如何设置Squid,以便它绕过localnet上客户端的基本身份验证?

问题描述 投票:0回答:1

我有这个鱿鱼配置文件,应该使用基本身份验证来防止鱿鱼未经身份验证的访问。

Squid作为docker服务运行,我想授予所有其他docker服务未经身份验证的访问。我观察到这些服务在网络范围10.0.0.1-10.0.255.254中运行(根据squid的access_log)。

当我从互联网访问鱿鱼时,基本身份验证正常工作。

当我从服务的外壳访问乌贼时,它仍在要求身份验证。预期的结果将是自由通过。我想念什么?

#port
http_port 1379

#dns
dns_nameservers 127.0.0.11 146.185.167.43 80.241.218.68 46.182.19.48 85.95.218.42 185.95.218.43 91.239.100.100 89.233.43.71

#logging
access_log /etc/squid/access_log
cache_log /etc/squid/error_log

#authentication
auth_param basic program /usr/lib/squid3/basic_ncsa_auth /etc/squid/squid_auth
auth_param basic children 5
auth_param basic realm Proxy Authentication Required
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off

#disable caching
cache deny all

#turn of persistent connections, so round robin works properly
client_persistent_connections off
server_persistent_connections off

#acl's

#local net
acl localnet src 10.0.0.0/16     # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines

#cache manager
acl manager url_regex -i ^cache_object:// /squid-internal-mgr/

#basic auth
acl auth_users proxy_auth squid

#smtp relaying
acl smtp port 25
acl smtps port 465
acl CONNECT method CONNECT

#safe ports
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl CONNECT method CONNECT


#protect against smtp attacks
http_access allow localhost manager
http_access deny manager

#allow only safe ports
http_access deny !Safe_ports

#prohibit to use the proxy as an smtp relay
http_access deny CONNECT !SSL_ports
http_access deny CONNECT smtp
http_access deny CONNECT smtps
http_access allow localnet
http_access allow localhost
http_access allow auth_users
http_access deny all

#remove headers
via off
forwarded_for off
forwarded_for truncate
follow_x_forwarded_for deny all
request_header_access Cache-Control deny all
request_header_access Via deny all
request_header_access X-Forwarded-For deny all


#wire everything to parent
cache_peer hannibal parent 1279 0 no-query default
prefer_direct off
never_direct allow all
docker squid
1个回答
0
投票

您需要正确地(重新)启动docker swarm服务。

我的原始评论不能发布为答案,因为This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post.,所以它将被我的主持人删除。

© www.soinside.com 2019 - 2024. All rights reserved.