e., assume the remote server
# or network connection died after the connection was established).
# The default is 15 minutes.
#
#read_timeout 15
# TAG: client_lifetime (in minutes)
# The maximum amount of time that a client (browser) is allowed to
# remain connected to the cache process. This protects the Cache
# from having alot of sockets (and hence file descriptors) tied up
# in a CLOSE_WAIT state from remote clients that go away without
# properly shutting down (either because of a network failure or
# because of a poor client implementation). The default is three
# hours, 20 minutes.
#
# NOTE: The default value is designed with low-speed client
# connections in mind. 200 minutes should be plenty of time to
# transfer a 10M file at 1k/sec. If you have high-speed client
# connectivity, or occasionally run out of file descriptors,
# we suggest you lower this value appropriately.
#
client_lifetime 400
# TAG: shutdown_lifetime (in seconds)
#
# When SIGTERM or SIGHUP is received, the cache is put into
# "shutdown pending" mode until all active sockets are closed.
# This value is the lifetime to set for all open descriptors
# during shutdown mode. Any active clients after this many
# seconds will receive a 'lifetime expire' message
#
#shutdown_lifetime 30
# TAG: clean_rate (in minutes)
# How often to force a full garbage collection. Garbage collection
# involves checking the expire time of every object in the cache.
#
# NOTE: this option is provided only for backwards compatibility.
# We recommend that you leave it disabled (i.e. set to -1). Expired
# objects are removed from the cache little by little as a part of
# its normal operations.
#
#clean_rate -1
# ACCESS CONTROLS
#-----------------------------------------------------------------------------
# Defining an Access List
#
# acl aclname acltype string1 ...
# acl aclname acltype "file" ...
#
# when using "file", the file should contain one item per line
#
# acltype is one of src dst srcdomain dstdomain url_pattern urlpath_pattern
# time port proto method browser user
#
# acl aclname src ip-address/netmask ... (clients IP address)
# acl aclname src addr1-addr2/netmask ... (range of addresses)
# acl aclname dst ip-address/netmask ... (URL host's IP address)
# acl aclname srcdomain foo.com ... (taken from reverse DNS lookup)
# acl aclname dstdomain foo.com ... (taken from the URL)
# acl aclname time [day-abbrevs] [h1:m1-h2:m2]
# day-abbrevs:
# S - Sunday
# M - Monday
# T - Tuesday
# W - Wednesday
# H - Thursday
# F - Friday
# A - Saturday
# h1:m1 must be less than h2:m2
# acl aclname url_regex ^http:// ... # regex matching on whole URL
# acl aclname urlpath_regex \.gif$ ... # regex matching on URL path only
# acl aclname port 80 70 21 ...
# acl aclname proto HTTP FTP ...
# acl aclname method GET POST ...
# acl aclname browser regexp
# acl aclname user username ... # string match on ident output.
# # use REQUIRED to accept any
# # non-null ident.
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl all src 0.0.0.0/0.0.0.0
acl proxies src 140.253.240.10/255.255.255.255 202.9.9.13/255.255.255.255 130.155.2.3/255.255.255.255 138.194.13.14/255.255.255.255 192.245.210.10/255.255.255.255 152.83.32.8/255.255.255.255
