# acl administrative
acl manager proto cache_object
acl localhost src 127.0.0.0/8
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl CONNECT method CONNECT
acl purge method PURGE


acl virus               dstdomain .eicar.org
acl virus               dstdomain .eicar.com
###########################################################
# acl reseau client
###########################################################
# Agarik
acl bab.agarik.com src 192.168.254.20/32
acl bab.agarik.com src 192.168.254.30/32
acl bab.agarik.com src 192.168.254.93/32
acl bab.agarik.com src 192.168.254.192/32
acl lcse01.agarik.com src 10.253.34.14/32
acl 10.252.42.5 src 10.252.42.5
acl 10.252.44.54 src 10.252.44.54
acl 10.252.44.4 src 10.252.44.4
acl reseau.install.mep.agarik.com src 10.253.6.0/24


# acl destination
acl windowsupdate       dstdomain windowsupdate.microsoft.com
acl windowsupdate       dstdomain .update.microsoft.com
acl windowsupdate       dstdomain download.windowsupdate.com
acl windowsupdate       dstdomain redir.metaservices.microsoft.com
acl windowsupdate       dstdomain images.metaservices.microsoft.com
acl ubuntu              dstdomain .ubuntu.com
acl nolimit             dstdomain *

# Pour squidclamav
http_access allow localhost
http_access allow purge localhost
http_access deny purge
url_rewrite_access deny localhost

# Pour le manager
http_access allow manager localhost
http_access deny manager

# On autorise que les ports 'classiques' de telechargement http/https/ftp
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

###########################################################
# Autorisations clients
###########################################################
# Agarik
http_access allow CONNECT wuCONNECT bab.agarik.com
http_access allow windowsupdate bab.agarik.com
# La regle ci dessous autorise � aller partout sans restriction
http_access allow reseau.install.mep.agarik.com

# on refuse tout
icp_access deny all
htcp_access deny all
http_access deny all

http_port 3128
hierarchy_stoplist cgi-bin ?

url_rewrite_program /opt/applis/squidclamav/bin/squidclamav -c /opt/applis/squidclamav/etc/squidclamav.conf
url_rewrite_children 15

access_log syslog:local6.warning squid
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern (cgi-bin|\?)    0       0%      0
refresh_pattern .               0       20%     4320
icp_port 3130
coredump_dir /opt/applis/squid/var/logs
cache_dir ufs /opt/applis/squid/var/cache 1024 16 256

