Помогите со Squid

#Recommended minimum configuration per scheme:
#auth_param negotiate program <uncomment and complete this line to activate>
#auth_param negotiate children 5
#auth_param negotiate keep_alive on
#auth_param ntlm program <uncomment and complete this line to activate>
#auth_param ntlm children 5
#auth_param ntlm keep_alive on
#auth_param digest program <uncomment and complete this line>
#auth_param digest children 5
#auth_param digest realm Squid proxy-caching web server
#auth_param digest nonce_garbage_interval 5 minutes
#auth_param digest nonce_max_duration 30 minutes
#auth_param digest nonce_max_count 50
#auth_param basic program <uncomment and complete this line>
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
#  TAG: authenticate_cache_garbage_interval
#    The time period between garbage collection across the username cache.
#    This is a tradeoff between memory utilization (long intervals - say
#    2 days) and CPU (short intervals - say 1 minute). Only change if you
#    have good reason to.
#
#Default:
# authenticate_cache_garbage_interval 1 hour
#  TAG: authenticate_ttl
#    The time a user & their credentials stay in the logged in
#    user cache since their last request. When the garbage
#    interval passes, all user credentials that have passed their
#    TTL are removed from memory.
#
#Default:
# authenticate_ttl 1 hour
#  TAG: authenticate_ip_ttl
#    If you use proxy authentication and the 'max_user_ip' ACL,
#    this directive controls how long Squid remembers the IP
#    addresses associated with each user.  Use a small value
#    (e.g., 60 seconds) if your users might change addresses
#    quickly, as is the case with dialups.   You might be safe
#    using a larger value (e.g., 2 hours) in a corporate LAN
#    environment with relatively static address assignments.
#
#Default:
# authenticate_ip_ttl 0 seconds
# ACCESS CONTROLS
# -----------------------------------------------------------------------------
#Recommended minimum configuration:
acl Sams2Time1 time MTWHFAS 23:00-23:59
acl Sams2Template10 proxy_auth kovalev
acl Sams2Allow3 dstdom_regex [url]http://ya.ru[/url]/
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32
#
# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
#acl localnet src 10.0.0.0/8    # RFC1918 possible internal network
#acl localnet src 172.16.0.0/12    # RFC1918 possible internal network
#acl localnet src 192.168.0.0/16    # RFC1918 possible internal network
#
acl SSL_ports port 443
acl Safe_ports port 80        # http
acl Safe_ports port 21        # ftp
acl Safe_ports port 443        # https
acl Safe_ports port 70        # gopher
acl Safe_ports port 210        # wais
acl Safe_ports port 1025-65535    # unregistered ports
acl Safe_ports port 280        # http-mgmt
acl Safe_ports port 488        # gss-http
acl Safe_ports port 591        # filemaker
acl Safe_ports port 777        # multiling http
acl CONNECT method CONNECT
#  TAG: http_access
#Recommended minimum configuration:
#
# Only allow cachemgr access from localhost
# Setup Sams2 HTTP Access here
http_access allow Sams2Template10 Sams2Allow3
http_access allow Sams2Template10 Sams2Time1
http_access allow manager localhost
http_access deny manager
# Deny requests to unknown ports
http_access deny !Safe_ports
# Deny CONNECT to other than SSL ports
http_access deny CONNECT !SSL_ports
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
#http_access allow localnet
http_access allow localhost
# And finally deny all other access to this proxy
http_access deny all
#  TAG: http_reply_access
#  TAG: icp_access
icp_access deny all
#  TAG: htcp_access
#  TAG: htcp_clr_access
#  TAG: miss_access
#  TAG: ident_lookup_access
# NETWORK OPTIONS
# -----------------------------------------------------------------------------
#  TAG: http_port
#    Usage:    port [options]
#        hostname:port [options]
#        1.2.3.4:port [options]
#
# Squid normally listens to port 3128
http_port 10.17.17.1:3128
#  TAG: https_port
#  TAG: tcp_outgoing_tos
#  TAG: clientside_tos
#  TAG: tcp_outgoing_address
# SSL OPTIONS
#  TAG: sslproxy_client_certificate
# Note: This option is only available if Squid is rebuilt with the
#       --enable-ssl option
#
#    Client SSL Certificate to use when proxying https:// URLs
#
#Default:
# none
#  TAG: sslproxy_client_key
# Note: This option is only available if Squid is rebuilt with the
#       --enable-ssl option
#
#    Client SSL Key to use when proxying https:// URLs
#
#Default:
# none
#  TAG: sslproxy_version
# Note: This option is only available if Squid is rebuilt with the
#       --enable-ssl option
#
#    SSL version level to use when proxying https:// URLs
#
#Default:
# sslproxy_version 1
#  TAG: sslproxy_options
# Note: This option is only available if Squid is rebuilt with the
#       --enable-ssl option
#
#    SSL engine options to use when proxying https:// URLs
#
#Default:
# none
#  TAG: sslproxy_cipher
# Note: This option is only available if Squid is rebuilt with the
#       --enable-ssl option
#
#    SSL cipher list to use when proxying https:// URLs
#
#Default:
# none
#  TAG: sslproxy_cafile
# Note: This option is only available if Squid is rebuilt with the
#       --enable-ssl option
#
#    file containing CA certificates to use when verifying server
#    certificates while proxying https:// URLs
#
#Default:
# none
#  TAG: sslproxy_capath
# Note: This option is only available if Squid is rebuilt with the
#       --enable-ssl option
#
#    directory containing CA certificates to use when verifying
#    server certificates while proxying https:// URLs
#
#Default:
# none
#  TAG: sslproxy_flags
# Note: This option is only available if Squid is rebuilt with the
#       --enable-ssl option
#
#    Various flags modifying the use of SSL while proxying https:// URLs:
#        DONT_VERIFY_PEER    Accept certificates even if they fail to
#                verify.
#        NO_DEFAULT_CA    Don't use the default CA list built in
#                to OpenSSL.
#
#Default:
# none
#  TAG: sslpassword_program
# Note: This option is only available if Squid is rebuilt with the
#       --enable-ssl option
#
#    Specify a program used for entering SSL key passphrases
#    when using encrypted SSL certificate keys. If not specified
#    keys must either be unencrypted, or Squid started with the -N
#    option to allow it to query interactively for the passphrase.
#
#Default:
# none
# OPTIONS WHICH AFFECT THE NEIGHBOR SELECTION ALGORITHM
# -----------------------------------------------------------------------------
#  TAG: cache_peer
#    To specify other caches in a hierarchy, use the format:
#
#        cache_peer hostname type http-port icp-port [options]
#
#    For example,
#
#    #                                        proxy  icp
#    #          hostname             type     port   port  options
#    #          -------------------- -------- ----- -----  -----------
#    cache_peer parent.foo.net       parent    3128  3130  proxy-only default
#    cache_peer sib1.foo.net         sibling   3128  3130  proxy-only
#    cache_peer sib2.foo.net         sibling   3128  3130  proxy-only
#
#          type:  either 'parent', 'sibling', or 'multicast'.
#
#    proxy-port:  The port number where the cache listens for proxy
#             requests.
#
#      icp-port:  Used for querying neighbor caches about
#             objects.  To have a non-ICP neighbor
#             specify '7' for the ICP port and make sure the
#             neighbor machine has the UDP echo port
#             enabled in its /etc/inetd.conf file.
#        NOTE: Also requires icp_port option enabled to send/receive
#              requests via this method.
#
#        options: proxy-only
#             weight=n
#             basetime=n
#             ttl=n
#             no-query
#             background-ping
#             default
#             round-robin
#             weighted-round-robin
#             carp
#             userhash
#             sourcehash
#             multicast-responder
#             closest-only
#             no-digest
#             no-netdb-exchange
#             no-delay
#             login=user:password | PASS | *:password
#             connect-timeout=nn
#             digest-url=url
#             allow-miss
#             max-conn=n
#             htcp
#             htcp-oldsquid
#             originserver
#             name=xxx
#             forceddomain=name
#             ssl
#             sslcert=/path/to/ssl/certificate
#             sslkey=/path/to/ssl/key
#             sslversion=1|2|3|4
#             sslcipher=...
#             ssloptions=...
#             front-end-https[=on|auto]
#
#             use 'proxy-only' to specify objects fetched
#             from this cache should not be saved locally.
#
#             use 'weight=n' to affect the selection of a peer
#             during any weighted peer-selection mechanisms.
#             The weight must be an integer; default is 1,
#             larger weights are favored more.
#             This option does not affect parent selection if a peering
#             protocol is not in use.
#
#             use 'basetime=n' to specify a base amount to
#             be subtracted from round trip times of parents.
#             It is subtracted before division by weight in calculating
#             which parent to fectch from. If the rtt is less than the
#             base time the rtt is set to a minimal value.
#
#             use 'ttl=n' to specify a IP multicast TTL to use
#             when sending an ICP queries to this address.
#             Only useful when sending to a multicast group.
#             Because we don't accept ICP replies from random
#             hosts, you must configure other group members as
#             peers with the 'multicast-responder' option below.
#
#             use 'no-query' to NOT send ICP queries to this
#             neighbor.
#
#             use 'background-ping' to only send ICP queries to this
#             neighbor infrequently. This is used to keep the neighbor
#             round trip time updated and is usually used in
#             conjunction with weighted-round-robin.
#
#             use 'default' if this is a parent cache which can
#             be used as a "last-resort" if a peer cannot be located
#             by any of the peer-selection mechanisms.
#             If specified more than once, only the first is used.
#
#             use 'round-robin' to define a set of parents which
#             should be used in a round-robin fashion in the
#             absence of any ICP queries.
#
#             use 'weighted-round-robin' to define a set of parents
#             which should be used in a round-robin fashion with the
#             frequency of each parent being based on the round trip
#             time. Closer parents are used more often.
#             Usually used for background-ping parents.