acl hq src 152.83.0.0/255.255.0.0
acl opsperth src 192.245.210.1-192.245.210.10/255.255.255.255
acl act1 src 138.44.0.0/255.255.0.0 152.83.0.0/255.255.0.0
acl act2 src 202.6.83.0/255.255.255.0 192.41.146.0/255.255.255.0
acl act3 src 150.203.0.0/255.255.0.0
acl vic1 src 138.194.0.0/255.255.0.0 140.79.0.0/255.255.0.0
acl vic2 src 144.110.16.0/255.255.255.0 144.110.17.0/255.255.255.0
acl vic3 src 144.110.22.0/255.255.255.0 144.110.32.0/255.255.255.0
acl vic4 src 144.110.48.0/255.255.255.0 144.110.64.0/255.255.255.0
acl vic5 src 192.102.250.0/255.255.255.0 202.8.33.0/255.255.255.0
acl vic6 src 202.8.38.0-202.8.39.0/255.255.255.0
acl vic7 src 130.116.3.0/255.255.255.0 192.102.251.0/255.255.255.0
acl vic8 src 192.203.235.0/255.255.255.0 192.124.252.0/255.255.255.0
acl vic9 src 202.0.88.0/255.255.255.0 192.16.180.0/255.255.255.0
acl vic10 src 150.229.17.0-150.229.31.0/255.255.255.0
acl vic11 src 150.229.33.0-150.229.47.0/255.255.255.0
acl vic12 src 192.68.132.0/255.255.255.0
acl nsw1 src 130.155.0.0/255.255.0.0
acl nsw2 src 192.55.219.0/255.255.255.0 192.122.176.0/255.255.255.0
acl nsw3 src 192.138.100.0/255.255.255.0 192.231.167.0/255.255.255.0
acl nsw4 src 192.207.156.0-192.207.158.0/255.255.255.0
acl nsw5 src 203.0.100.0/255.255.255.0 203.6.243.0/255.255.255.0
acl nsw6 src 203.6.255.0/255.255.255.0 203.7.128.0/255.255.255.0
acl nsw7 src 203.15.65.0/255.255.255.0
acl nsw8 src 203.4.145.0/255.255.255.0
acl qld1 src 140.253.0.0/255.255.0.0 146.118.0.0/255.255.0.0
acl qld2 src 192.94.62.0/255.255.255.0 140.253.120.0/255.255.255.0
acl qld3 src 202.14.0.0/255.255.255.0 192.207.197.0/255.255.255.0
acl qld4 src 192.94.64.0/255.255.255.0 192.231.212.0/255.255.255.0
acl qld5 src 202.12.121.0/255.255.255.0
acl qld6 src 192.231.212.0/255.255.255.0
acl qld7 src 203.12.41.0/255.255.255.0
acl sa1 src 138.194.150.0/255.255.255.0 202.9.0.0/255.255.255.0
acl sa2 src 202.9.8.0-202.9.10.0/255.255.255.0
acl sa3 src 202.9.12.0-202.9.14.0/255.255.255.0
acl sa4 src 202.9.2.0/255.255.255.0
acl sa5 src 202.9.9.0/255.255.255.0
acl wa1 src 192.245.210.0-192.245.217.0/255.255.255.0
acl wa2 src 192.54.106.0/255.255.255.0 192.65.130.0/255.255.255.0
acl wa3 src 192.149.36.0/255.255.255.0
acl tas1 src 203.18.60.0-203.18.61.0/255.255.255.0
acl tas2 src 192.67.12.0/255.255.255.0 202.0.98.0/255.255.255.0
acl tas3 src 192.150.202.0/255.255.255.0
acl tas4 src 203.12.40.0/255.255.255.0
acl nt1 src 192.94.63.0/255.255.255.0 192.207.33.0/255.255.255.0
acl SSL_ports port 443 563
acl CONNECT method CONNECT
# Allowing or Denying access based on defined access lists
#
# Access to the HTTP port:
# http_access allow|deny [!]aclname ...
#
# Access to the ICP port:
# icp_access allow|deny [!]aclname ...
# Only allow access to the cache manager functions from the local host.
http_access deny manager !localhost !hq !opsperth
http_access deny CONNECT !SSL_ports
# Deny everything else except ...
http_access deny all !proxies !localhost !act1 !act2 !act3 !nsw1 !nsw1 !nsw2 !nsw3 !nsw4 !nsw5 !nsw6 !nsw7 !nsw8 !nt1 !vic1 !vic2 !vic3 !vic4 !vic5 !vic6 !vic7 !vic8 !vic9 !vic10 !vic11 !vic12 !qld1 !qld2 !qld3 !qld4 !qld6 !qld7 !sa1 !sa2 !sa3 !sa4 !sa5 !tas1 !tas2 !tas3 !tas4 !wa1 !wa2 !wa3
# Reply to all ICP queries we receive
icp_access deny all !proxies
# TAG: miss_access
# Use to force your neighbors to use you as a sibling instead of
# a parent. For example:
#
# acl localclients src 172.16.0.0/16
# miss_access allow localclients
# miss_access deny !localclients
#
# This means that only your local clients are allowed to fetch
# MISSES and all other clients can only fetch HITS.
#
# By default, allow all clients who passed the http_access rules
# to fetch MISSES from us.
miss_access allow all
# TAG: cache_host_acl
# Just like 'cache_host_domain' but provides more flexibility by
# using ACL's.
#
# cache_host_acl cache-host [!]aclname ...
#
# NOTE: * Any number of ACL's may be given for a cache-host,
# either on the same or separate lines.
# * When multiple ACL's are given for a particular
# cache-host, the first matched ACL is applied.
# * Cache hosts with no domain or ACL restrictions are
# queried for all requests.
# * There are no defaults.
# ADMINISTRATIVE PARAMETERS
#-----------------------------------------------------------------------------
# TAG: cache_mgr
# Email-address of local cache manager who will receive
# mail if the cache dies. The default is "webmaster."
#
cache_mgr cache-admin@its.csiro.au
# TAG: cache_effective_user
# If the cache is run as root, it will change its effective/real
# UID/GID to the UID/GID specified below. The default is not to
# change UID/GID.
#
cache_effective_user nobody nogroup
# TAG: visible_hostname
# If you want to present a special hostname in error messages, etc,
# then define this. Otherwise, the return value of gethostname()
# will be used.
#
#IF ACT
visible_hostname act-proxy.csiro.au
#IF NSW
visible_hostname nsw-proxy.csiro.au
#IF VIC
visible_hostname vic-proxy.csiro.au
#IF QLD
visible_hostname qld-proxy.csiro.au
#IF WA
visible_hostname wa-proxy.csiro.au
#IF SA
visible_hostname sa-proxy.csiro.au
#ENDIF
# OPTIONS FOR THE CACHE REGISTRATION SERVICE
#-----------------------------------------------------------------------------
# This section contains parameters for the (optional) cache
# announcement service. This service is provided to help
# cache administrators locate one another in order to join or
# create cache hierarchies.
#
# An 'announcement' message is sent (via UDP) to the registration
# service by Squid. By default, the annoucement message is NOT
# SENT unless you enable it with 'cache_announce' below.
#
# The announcement message includes your hostname, plus the
# following information from this configuration file:
#
# http_port
# icp_port
# cache_mgr
#
# All current information is processed regularly and made
# available on the Web at http://www.nlanr.net/Cache/Tracker/.
# This is how frequently to send cache announcements. The default
# is `0' which disables sending the announcement messages.
#
# To enable announcing your cache, just uncomment the line below.
#
#cache_announce 24
