[squid-users] squid + Office365 + Trend Micro

Hello,

I've successfully set up a debian squid + squidguard proxyserver using
Kerberos to WIN2008 domain.
Everything works as expected, except whatever I do I can't get this
exception to work for our
office365 environment and our Trend Micro AV (cloud with agents).

You can check my /squid.conf/ in my signature..

/my_acl_definitions.conf/ has
*acl direct dstdomain /etc/squid3/conf.d/domains*

/my_access.conf/ has
*http_access allow auth all
http_access allow !auth direct
http_access deny all*

/domains/ has
*.live.com
.lync.com
.glbdns.microsoft.com
.microsoft.com
.microsoftonline.com
.microsoftonline-p.net
.microsoftonline-p.com
.microsoftonlineimages.com
.microsoftonlinesupport.net
.msn.com
.msn.co.jp
.msn.co.uk
.msecnd.net
.msocdn.com
.office.net
.office365.com
.officeapps.live.com
.outlook.com
.sharepoint.com
.sharepointonline.com
.activedirectory.windowsazure.com
.phonefactor.net
.aadrm.com
.trendmicro.com
.outlook.com*

/access.log/
*1392112172.984 0 10.10.10.58 TCP_DENIED/407 4129 OPTIONS
http://office.microsoft.com/client/15/templates/ - NONE/- text/html
1392112172.988 0 10.10.10.58 TCP_DENIED/407 4129 OPTIONS
http://office.microsoft.com/client/15/templates/ - NONE/- text/html
1392112172.990 0 10.10.10.58 TCP_DENIED/407 4129 OPTIONS
http://office.microsoft.com/client/15/templates/ - NONE/- text/html
1392112172.993 0 10.10.10.58 TCP_DENIED/407 4129 OPTIONS
http://office.microsoft.com/client/15/templates/ - NONE/- text/html
1392112173.244 0 10.10.10.58 TCP_DENIED/407 4150 GET
http://office.microsoft.com/client/15/templates/start? - NONE/- text/html
1392112526.808 0 10.10.10.58 TCP_DENIED/407 4148 GET
http://office.microsoft.com/client/15/templates/start? - NONE/- text/html
1392112526.841 0 10.10.10.58 TCP_DENIED/407 4128 OPTIONS
http://office.microsoft.com/client/15/templates/ - NONE/- text/html
1392112526.843 0 10.10.10.58 TCP_DENIED/407 4128 OPTIONS
http://office.microsoft.com/client/15/templates/ - NONE/- text/html
1392112526.846 0 10.10.10.58 TCP_DENIED/407 4128 OPTIONS
http://office.microsoft.com/client/15/templates/ - NONE/- text/html
1392112526.849 0 10.10.10.58 TCP_DENIED/407 4128 OPTIONS
http://office.microsoft.com/client/15/templates/ - NONE/- text/html
1392112526.852 0 10.10.10.58 TCP_DENIED/407 4128 OPTIONS
http://office.microsoft.com/client/15/templates/ - NONE/- text/html
1392112526.855 0 10.10.10.58 TCP_DENIED/407 4128 OPTIONS
http://office.microsoft.com/client/15/templates/ - NONE/- text/html
*

This only occurs when a client with Office 2012 connects to Office365.
(login prompt)

*1392112407.358 0 10.10.10.58 TCP_DENIED/407 3606 CONNECT
odc.officeapps.live.com:443 - NONE/- text/html
1392112407.362 0 10.10.10.58 TCP_DENIED/407 3606 CONNECT
odc.officeapps.live.com:443 - NONE/- text/html
1392112407.366 0 10.10.10.58 TCP_DENIED/407 3606 CONNECT
odc.officeapps.live.com:443 - NONE/- text/html
1392112407.370 0 10.10.10.58 TCP_DENIED/407 3606 CONNECT
odc.officeapps.live.com:443 - NONE/- text/html
1392112407.373 0 10.10.10.58 TCP_DENIED/407 3606 CONNECT
odc.officeapps.live.com:443 - NONE/- text/html
1392112407.915 0 10.10.10.58 TCP_DENIED/407 3606 CONNECT
odc.officeapps.live.com:443 - NONE/- text/html
1392112407.917 0 10.10.10.58 TCP_DENIED/407 3606 CONNECT
odc.officeapps.live.com:443 - NONE/- text/html
1392112407.921 0 10.10.10.58 TCP_DENIED/407 3606 CONNECT
odc.officeapps.live.com:443 - NONE/- text/html
1392112407.925 0 10.10.10.58 TCP_DENIED/407 3606 CONNECT
odc.officeapps.live.com:443 - NONE/- text/html
1392112407.930 0 10.10.10.58 TCP_DENIED/407 3606 CONNECT
odc.officeapps.live.com:443 - NONE/- text/html
1392112407.933 0 10.10.10.58 TCP_DENIED/407 3606 CONNECT
odc.officeapps.live.com:443 - NONE/- text/html
1392113039.469 0 10.10.10.58 TCP_DENIED/407 3606 CONNECT
odc.officeapps.live.com:443 - NONE/- text/html*

Trend Micro alerts (client agent can scan and update but status is shown
red...)