#
#             use 'carp' to define a set of parents which should
#             be used as a CARP array. The requests will be
#             distributed among the parents based on the CARP load
#             balancing hash function based on their weight.
#
#             use 'userhash' to load-balance amongst a set of parents
#             based on the client proxy_auth or ident username.
#
#             use 'sourcehash' to load-balance amongst a set of parents
#             based on the client source ip.
#
#             'multicast-responder' indicates the named peer
#             is a member of a multicast group.  ICP queries will
#             not be sent directly to the peer, but ICP replies
#             will be accepted from it.
#
#             'closest-only' indicates that, for ICP_OP_MISS
#             replies, we'll only forward CLOSEST_PARENT_MISSes
#             and never FIRST_PARENT_MISSes.
#
#             use 'no-digest' to NOT request cache digests from
#             this neighbor.
#
#             'no-netdb-exchange' disables requesting ICMP
#             RTT database (NetDB) from the neighbor.
#
#             use 'no-delay' to prevent access to this neighbor
#             from influencing the delay pools.
#
#             use 'login=user:password' if this is a personal/workgroup
#             proxy and your parent requires proxy authentication.
#             Note: The string can include URL escapes (i.e. %20 for
#             spaces). This also means % must be written as %%.
#
#             use 'login=PASS' if users must authenticate against
#             the upstream proxy or in the case of a reverse proxy
#             configuration, the origin web server.  This will pass
#             the users credentials as they are to the peer.
#             This only works for the Basic HTTP authentication scheme.
#             Note: To combine this with proxy_auth both proxies must
#             share the same user database as HTTP only allows for
#             a single login (one for proxy, one for origin server).
#             Also be warned this will expose your users proxy
#             password to the peer. USE WITH CAUTION
#
#             use 'login=*:password' to pass the username to the
#             upstream cache, but with a fixed password. This is meant
#             to be used when the peer is in another administrative
#             domain, but it is still needed to identify each user.
#             The star can optionally be followed by some extra
#             information which is added to the username. This can
#             be used to identify this proxy to the peer, similar to
#             the login=username:password option above.
#
#             use 'connect-timeout=nn' to specify a peer
#             specific connect timeout (also see the
#             peer_connect_timeout directive)
#
#             use 'digest-url=url' to tell Squid to fetch the cache
#             digest (if digests are enabled) for this host from
#             the specified URL rather than the Squid default
#             location.
#
#             use 'allow-miss' to disable Squid's use of only-if-cached
#             when forwarding requests to siblings. This is primarily
#             useful when icp_hit_stale is used by the sibling. To
#             extensive use of this option may result in forwarding
#             loops, and you should avoid having two-way peerings
#             with this option. (for example to deny peer usage on
#             requests from peer by denying cache_peer_access if the
#             source is a peer)
#
#             use 'max-conn=n' to limit the amount of connections Squid
#             may open to this peer.
#
#             use 'htcp' to send HTCP, instead of ICP, queries
#             to the neighbor.  You probably also want to
#             set the "icp port" to 4827 instead of 3130.
#             You MUST also set htcp_access expicitly. The default of
#             deny all will prevent peer traffic.
#
#             use 'htcp-oldsquid' to send HTCP to old Squid versions
#             You MUST also set htcp_access expicitly. The default of
#             deny all will prevent peer traffic.             
#
#             'originserver' causes this parent peer to be contacted as
#             a origin server. Meant to be used in accelerator setups.
#
#             use 'name=xxx' if you have multiple peers on the same
#             host but different ports. This name can be used to
#             differentiate the peers in cache_peer_access and similar
#             directives.
#
#             use 'forceddomain=name' to forcibly set the Host header
#             of requests forwarded to this peer. Useful in accelerator
#             setups where the server (peer) expects a certain domain
#             name and using redirectors to feed this domain name
#             is not feasible.
#
#             use 'ssl' to indicate connections to this peer should
#             be SSL/TLS encrypted.
#
#             use 'sslcert=/path/to/ssl/certificate' to specify a client
#             SSL certificate to use when connecting to this peer.
#
#             use 'sslkey=/path/to/ssl/key' to specify the private SSL
#             key corresponding to sslcert above. If 'sslkey' is not
#             specified 'sslcert' is assumed to reference a
#             combined file containing both the certificate and the key.