# This is the hostname and portnumber where the registration message
# will be sent.
#
# Format: announce_to host[:port] [filename]
#
# Hostname will default to 'sd.cache.nlanr.net' and port will default
# to 3131. If the 'filename' argument is given, the contents of that
# file will be included in the announce message.
#
#announce_to sd.cache.nlanr.net:3131
# HTTPD-ACCELERATOR OPTIONS
#-----------------------------------------------------------------------------
# TAG: httpd_accel
# If you want to run squid as an httpd accelerator, define the
# host name and port number where the real HTTP server is.
#
# If you want virtual host support then specify the hostname
# as "virtual".
#
#httpd_accel real_httpd_host real_httpd_port
# TAG: httpd_accel_with_proxy
# If you want to use squid as both a local httpd accelerator
# and as a proxy, change this to 'on'.
#
#httpd_accel_with_proxy off
# TAG: httpd_accel_uses_host_header
# HTTP/1.1 requests include a Host: header which is basically the
# hostname from the URL. Squid can be an accelerator for
# different HTTP servers by looking at this header. However,
# Squid does NOT check the value of the Host header, so it opens
# a big security hole. We recommend that this option remain
# disabled unless you are sure of what you are doing.
#
#httpd_accel_uses_host_header off
# MISCELLANEOUS
#-----------------------------------------------------------------------------
# The DNS tests exit as soon as the first site is successfully looked up
#
# If you want to disable DNS tests, do not comment out or delete this
# list. Instead use the -D command line option
#
dns_testnames internic.net usc.edu cs.colorado.edu mit.edu yale.edu
# TAG: logfile_rotate #
# Specifies the number of logfile rotations to make upon receiving
# a USR1 signal. The default is 10, which will rotate with
# extensions 0 through 9. Setting logfile_rotate to 0 will
# disable the rotation, but the logfiles are still closed and
# re-opened. This will enable you to rename the logfiles yourself
# just before sending a USR1 signal to the squid process.
#
logfile_rotate 0
# TAG: append_domain
# Appends local domain name to hostnames without any dots in them.
# append_domain must begin with a period.
#
#append_domain .yourdomain.com
# TAG: tcp_recv_bufsize
# Size of receive buffer to set for TCP sockets. Probably just
# as easy to change your kernel's default. Set to zero to use
# the default buffer size.
#
#tcp_recv_bufsize 0
# TAG: ssl_proxy
# Specify the name of a 'cache_host' listed above, or a hostname
# and port number where all SSL requests should be forwarded to.
#
# Usage: ssl_proxy cache_host
# ssl_proxy host:port
#
#ssl_proxy
# TAG: passthrough_proxy
# Specify the name of a 'cache_host' listed above, or a hostname
# and port number where all non-GET (i.e. POST, PUT) requests
# should be forwarded to.
#
# Usage: passthrough_proxy cache_host
# passthrough_proxy host:port
#
#passthrough_proxy
# TAG: proxy_auth
# Usage: proxy_auth passwd_file [ ignore-domain ]
#
# 'passwd_file' is an apache-style file of passwords for
# authenticated proxy access Looks like user:password, with the
# password being standard crypt() format. Proxy authentication
# is disabled by default.
#
# 'ignore-domain' is a domain name for which authorization will
# *not* be required.
#
#proxy_auth /dev/null
# TAG: err_html_text
# HTML text to include in error messages. Make this a "mailto"
# URL to your admin address, or maybe just a link to your
# organizations Web page.
#
#err_html_text
# TAG: deny_info
# Usage: deny_info URL acl
#
# This can be used to return a HTTP redirect for requests which
# do not pass the 'http_access' rules. A single ACL will cause
# the http_access check to fail. If a 'deny_info' line exists
# for that ACL then Squid returns a redirect to the given URL.
# TAG: udp_hit_obj on|off
# If set, Squid will request UDP_HIT_OBJ replies from its
# neighbors. UDP_HIT_OBJ is nice because it saves bandwidth, but
# it can cause some other problems. For one it complicates
# calculating hit rates. Also, problems arise because the ICP
# query does not contain any HTTP request headers which may
# affect the reply.
#
#udp_hit_obj off
# TAG: udp_hit_obj_size
#
# If set, Squid will limit UDP_HIT_OBJ size to be less than
# this value. Setting this value to more than SQUID_UDP_SO_SNDBUF
# will not work as expected. Set to zero to select the size
# permited by the socket.
#udp_hit_obj_size 0
# TAG: memory_pools on|off
# If set, Squid will keep pools of allocated (but unused) memory
# available for future use. If memory is a premium on your
# system, disable this.
#
#memory_pools on
# TAG: forwarded_for on|off
# If set, Squid will include your system's IP address or name
# in the HTTP requests it forwards. By default it looks like
# this:
# Forwarded: by http://foo.org:3128/ for 192.1.2.3
# If you disable this, it will appear as
# Forwarded: by http://foo.org:3128/
#
#forwarded_for on
# TAG: log_icp_queries on|off
# If set, ICP queries are logged to access.log. ICP logging
# is enabled by default, so uncomment and change the line
# below to disable it.
#log_icp_queries on
# TAG: minimum_direct_hops
# If using the ICMP pinging stuff, do direct fetches for sites
# which are no more than this many hops away.
#
minimum_direct_hops 4
# TAG: cachemgr_passwd
# Specify passwords for cachemgr operations.
#
#Usage: cachemgr_passwd password action action ...
