Re: ACL Nightmare

david@avarice.nepean.uws.edu.au writes:

>Argh! Okay, I give up. Using cachemgr.cgi, I request the status of some
>item from the currently running Squid; I get the result, fine. I select
>another item, and I'm told I'm forbidden to access the item. Doesn't
>matter which item I select either, first one works, subsequent ones don't.
>
>>From access.log:
>
>137.154.210.10 TCP_MISS/555/NONE 1543 GET
> cache_object://proxy.nepean.uws.edu.au/server_list
>137.154.210.10 TCP_DENIED/403/NONE 0 GET
> cache_object://proxy.nepean.uws.edu.au/stats/general
>
>>From squid.conf:
>
>acl manager proto cache_object
>acl localhost src 127.0.0.1/255.255.255.255
>acl src_okmgr src 137.154.210.10/32
>http_access deny manager !src_okmgr !localhost
>http_access allow manager src_okmgr localhost
>
>Seems to have started around 1.0.18 (although of course this could just
>coincide with some squid.conf stuff-up - see above). Help.. :-(

Remember, the ACL's on a 'http_access' line are AND'ed together. Also,
you should specifically allow cachemgr from your host first, then deny
it from other places

    acl src_okmgr src 137.154.210.10/32 127.0.0.1/32
    acl manager proto cache_object
    http_access allow manager src_okmgr
    http_access deny manager

Duane W.
Received on Wed Nov 13 1996 - 12:36:51 MST