*1392020956.008 1 10.10.10.222 TCP_DENIED/407 3956 CONNECT
wfbssvc51.icrc.trendmicro.com:443 - NONE/- text/html
1392020956.010 1 10.10.10.222 TCP_DENIED/407 3951 CONNECT
wfbssvc51.icrc.trendmicro.com:443 - NONE/- text/html
1392020956.022 1 10.10.10.222 TCP_DENIED/407 3956 CONNECT
wfbssvc51.icrc.trendmicro.com:443 - NONE/- text/html
1392020956.024 1 10.10.10.222 TCP_DENIED/407 3953 CONNECT
wfbssvc51.icrc.trendmicro.com:443 - NONE/- text/html
1392020956.026 0 10.10.10.222 TCP_DENIED/407 3931 CONNECT
wfbssvc51.icrc.trendmicro.com:443 - NONE/- text/html
1392020975.692 0 10.10.10.222 TCP_DENIED/407 4382 GET
http://wfbs-svc50-en.url.trendmicro.com/T/128/zNEsOn1a_kd_RI6YGnho8iCUPl3r418cAiHfhXRAQAAmhIJ9cIhl0psS9zNeKVWtmMBWkaswp8PLJPrURUYLUXPmRd9D3j2cDnR59QHDXqUKpcLar8P7YX-OFkV3vihW
- NONE/- text/html
1392020975.693 0 10.10.10.222 TCP_DENIED/407 4529 GET
http://wfbs-svc50-en.url.trendmicro.com/T/128/zNEsOn1a_kd_RI6YGnho8iCUPl3r418cAiHfhXRAQAAmhIJ9cIhl0psS9zNeKVWtmMBWkaswp8PLJPrURUYLUXPmRd9D3j2cDnR59QHDXqUKpcLar8P7YX-OFkV3vihW
- NONE/- text/html
1392020975.706 1 10.10.10.222 TCP_DENIED/407 4382 GET
http://wfbs-svc50-en.url.trendmicro.com/T/128/zNEsOn1a_kd_RI6YGnho8iCUPl3r418cAiHfhXRAQAAmhIJ9cIhl0psS9zNeKVWtmMBWkaswp8PLJPrURUYLUXPmRd9D3j2cDnR59QHDXqUKpcLar8P7YX-OFkV3vihW
- NONE/- text/html
1392020975.708 0 10.10.10.222 TCP_DENIED/407 4527 GET
http://wfbs-svc50-en.url.trendmicro.com/T/128/zNEsOn1a_kd_RI6YGnho8iCUPl3r418cAiHfhXRAQAAmhIJ9cIhl0psS9zNeKVWtmMBWkaswp8PLJPrURUYLUXPmRd9D3j2cDnR59QHDXqUKpcLar8P7YX-OFkV3vihW
- NONE/- text/html
1392021040.654 0 10.10.10.39 TCP_DENIED/407 3642 CONNECT
wfbs-svc-emea-aal.trendmicro.com:443 - NONE/- text/html
1392021040.656 0 10.10.10.39 TCP_DENIED/407 3642 CONNECT
wfbs-svc-emea-aal.trendmicro.com:443 - NONE/- text/html
1392021040.664 0 10.10.10.39 TCP_DENIED/407 3777 GET
http://wfbs-svc-emea-aal.trendmicro.com/ - NONE/- text/html
1392021040.667 0 10.10.10.39 TCP_DENIED/407 3777 GET
http://wfbs-svc-emea-aal.trendmicro.com/ - NONE/- text/html
1392021040.670 0 10.10.10.39 TCP_DENIED/407 3777 GET
http://wfbs-svc-emea-aal.trendmicro.com/ - NONE/- text/html
1392021059.460 0 10.10.10.222 TCP_DENIED/407 3643 CONNECT
wfbs-svc-emea-aal.trendmicro.com:443 - NONE/- text/html
1392021059.462 0 10.10.10.222 TCP_DENIED/407 3643 CONNECT
wfbs-svc-emea-aal.trendmicro.com:443 - NONE/- text/html
1392021059.465 0 10.10.10.222 TCP_DENIED/407 3704 GET
http://wfbs-svc-emea-aal.trendmicro.com/ - NONE/- text/html
1392021059.467 0 10.10.10.222 TCP_DENIED/407 3704 GET
http://wfbs-svc-emea-aal.trendmicro.com/ - NONE/- text/html*

Thank you for your time!

Stanny

-----
squid.conf

--
View this message in context: http://squid-web-proxy-cache.1019090.n4.nabble.com/squid-Office365-Trend-Micro-tp4664707.html
Sent from the Squid - Users mailing list archive at Nabble.com.