#
# valid actions are:
# shutdown *
# info
# stats/objects
# stats/vm_objects
# stats/utilization
# stats/ipcache
# stats/fqdncache
# stats/dns
# stats/redirector
# stats/io
# stats/reply_headers
# stats/filedescriptors
# stats/netdb
# log/status *
# log/enable *
# log/disable *
# log/clear *
# log *
# parameter
# server_list
# client_list
# squid.conf *
#
# * Indicates actions which will not be performed without a
# valid password, others can be performed if not listed here.
#
# To disable an action, set the password to "disable".
# To allow performing an action without a password, set the
# password to "none".
#
#Examples:
#
# cachemgr_passwd secret shutdown
# cachemgr_passwd lesssssssecret info stats/objects
#
#Defaults: none
# TAG: swap_level1_dirs
# Number of first-level directories to create for storing cached
# objects. Minimum 1, maximum 256, default 16.
#
#swap_level1_dirs 16
# TAG: swap_level2_dirs
# Number of sub-directories to create under each first-level
# directory. Minimum 1, maximum 256, default 256.
#
#swap_level2_dirs 256
# TAG: store_avg_object_size
# Average object size, used to estimate number of objects your
# cache can hold. See doc/Release-Notes-1.1.txt. The default is
# 20K.
#store_avg_object_size 20
# TAG: store_objects_per_bucket 50
# Target number of objects per bucket in the store hash table.
# Lowering this value increases the total number of buckets and
# also the storage maintenance rate. The default is 50.
#store_objects_per_bucket 50
#
# Generated for ACT by genconf on Wed Sep 3 11:05:41 EST 1997
#
#
# Generic Squid configuration for CSIROs state proxies
#
# DO NOT USE ASIS!
#
# Generate the configuration for your state proxy vie the command:
#
# genconf STATE
#
# E.G. genconf ACT
# will generate a file called squid.conf.act
#
# This file must then be moved to /usr/local/squid/etc and renamed
# squid.conf and the squid deamon must then be restarted to load the
# new configuration.
#
# If is planned to perform this generate/upload function automatically,
# once a week, before the weekly logs get removed and squid is restarted.
#
# The rules
# =========
#
# Common lines will be included asis in the target config file, these include
# regular comments, commencing with a single hash, and non-comment lines.
#
# Conditional lines commence with a # and an IF or NOT, followed by a state
# label. More than one #IF or #IFNOT statement can be included in the one
# block. #IF and #IFNOT can be mixed within the one block. All #IF[NOT]
# blocks MUST end with an #ENDIF
#
# Conditional = #IF[NOT] label
# lines to include if condition met
# [#IF[NOT] label
# lines to include if new condition met
# #ENDIF
# E.G.
#
# The following lines will cause the cache_hosts to be setup as the
# proxies that this one isn't. E.I. ACT neighbours with NSW and VIC, and
# NSW neighbours with ACT and VIC.
#
# #IFNOT ACT
# cache_host act-proxy.csiro.au 8080 3130
# #IFNOT NSW
# cache_host nsw-proxy.csiro.au 8080 3130
# #IFNOT VIC
# cache_host vic-proxy.csiro.au 8080 3130
# #ENDIF
#
# Change History
# --------------
#
# 2 Sep 1997 S. Green Generic config file created from ACT config
# 27 Aug 1997 S. Green Add 203.4.145.0 nsw net
# 18 Aug 1997 S. Green Add vic-proxy and wa-proxy to neighbourhood
# 12 Aug 1997 S. Green Add nsw-proxy to neighbouring
# 11 Aug 1997 S. Green start neighbouring with other CSIRO proxies
# (currently only qld-proxy and sa-proxy)
# proxies acl list contains IP addresses of these
# deny all ICP except from other proxies
# TAG: http_port
# The port number where squid will listen for HTTP client
# requests. Default is 3128, for httpd-accel mode use port 80.
# May be overridden with -a on the command line.
#
http_port 8080
# TAG: icp_port
# The port number where squid send and receive ICP requests to
# and from neighbor caches. Default is 3130. To disable use
# "0". May be overridden with -u on the command line.
#
icp_port 3130
# TAG: mcast_groups
# This tag specifies a list of multicast groups which your
# server should join to receive multicasted ICP requests.
#
# Usage: mcast_groups 239.128.16.128 224.0.1.20
#
# By default, squid doesn't listen on any multicast groups.
#
#mcast_groups 239.128.16.128
# TAG: tcp_incoming_address
# TAG: tcp_outgoing_address
# TAG: udp_incoming_address
# TAG: udp_outgoing_address
#
# Usage: tcp_incoming_address 10.20.30.40
# udp_outgoing_address fully.qualified.domain.name
#
# These tags have replaced 'bind_address' and 'outbound_address'
# to provide more control for multihomed hosts.
#
# tcp_incoming_address is used for the HTTP socket which accepts
# connections from clients and other caches.
# tcp_outgoing_address is used for connections made to remote
# servers and other caches.
# udp_incoming_address is used for the ICP socket receiving packets
# from other caches.
# udp_outgoing_address is used for ICP packets sent out to other
# caches.
#
# The defaults behaviour is to not bind to any specific address.
#
# NOTE, udp_incoming_address and udp_outgoing_address can not have
# the same value since they both use port 3130.
#
#tcp_incoming_address 0.0.0.0
#tcp_outgoing_address 0.0.0.0
#udp_incoming_address 0.0.0.0
#udp_outgoing_address 0.0.0.0
# OPTIONS WHICH AFFECT THE NEIGHBOR SELECTION ALGORITHM
#-----------------------------------------------------------------------------
# TAG: cache_host
# To specify other caches in a hierarchy, use the format:
#
# hostname type http_port icp_port
#
# For example,
#
# # proxy icp
# # hostname type port port options
# # -------------------- -------- ----- ----- -----------
# cache_host bigserver.usc.edu parent 3128 3130 [proxy-only]
# cache_host littleguy1.usc.edu sibling 3128 3130 [proxy-only]
# cache_host littleguy1.usc.edu sibling 3128 3130 [proxy-only]
#
# type: either 'parent' or 'sibling'.
#
# proxy_port: The port number where the cache listens for proxy
# requests.
#
# icp_port: Used for querying neighbor caches about
# objects. To have a non-ICP neighbor
# specify '7' for the ICP port and make sure the
# neighbor machine has the UDP echo port
# enabled in its /etc/inetd.conf file.
#
# options: proxy-only
# weight=n
# ttl=n
# no-query
# default
#
# use 'proxy-only' to specify that objects fetched
# from this cache should not be saved locally.
#
# use 'weight=n' to specify a weighted parent.
# The weight must be an integer. The default weight
# is 1, larger weights are favored more.
#
# use 'ttl=n' to specify a IP multicast TTL to use
# when sending an ICP request to this address.
# Only useful when sending to a multicast group.
# multicast groups are treated like regular parents and
# neighbo[u]rs, except that we don't expect to see any
# replies from them.
#
# use 'no-query' to NOT send ICP queries to this
# neighbor.
#
# use 'default' if this is a parent cache which can
# be used as a "last-resort." You should probably
# only use 'default' in situations where you cannot
# use ICP with your parent cache(s).
#
# NOTE: non-ICP neighbors must be specified as 'parent'.
#
#cache_host hostname type 3128 3130
# PARENT caches for AARNET-2
# Not yet implemented!
#IF ACT
#cache_host act-aarnet-proxy parent 8080 3130
#IF NSW
#cache_host nsw-aarnet-proxy parent 8080 3130
#IF VIC
#cache_host vic-aarnet-proxy parent 8080 3130
#IF QLD
#cache_host qld-aarnet-proxy parent 8080 3130
#IF WA
#cache_host wa-aarnet-proxy parent 8080 3130
#IF SA
#cache_host sa-aarnet-proxy parent 8080 3130
#ENDIF
# CSIRO Neighbour caches
#IFNOT ACT
#cache_host act-proxy.csiro.au sibling 8080 3130
#IFNOT NSW
cache_host nsw-proxy.csiro.au sibling 8080 3130
#IFNOT QLD
cache_host qld-proxy.csiro.au sibling 8080 3130
#IFNOT SA
cache_host sa-proxy.csiro.au sibling 8080 3130
#IFNOT VIC
cache_host vic-proxy.csiro.au sibling 8080 3130
#IFNOT WA
cache_host wa-proxy.csiro.au sibling 8080 3130
#ENDIF
# TAG: cache_host_domain
# Use to limit the domains for which a neighbor cache will be queried.
# Usage:
#
# cache_host_domain cache-host domain [domain ...]
# cache_host_domain cache-host !domain
#
# For example, specifying
#
# cache_host_domain bigserver.usc.edu .edu
#
# has the effect such that UDP query packets are sent to
# 'bigserver' only when the requested object exists on a
# server in the .edu domain. Prefixing the domainname
# with '!' means that the cache will be queried for objects
# NOT in that domain.
#
# NOTE: * Any number of domains may be given for a cache-host,
# either on the same or separate lines.
# * When multiple domains are given for a particular
# cache-host, the first matched domain is applied.
# * Cache hosts with no domain restrictions are queried
# for all requests.
# * There are no defaults.
# * There is also a 'cache_host_acl' tag in the ACL
# section.
# TAG: neighbor_type_domain
#
# usage: neighbor_type_domain parent|sibling domain domain ...
#
# Modifying the neighbor type for specific domains is now
# possible. You can treat some domains differently than the the
# default neighbor type specified on the 'cache_host' line.
# Normally it should only be necessary to list domains which
# should be treated differently because the default neighbor type
# applies for hostnames which do not match domains listed here.
#
#EXAMPLE:
# cache_host parent cache.foo.org 3128 3130
# neighbor_type_domain cache.foo.org sibling .com .net
# neighbor_type_domain cache.foo.org sibling .au .de
# TAG: inside_firewall
# This tag specifies a list of domains inside your Internet
# firewall.
#
# Usage: inside_firewall my.domain [ my.other.domain ...]
#
# The use of this tag affects the server selection algorithm in
# two ways. Objects which do not match any of the listed domains
# will be considered "beyond the firewall." For these:"
# - There will be no DNS lookups for the URL-host.
# - The object will always be fetched from one of
# the parent or neighbor caches.
#
# As a special case you may specify the domain as 'none' to force
# all requests to be fetched from neghbors and parents.
#
#inside_firewall topsecret.com
# TAG: local_domain
# This tag specifies a list of domains local to your organization.
#
# Usage: local_domain my.domain [ my.other.domain ...]
#
# For URLs which are in one of the local domains, the object
# is always fetched directly from the source and never from a
# neighbor or parent.
#
# local_domain its.csiro.au
# TAG: local_ip
# This tag specifies a list of network addresses local to your
# organization.
#
# Usage: local_ip ip-address
#
# This tag is similar to local_domain, except that the IP-address
# of the URL-host is checked. This requires that a DNS lookup
# be done on the URL-host. For this reason, local_domain is
# preferred over local_ip. By using local_domain it may be
# possible to avoid the DNS lookup altogether and deliver the
# object with less delay.
#
#local_ip 10.0.0.0
#local_ip 172.16.0.0
# TAG: firewall_ip
#
# Just like 'inside_firewall' but for IP addresses. NOTE:
# firewall_ip and local_ip are mutually exclusive. If you
# use firewall_ip then local_ip will be ignored.
#
#firewall_ip 10.0.0.0
#firewall_ip 172.16.0.0
# TAG: single_parent_bypass
# This tag specifies that it is okay to bypass the hierarchy
# "Pinging" when there is only a single parent for a given URL.
#
# Usage: single_parent_bypass on|off
#
# Before actually sending ICP "ping" packets to parents and
# neighbors, we figure out which hosts would be pinged based
# on the cache_host_domain rules, etc. Often it may be the
# case that only a single parent cache would be pinged.
#
# Since there is only a single parent, there is a very good
# chance that we will end up fetching the object from that
# parent. For this reason, it may be beneficial to avoid
# the ping and just fetch the object anyway.
#
# However, if we avoid the ping, we will be assuming that the
# parent host is reachable and that the cache process is running.
# By using the ping, we can be reasonably sure that the parent
# host will be able to handle our request. If the ping fails then
# it may be possible to fetch the object directly from the source.
#
# To favor the resiliency provided by the ping algorithm,
# single_parent_bypass is 'off' by default.
#
#single_parent_bypass off
# TAG: source_ping
# If source_ping is enabled, then squid will include the source
# provider site in its selection algorithm. This is accomplished
# by sending ICP "HIT" packets to the UDP echo port of the source
# host. Note that using source_ping may send a fair amount of UDP
# traffic out on the Internet and may irritate paranoid network
# administrators.
#
# Note that source_ping is incompatible with inside_firewall.
# For hosts beyond the firewall, source_ping packets will never
# be sent.
#
# By default, source_ping is off.
#
#source_ping off
# TAG: neighbor_timeout (seconds)
# This controls how long to wait for replies from neighbor caches.
# If none of the parent or neighbor caches reply before this many
# seconds (due to dropped packets or slow links), then the object
# request will be satisfied from the default source. The default
# timeout is two seconds.
#
#neighbor_timeout 2
# TAG: hierarchy_stoplist
# A list of words which, if found in a URL, cause the object to
# be handled directly by this cache. In other words, use this
# to not query neighbor caches for certain objects. You may
# list this option multiple times.
#
# The default is to directly fetch URLs containing 'cgi-bin' or '?'.
#
hierarchy_stoplist cgi-bin ? admin.its.csiro.au chameleon.its.csiro.au
# TAG: cache_stoplist
# A list of words which, if found in a URL, cause the object to
# immediately removed from the cache. In other words, use this
# to force certain objects to never be cached. You may list this
# option multiple times.
#
# The default is to not cache URLs containing 'cgi-bin' or '?'.
#
cache_stoplist cgi-bin ? admin.its.csiro.au chameleon.its.csiro.au
# TAG: cache_stoplist_pattern # case sensitive
# TAG: cache_stoplist_pattern/i # case insensitive
#
# Just like 'cache_stoplist' but you can use regular expressions
# instead of simple string matching. There is no default.
#
#cache_stoplist_pattern
# OPTIONS WHICH AFFECT THE CACHE SIZE
#-----------------------------------------------------------------------------
#
# TAG: cache_mem (in megabytes)
# Maximum amout of VM used to store objects in memory.
# This includes:
# in-transit objects,
# negative-cached objects,
# "hot" objects
# The value of cache_mem is an upper limit on the size of the
# "in-memory object data" pool. This is a pool of 4k pages used
# to hold object data.
#
# In-transit objects have priority over the others. When
# additional space is needed for incoming data, negative-cached
# and hot objects will be released. In other words, the
# negative-cached and hot objects will fill up any unused space
# not needed for in-transit objects.
#
# The values of cache_mem_low and cache_mem_high (below) can be
# used to tune the use of the memory pool. When the high mark is
# reached, in-transit and hot objects will be released to clear
# space. When an object transfer is completed, it will remain in
# memory only if the current memory usage is below the low water
# mark.
#
# The default is 8 Megabytes.
#
cache_mem 32
# TAG: cache_swap (in megabytes)
# Maximum about of disk space used by the cache. The default is
# 100 megabytes. When the disk usage gets to this size, the cache
# uses LRU replacement to evict objects as new objects are cached.
# Note that cache_swap is set to:
# max(cache_mem, cache_swap_specified)
# to guard against users' accidentally specifying a smaller
# cache_swap than cache_mem size.
#
#IF VIC
#
# Victorias cache is only 2GB at this stage
#
#cache_swap 2000
#ELSE
# All other states use 4GB
cache_swap 4000
#ENDIF
# TAG: cache_swap_low (percent, 0-100)
# TAG: cache_swap_high (percent, 0-100)
# The low- and high-water marks for cache LRU replacement.
# LRU replacement begins when the high-water mark is reached
# and ends when enough objects have been removed and the low-water
# mark is reached. Defaults are 75% and 90%.
#
cache_swap_low 70
cache_swap_high 80
# TAG: cache_mem_low (in percent, 0-100)
# TAG: cache_mem_high (in percent, 0-100)
# The low- and high-water mark for cache memory storage. When
# the amount of RAM used by the hot-object RAM cache reaches this
# point, the cache starts throwing objects out of the RAM cache
# (but they remain on disk). Defaults are 75% and 90%.
#
cache_mem_low 70
cache_mem_high 80
# TAG: maximum_object_size
# Objects larger than this size will NOT be saved on disk. The
# value is specified in kilobytes, and the default is 4MB.
#
maximum_object_size 32768
# TAG: ipcache_size (number of entries)
# TAG: ipcache_low (percent)
# TAG: ipcache_high (percent)
# The size, low-, and high-water marks for the IP cache.
#
#ipcache_size 1024
#ipcache_low 90
#ipcache_high 95
# LOGFILE PATHNAMES AND CACHE DIRECTORIES
#-----------------------------------------------------------------------------
# TAG: cache_dir
# Directory for on-disk cache storage. The cache will change into
# this directory when running. The default is
# /usr/local/squid/cache.
#
# You can specify multiple cache_dir lines to spread the
# cache among different disk partitions.
#
#cache_dir /usr/local/squid/cache
cache_dir /cache1
cache_dir /cache2
# TAG: cache_access_log
# Logs the client request activity. Contains an entry for
# every HTTP and ICP request received.
#
cache_access_log /usr/local/squid/logs/access.log
# TAG: cache_log
# Cache logging file. Set logging levels with "debug_options" below.
#
cache_log /usr/local/squid/logs/cache.log
# TAG: cache_store_log
# Logs the activities of the storage manager. Shows which
# objects are ejected from the cache, and which objects are
# saved and for how long. To disable, enter "none".
#
cache_store_log none
# TAG: cache_swap_log
# Location for the cache "swap log." This log file holds the
# metadata of objects saved on disk. It is used to rebuild the
# cache during startup. Normally this file resides in the first
# 'cache_dir' directory, but you may specify an alternate
# pathname here. Note you must give a full filename, not just
# a directory.
#
#cache_swap_log
# TAG: emulate_httpd_log
# The Cache can emulate the log file format which many 'httpd'
# programs use. To disable/enable this emulation, set
# emulate_httpd_log to 'off' or 'on'. The default
# is to use the native log format.
#
#emulate_httpd_log off
# TAG: log_mime_hdrs
# The Cache can record both the request and the response
# MIME headers for each HTTP transaction. The headers are
# encoded safely and will appear as two bracketed fields
# at the end of the access log (for either the native
# or httpd-emulated log formats). To enable this logging
# set log_mime_hdrs to 'on'.
#
# NOTE: support for this may require you to define
# LOG_FULL_HEADERS before compiling.
#
#log_mime_hdrs off
# TAG: useragent_log
# If compiled with "-DUSE_USERAGENT_LOG=1" Squid will write
# the User-Agent field from HTTP requests to the filename
# specified here. By default useragent_log is disabled.
#
#useragent_log none
# TAG: pid_filename
# A pathname to write the process-id to. To disable, enter "none".
#
pid_filename /usr/local/squid/logs/squid.pid
# TAG: debug_options
# Logging options are set as section,level where each source file
# is assigned a unique section. Lower levels result in less
# output, Full debugging (level 9) can result in a very large
# log file, so be careful. The magic word "ALL" sets debugging
# levels for all sections. We recommend normally running with
# "ALL,1".
#
debug_options ALL,1
# TAG: ident_lookup
# If you wish to make an RFC931/ident lookup of the client username
# for each connection, enable this. It is off by default.
#
#ident_lookup off
# TAG: log_fqdn
# Turn this on if you wish to log fully qualified domain names
# in the access.log.
#
#log_fqdn off
# TAG: client_netmask
# A netmask for client addresses in logfiles and cachemgr output.
# Change this to protect the privacy of your cache clients.
#
#client_netmask 255.255.255.255
# OPTIONS FOR EXTERNAL SUPPORT PROGRAMS
#-----------------------------------------------------------------------------
# TAG: ftpget_program
# Where to find the 'ftpget' program that retrieves FTP data (HTTP
# and Gopher protocol support are built into the cache).
#
# To disable ftpget and the ability to retrieve FTP objects, set
# this to "none". Note that ftpget is automatically disabled for
# http_accel mode.
#
ftpget_program /usr/local/squid/bin/ftpget
# TAG: ftpget_options
# Options for the 'ftpget' program. Please run 'ftpget' without
# any arguments to see a list of options. The default is
# no options. An example is
#
# ftpget_options -n 60 -R -W
#
#ftpget_options
ftpget_options -n 60 -R -W
# If you want the anonymous login password to be more informative
# (and enable the use of picky ftp servers), set this to something
# resonable for your domain, like wwwuser@somewhere.net
#
# The reason why this is domainless by default is that the
# request can be made on the behalf of a user in any domain,
# depending on how the cache is used.
# Some ftp server also validate that the email address is valid
# (for example perl.com).
#
ftp_user squid-ftp@its.csiro.au
# TAG: cache_dns_program
# Specify the location of the executable for dnslookup process.
#
#cache_dns_program /usr/local/squid/bin/dnsserver
# TAG: dns_children
# The number of processes spawn to service DNS name lookups.
# For heavily loaded caches on large servers, you should
# probably increase this value to at least 10. The maximum
# is 32. The default is 5.
#
# To disable dnsservers, set this to 0. NOTE, this is very
# strongly discouraged. If you disable dnsservers your Squid
# process will BLOCK on DNS lookups!
#
dns_children 8
# TAG: redirect_program
# Specify the location of the executable for the URL redirector.
# Currently, you must provide your own redirector program.
# See the Release-Notes for how to write one.
# By default, the redirector is not used.
#
#redirect_program /bin/false
# TAG: redirect_children
# The number of redirector processes to spawn.
#
#redirect_children 5
# OPTIONS FOR TUNING THE CACHE
#-----------------------------------------------------------------------------
# TAG: wais_relay
# Relay WAIS request to host (1st arg) at port (2 arg).
#
#wais_relay localhost 8000
# TAG: request_size
# Maximum allowed request size in kilobytes. If people are using
# POST to upload files, then set this to the largest acceptable
# filesize plus a few extra kbytes.
#
#request_size 100
# TAG: refresh_pattern # case sensitive
# TAG: refresh_pattern/i # case insensitive
#
# usage: refresh_pattern regex min percent max
#
# min and max are specified in MINUTES.
# percent is an integer number.
#
# Please see the file doc/Release-Notes-1.1.txt for a full
# description of Squid's refresh algorithm. Basically a
# cached object is:
#
# FRESH if age < min
# STALE if expires < now
# STALE if age > max
# FRESH if lm-factor < percent
#
# The refresh_pattern lines are checked in the order listed here.
# The first entry which matches is used. If none of the entries
# match, then the default will be used.
#
#Default:
refresh_pattern/i \.gif$ 30 80% 43200
refresh_pattern/i \.jpg$ 30 80% 43200
refresh_pattern/i \.jpeg$ 30 80% 43200
refresh_pattern/i \.mpg$ 30 80% 43200
refresh_pattern/i \.mpeg$ 30 80% 43200
refresh_pattern/i \.exe$ 30 80% 43200
refresh_pattern/i \.csi$ 30 80% 43200
refresh_pattern/i \.gz$ 30 80% 43200
refresh_pattern/i \.zip$ 30 80% 43200
refresh_pattern/i \.wav$ 30 80% 43200
refresh_pattern/i \.au$ 30 80% 43200
refresh_pattern/i \.avi$ 30 80% 43200
refresh_pattern/i \.pdf$ 30 80% 43200
refresh_pattern/i \.hqx$ 30 80% 43200
refresh_pattern/i \.mid$ 30 80% 43200
refresh_pattern/i \.z$ 30 80% 43200
refresh_pattern/i \.tar$ 30 80% 43200
refresh_pattern/i \.aiff$ 30 80% 43200
refresh_pattern/i \.sit$ 30 80% 43200
refresh_pattern/i \.bin$ 30 80% 43200
refresh_pattern/i \.tgz$ 30 80% 43200
refresh_pattern/i \.ps$ 30 80% 43200
refresh_pattern/i \.microsoft\.com 1440 40% 20160
refresh_pattern/i admin\.its 0 0% 0
refresh_pattern/i chameleon\.its 0 0% 0
refresh_pattern/i \.csiro\.au 30 20% 10080
refresh_pattern ^http:// 30 40% 20160
refresh_pattern ^ftp:// 30 50% 20160
refresh_pattern ^gopher:// 30 40% 20160
refresh_pattern . 30 40% 20160
# TAG: reference_age (in minutes)
# If set, objects which have not been referenced for this amount
# of time will be purged from the cache. This is the only
# parameter for removing cache objects except when the disk space
# reaches the high water mark. By default reference_age is
# computed dynamically so that the store swap size stays within
# the low and high water mark limits.
#reference_age 0
# TAG: quick_abort
# By default the cache continues to retrieve objects from
# aborted requests. This may be undesirable on slow (e.g. SLIP)
# links and/or very busy caches. Impatient users may tie up
# file descriptors by repeatedly aborting and re-requesting
# non-cachable objects.
#
# Usage: quick_abort min-kbytes percent max-kbytes
#
# When the user aborts a request, Squid will check the
# quick_abort values to the amount of data transfered until
# then.
#
# If the transfer has less than 'min-kbytes' remaining, it
# will finish the retrieval. Setting minlength to -1 will
# disable the quick_abort feature.
#
# If the transfer has more than 'max-kbytes' remaining, it
# will abort the retrieval.
#
# If more than 'percent' of the transfer has completed, it will
# finish the retrieval.
#
#quick_abort -1 0 0
# TAG: negative_ttl (in minutes)
# Time-to-Live (TTL) for failed requests. Certain types of
# failures (such as "connection refused" and "404 Not Found") are
# negatively-cached for a small amount of time. The default is 5
# minutes. Note that this is different from negative caching of
# DNS lookups.
#
#negative_ttl 5
#
# TAG: positive_dns_ttl (in minutes)
# Time-to-Live (TTL) for positive caching of successful DNS lookups.
# Default is 6 hours (360 minutes). If you want to minimize the
# use of Squid's ipcache, set this to 1, not 0.
#
#positive_dns_ttl 360
# TAG: negative_dns_ttl (in minutes)
# Time-to-Live (TTL) for negative caching of failed DNS lookups.
#
#negative_dns_ttl 5
# TIMEOUTS
#-----------------------------------------------------------------------------
# TAG: connect_timeout (in seconds)
# Some systems (notably Linux) can not be relied upon to properly
# time out connect(2) requests. Therefore the squid process
# enforces its own timeout on server connections. This parameter
# specifies how long to wait for the connect to complete. The
# default is two minutes (120 seconds).
#
#connect_timeout 120
# TAG: read_timeout (in minutes)
# An active connection will be aborted after read_timeout minutes
# of no activity on that connection (i.e., assume the remote server
# or network connection died after the connection was established).
# The default is 15 minutes.
#
#read_timeout 15
# TAG: client_lifetime (in minutes)
# The maximum amount of time that a client (browser) is allowed to
# remain connected to the cache process. This protects the Cache
# from having alot of sockets (and hence file descriptors) tied up
# in a CLOSE_WAIT state from remote clients that go away without
# properly shutting down (either because of a network failure or
# because of a poor client implementation). The default is three
# hours, 20 minutes.
#
# NOTE: The default value is designed with low-speed client
# connections in mind. 200 minutes should be plenty of time to
# transfer a 10M file at 1k/sec. If you have high-speed client
# connectivity, or occasionally run out of file descriptors,
# we suggest you lower this value appropriately.
#
client_lifetime 400
# TAG: shutdown_lifetime (in seconds)
#
# When SIGTERM or SIGHUP is received, the cache is put into
# "shutdown pending" mode until all active sockets are closed.
# This value is the lifetime to set for all open descriptors
# during shutdown mode. Any active clients after this many
# seconds will receive a 'lifetime expire' message
#
#shutdown_lifetime 30
# TAG: clean_rate (in minutes)
# How often to force a full garbage collection. Garbage collection
# involves checking the expire time of every object in the cache.
#
# NOTE: this option is provided only for backwards compatibility.
# We recommend that you leave it disabled (i.e. set to -1). Expired
# objects are removed from the cache little by little as a part of
# its normal operations.
#
#clean_rate -1
# ACCESS CONTROLS
#-----------------------------------------------------------------------------
# Defining an Access List
#
# acl aclname acltype string1 ...
# acl aclname acltype "file" ...
#
# when using "file", the file should contain one item per line
#
# acltype is one of src dst srcdomain dstdomain url_pattern urlpath_pattern
# time port proto method browser user
#
# acl aclname src ip-address/netmask ... (clients IP address)
# acl aclname src addr1-addr2/netmask ... (range of addresses)
# acl aclname dst ip-address/netmask ... (URL host's IP address)
# acl aclname srcdomain foo.com ... (taken from reverse DNS lookup)
# acl aclname dstdomain foo.com ... (taken from the URL)
# acl aclname time [day-abbrevs] [h1:m1-h2:m2]
# day-abbrevs:
# S - Sunday
# M - Monday
# T - Tuesday
# W - Wednesday
# H - Thursday
# F - Friday
# A - Saturday
# h1:m1 must be less than h2:m2
# acl aclname url_regex ^http:// ... # regex matching on whole URL
# acl aclname urlpath_regex \.gif$ ... # regex matching on URL path only
# acl aclname port 80 70 21 ...
# acl aclname proto HTTP FTP ...
# acl aclname method GET POST ...
# acl aclname browser regexp
# acl aclname user username ... # string match on ident output.
# # use REQUIRED to accept any
# # non-null ident.
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl all src 0.0.0.0/0.0.0.0
acl proxies src 140.253.240.10/255.255.255.255 202.9.9.13/255.255.255.255 130.155.2.3/255.255.255.255 138.194.13.14/255.255.255.255 192.245.210.10/255.255.255.255 152.83.32.8/255.255.255.255
acl hq src 152.83.0.0/255.255.0.0
acl opsperth src 192.245.210.1-192.245.210.10/255.255.255.255
acl act1 src 138.44.0.0/255.255.0.0 152.83.0.0/255.255.0.0
acl act2 src 202.6.83.0/255.255.255.0 192.41.146.0/255.255.255.0
acl act3 src 150.203.0.0/255.255.0.0
acl vic1 src 138.194.0.0/255.255.0.0 140.79.0.0/255.255.0.0
acl vic2 src 144.110.16.0/255.255.255.0 144.110.17.0/255.255.255.0
acl vic3 src 144.110.22.0/255.255.255.0 144.110.32.0/255.255.255.0
acl vic4 src 144.110.48.0/255.255.255.0 144.110.64.0/255.255.255.0
acl vic5 src 192.102.250.0/255.255.255.0 202.8.33.0/255.255.255.0
acl vic6 src 202.8.38.0-202.8.39.0/255.255.255.0
acl vic7 src 130.116.3.0/255.255.255.0 192.102.251.0/255.255.255.0
acl vic8 src 192.203.235.0/255.255.255.0 192.124.252.0/255.255.255.0
acl vic9 src 202.0.88.0/255.255.255.0 192.16.180.0/255.255.255.0
acl vic10 src 150.229.17.0-150.229.31.0/255.255.255.0
acl vic11 src 150.229.33.0-150.229.47.0/255.255.255.0
acl vic12 src 192.68.132.0/255.255.255.0
acl nsw1 src 130.155.0.0/255.255.0.0
acl nsw2 src 192.55.219.0/255.255.255.0 192.122.176.0/255.255.255.0
acl nsw3 src 192.138.100.0/255.255.255.0 192.231.167.0/255.255.255.0
acl nsw4 src 192.207.156.0-192.207.158.0/255.255.255.0
acl nsw5 src 203.0.100.0/255.255.255.0 203.6.243.0/255.255.255.0
acl nsw6 src 203.6.255.0/255.255.255.0 203.7.128.0/255.255.255.0
acl nsw7 src 203.15.65.0/255.255.255.0
acl nsw8 src 203.4.145.0/255.255.255.0
acl qld1 src 140.253.0.0/255.255.0.0 146.118.0.0/255.255.0.0
acl qld2 src 192.94.62.0/255.255.255.0 140.253.120.0/255.255.255.0
acl qld3 src 202.14.0.0/255.255.255.0 192.207.197.0/255.255.255.0
acl qld4 src 192.94.64.0/255.255.255.0 192.231.212.0/255.255.255.0
acl qld5 src 202.12.121.0/255.255.255.0
acl qld6 src 192.231.212.0/255.255.255.0
acl qld7 src 203.12.41.0/255.255.255.0
acl sa1 src 138.194.150.0/255.255.255.0 202.9.0.0/255.255.255.0
acl sa2 src 202.9.8.0-202.9.10.0/255.255.255.0
acl sa3 src 202.9.12.0-202.9.14.0/255.255.255.0
acl sa4 src 202.9.2.0/255.255.255.0
acl sa5 src 202.9.9.0/255.255.255.0
acl wa1 src 192.245.210.0-192.245.217.0/255.255.255.0
acl wa2 src 192.54.106.0/255.255.255.0 192.65.130.0/255.255.255.0
acl wa3 src 192.149.36.0/255.255.255.0
acl tas1 src 203.18.60.0-203.18.61.0/255.255.255.0
acl tas2 src 192.67.12.0/255.255.255.0 202.0.98.0/255.255.255.0
acl tas3 src 192.150.202.0/255.255.255.0
acl tas4 src 203.12.40.0/255.255.255.0
acl nt1 src 192.94.63.0/255.255.255.0 192.207.33.0/255.255.255.0
acl SSL_ports port 443 563
acl CONNECT method CONNECT
# Allowing or Denying access based on defined access lists
#
# Access to the HTTP port:
# http_access allow|deny [!]aclname ...
#
# Access to the ICP port:
# icp_access allow|deny [!]aclname ...
# Only allow access to the cache manager functions from the local host.
http_access deny manager !localhost !hq !opsperth
http_access deny CONNECT !SSL_ports
# Deny everything else except ...
http_access deny all !proxies !localhost !act1 !act2 !act3 !nsw1 !nsw1 !nsw2 !nsw3 !nsw4 !nsw5 !nsw6 !nsw7 !nsw8 !nt1 !vic1 !vic2 !vic3 !vic4 !vic5 !vic6 !vic7 !vic8 !vic9 !vic10 !vic11 !vic12 !qld1 !qld2 !qld3 !qld4 !qld6 !qld7 !sa1 !sa2 !sa3 !sa4 !sa5 !tas1 !tas2 !tas3 !tas4 !wa1 !wa2 !wa3
# Reply to all ICP queries we receive
icp_access deny all !proxies
# TAG: miss_access
# Use to force your neighbors to use you as a sibling instead of
# a parent. For example:
#
# acl localclients src 172.16.0.0/16
# miss_access allow localclients
# miss_access deny !localclients
#
# This means that only your local clients are allowed to fetch
# MISSES and all other clients can only fetch HITS.
#
# By default, allow all clients who passed the http_access rules
# to fetch MISSES from us.
miss_access allow all
# TAG: cache_host_acl
# Just like 'cache_host_domain' but provides more flexibility by
# using ACL's.
#
# cache_host_acl cache-host [!]aclname ...
#
# NOTE: * Any number of ACL's may be given for a cache-host,
# either on the same or separate lines.
# * When multiple ACL's are given for a particular
# cache-host, the first matched ACL is applied.
# * Cache hosts with no domain or ACL restrictions are
# queried for all requests.
# * There are no defaults.
# ADMINISTRATIVE PARAMETERS
#-----------------------------------------------------------------------------
# TAG: cache_mgr
# Email-address of local cache manager who will receive
# mail if the cache dies. The default is "webmaster."
#
cache_mgr cache-admin@its.csiro.au
# TAG: cache_effective_user
# If the cache is run as root, it will change its effective/real
# UID/GID to the UID/GID specified below. The default is not to
# change UID/GID.
#
cache_effective_user nobody nogroup
# TAG: visible_hostname
# If you want to present a special hostname in error messages, etc,
# then define this. Otherwise, the return value of gethostname()
# will be used.
#
#IF ACT
visible_hostname act-proxy.csiro.au
#IF NSW
#visible_hostname nsw-proxy.csiro.au
#IF VIC
#visible_hostname vic-proxy.csiro.au
#IF QLD
#visible_hostname qld-proxy.csiro.au
#IF WA
#visible_hostname wa-proxy.csiro.au
#IF SA
#visible_hostname sa-proxy.csiro.au
#ENDIF
# OPTIONS FOR THE CACHE REGISTRATION SERVICE
#-----------------------------------------------------------------------------
# This section contains parameters for the (optional) cache
# announcement service. This service is provided to help
# cache administrators locate one another in order to join or
# create cache hierarchies.
#
# An 'announcement' message is sent (via UDP) to the registration
# service by Squid. By default, the annoucement message is NOT
# SENT unless you enable it with 'cache_announce' below.
#
# The announcement message includes your hostname, plus the
# following information from this configuration file:
#
# http_port
# icp_port
# cache_mgr
#
# All current information is processed regularly and made
# available on the Web at http://www.nlanr.net/Cache/Tracker/.
# This is how frequently to send cache announcements. The default
# is `0' which disables sending the announcement messages.
#
# To enable announcing your cache, just uncomment the line below.
#
#cache_announce 24
# This is the hostname and portnumber where the registration message
# will be sent.
#
# Format: announce_to host[:port] [filename]
#
# Hostname will default to 'sd.cache.nlanr.net' and port will default
# to 3131. If the 'filename' argument is given, the contents of that
# file will be included in the announce message.
#
#announce_to sd.cache.nlanr.net:3131
# HTTPD-ACCELERATOR OPTIONS
#-----------------------------------------------------------------------------
# TAG: httpd_accel
# If you want to run squid as an httpd accelerator, define the
# host name and port number where the real HTTP server is.
#
# If you want virtual host support then specify the hostname
# as "virtual".
#
#httpd_accel real_httpd_host real_httpd_port
# TAG: httpd_accel_with_proxy
# If you want to use squid as both a local httpd accelerator
# and as a proxy, change this to 'on'.
#
#httpd_accel_with_proxy off
# TAG: httpd_accel_uses_host_header
# HTTP/1.1 requests include a Host: header which is basically the
# hostname from the URL. Squid can be an accelerator for
# different HTTP servers by looking at this header. However,
# Squid does NOT check the value of the Host header, so it opens
# a big security hole. We recommend that this option remain
# disabled unless you are sure of what you are doing.
#
#httpd_accel_uses_host_header off
# MISCELLANEOUS
#-----------------------------------------------------------------------------
# The DNS tests exit as soon as the first site is successfully looked up
#
# If you want to disable DNS tests, do not comment out or delete this
# list. Instead use the -D command line option
#
dns_testnames internic.net usc.edu cs.colorado.edu mit.edu yale.edu
# TAG: logfile_rotate #
# Specifies the number of logfile rotations to make upon receiving
# a USR1 signal. The default is 10, which will rotate with
# extensions 0 through 9. Setting logfile_rotate to 0 will
# disable the rotation, but the logfiles are still closed and
# re-opened. This will enable you to rename the logfiles yourself
# just before sending a USR1 signal to the squid process.
#
logfile_rotate 0
# TAG: append_domain
# Appends local domain name to hostnames without any dots in them.
# append_domain must begin with a period.
#
#append_domain .yourdomain.com
# TAG: tcp_recv_bufsize
# Size of receive buffer to set for TCP sockets. Probably just
# as easy to change your kernel's default. Set to zero to use
# the default buffer size.
#
#tcp_recv_bufsize 0
# TAG: ssl_proxy
# Specify the name of a 'cache_host' listed above, or a hostname
# and port number where all SSL requests should be forwarded to.
#
# Usage: ssl_proxy cache_host
# ssl_proxy host:port
#
#ssl_proxy
# TAG: passthrough_proxy
# Specify the name of a 'cache_host' listed above, or a hostname
# and port number where all non-GET (i.e. POST, PUT) requests
# should be forwarded to.
#
# Usage: passthrough_proxy cache_host
# passthrough_proxy host:port
#
#passthrough_proxy
# TAG: proxy_auth
# Usage: proxy_auth passwd_file [ ignore-domain ]
#
# 'passwd_file' is an apache-style file of passwords for
# authenticated proxy access Looks like user:password, with the
# password being standard crypt() format. Proxy authentication
# is disabled by default.
#
# 'ignore-domain' is a domain name for which authorization will
# *not* be required.
#
#proxy_auth /dev/null
# TAG: err_html_text
# HTML text to include in error messages. Make this a "mailto"
# URL to your admin address, or maybe just a link to your
# organizations Web page.
#
#err_html_text
# TAG: deny_info
# Usage: deny_info URL acl
#
# This can be used to return a HTTP redirect for requests which
# do not pass the 'http_access' rules. A single ACL will cause
# the http_access check to fail. If a 'deny_info' line exists
# for that ACL then Squid returns a redirect to the given URL.
# TAG: udp_hit_obj on|off
# If set, Squid will request UDP_HIT_OBJ replies from its
# neighbors. UDP_HIT_OBJ is nice because it saves bandwidth, but
# it can cause some other problems. For one it complicates
# calculating hit rates. Also, problems arise because the ICP
# query does not contain any HTTP request headers which may
# affect the reply.
#
#udp_hit_obj off
# TAG: udp_hit_obj_size
#
# If set, Squid will limit UDP_HIT_OBJ size to be less than
# this value. Setting this value to more than SQUID_UDP_SO_SNDBUF
# will not work as expected. Set to zero to select the size
# permited by the socket.
#udp_hit_obj_size 0
# TAG: memory_pools on|off
# If set, Squid will keep pools of allocated (but unused) memory
# available for future use. If memory is a premium on your
# system, disable this.
#
#memory_pools on
# TAG: forwarded_for on|off
# If set, Squid will include your system's IP address or name
# in the HTTP requests it forwards. By default it looks like
# this:
# Forwarded: by http://foo.org:3128/ for 192.1.2.3
# If you disable this, it will appear as
# Forwarded: by http://foo.org:3128/
#
#forwarded_for on
# TAG: log_icp_queries on|off
# If set, ICP queries are logged to access.log. ICP logging
# is enabled by default, so uncomment and change the line
# below to disable it.
#log_icp_queries on
# TAG: minimum_direct_hops
# If using the ICMP pinging stuff, do direct fetches for sites
# which are no more than this many hops away.
#
minimum_direct_hops 4
# TAG: cachemgr_passwd
# Specify passwords for cachemgr operations.
#
#Usage: cachemgr_passwd password action action ...
#
# valid actions are:
# shutdown *
# info
# stats/objects
# stats/vm_objects
# stats/utilization
# stats/ipcache
# stats/fqdncache
# stats/dns
# stats/redirector
# stats/io
# stats/reply_headers
# stats/filedescriptors
# stats/netdb
# log/status *
# log/enable *
# log/disable *
# log/clear *
# log *
# parameter
# server_list
# client_list
# squid.conf *
#
# * Indicates actions which will not be performed without a
# valid password, others can be performed if not listed here.
#
# To disable an action, set the password to "disable".
# To allow performing an action without a password, set the
# password to "none".
#
#Examples:
#
# cachemgr_passwd secret shutdown
# cachemgr_passwd lesssssssecret info stats/objects
#
#Defaults: none
# TAG: swap_level1_dirs
# Number of first-level directories to create for storing cached
# objects. Minimum 1, maximum 256, default 16.
#
#swap_level1_dirs 16
# TAG: swap_level2_dirs
# Number of sub-directories to create under each first-level
# directory. Minimum 1, maximum 256, default 256.
#
#swap_level2_dirs 256
# TAG: store_avg_object_size
# Average object size, used to estimate number of objects your
# cache can hold. See doc/Release-Notes-1.1.txt. The default is
# 20K.
#store_avg_object_size 20
# TAG: store_objects_per_bucket 50
# Target number of objects per bucket in the store hash table.
# Lowering this value increases the total number of buckets and
# also the storage maintenance rate. The default is 50.
#store_objects_per_bucket 50
Received on Wed Sep 03 1997 - 04:58:11 MDT
This archive was generated by hypermail pre-2.1.9 : Tue Dec 09 2003 - 16:36:55 MST