#
#             use sslversion=1|2|3|4 to specify the SSL version to use
#             when connecting to this peer
#            1 = automatic (default)
#            2 = SSL v2 only
#            3 = SSL v3 only
#            4 = TLS v1 only
#
#             use sslcipher=... to specify the list of valid SSL ciphers
#             to use when connecting to this peer.
#
#             use ssloptions=... to specify various SSL engine options:
#            NO_SSLv2  Disallow the use of SSLv2
#            NO_SSLv3  Disallow the use of SSLv3
#            NO_TLSv1  Disallow the use of TLSv1
#             See src/ssl_support.c or the OpenSSL documentation for
#             a more complete list.
#
#             use sslcafile=... to specify a file containing
#             additional CA certificates to use when verifying the
#             peer certificate.
#
#             use sslcapath=... to specify a directory containing
#             additional CA certificates to use when verifying the
#             peer certificate.
#
#             use sslcrlfile=... to specify a certificate revocation
#             list file to use when verifying the peer certificate.
#             
#             use sslflags=... to specify various flags modifying the
#             SSL implementation:
#            DONT_VERIFY_PEER
#                Accept certificates even if they fail to
#                verify.
#            NO_DEFAULT_CA
#                Don't use the default CA list built in
#                to OpenSSL.
#            DONT_VERIFY_DOMAIN
#                Don't verify the peer certificate
#                matches the server name
#
#             use ssldomain= to specify the peer name as advertised
#             in it's certificate. Used for verifying the correctness
#             of the received peer certificate. If not specified the
#             peer hostname will be used.
#
#             use front-end-https to enable the "Front-End-Https: On"
#             header needed when using Squid as a SSL frontend in front
#             of Microsoft OWA. See MS KB document Q307347 for details
#             on this header. If set to auto the header will
#             only be added if the request is forwarded as a https://
#             URL.
#
#Default:
# none
#  TAG: cache_peer_domain
#    Use to limit the domains for which a neighbor cache will be
#    queried.  Usage:
#
#    cache_peer_domain cache-host domain [domain ...]
#    cache_peer_domain cache-host !domain
#
#    For example, specifying
#
#        cache_peer_domain parent.foo.net    .edu
#
#    has the effect such that UDP query packets are sent to
#    'bigserver' only when the requested object exists on a
#    server in the .edu domain.  Prefixing the domainname
#    with '!' means the cache will be queried for objects
#    NOT in that domain.
#
#    NOTE:    * Any number of domains may be given for a cache-host,
#          either on the same or separate lines.
#        * When multiple domains are given for a particular
#          cache-host, the first matched domain is applied.
#        * Cache hosts with no domain restrictions are queried
#          for all requests.
#        * There are no defaults.
#        * There is also a 'cache_peer_access' tag in the ACL
#          section.
#
#Default:
# none
#  TAG: cache_peer_access
#    Similar to 'cache_peer_domain' but provides more flexibility by
#    using ACL elements.
#
#    cache_peer_access cache-host allow|deny [!]aclname ...
#
#    The syntax is identical to 'http_access' and the other lists of
#    ACL elements.  See the comments for 'http_access' below, or
#    the Squid FAQ ([url]http://www.squid-cache.org/FAQ/FAQ-10.html[/url]).
#
#Default:
# none
#  TAG: neighbor_type_domain
#    usage: neighbor_type_domain neighbor parent|sibling domain domain ...
#
#    Modifying the neighbor type for specific domains is now
#    possible.  You can treat some domains differently than the the
#    default neighbor type specified on the 'cache_peer' line.
#    Normally it should only be necessary to list domains which
#    should be treated differently because the default neighbor type
#    applies for hostnames which do not match domains listed here.
#
#EXAMPLE:
#    cache_peer cache.foo.org parent 3128 3130
#    neighbor_type_domain cache.foo.org sibling .com .net
#    neighbor_type_domain cache.foo.org sibling .au .de
#
#Default:
# none
#  TAG: dead_peer_timeout    (seconds)
#    This controls how long Squid waits to declare a peer cache
#    as "dead."  If there are no ICP replies received in this
#    amount of time, Squid will declare the peer dead and not
#    expect to receive any further ICP replies.  However, it
#    continues to send ICP queries, and will mark the peer as
#    alive upon receipt of the first subsequent ICP reply.
#
#    This timeout also affects when Squid expects to receive ICP
#    replies from peers.  If more than 'dead_peer' seconds have
#    passed since the last ICP reply was received, Squid will not
#    expect to receive an ICP reply on the next query.  Thus, if
#    your time between requests is greater than this timeout, you
#    will see a lot of requests sent DIRECT to origin servers
#    instead of to your parents.
#
#Default:
# dead_peer_timeout 10 seconds
#  TAG: hierarchy_stoplist
#    A list of words which, if found in a URL, cause the object to
#    be handled directly by this cache.  In other words, use this
#    to not query neighbor caches for certain objects.  You may
#    list this option multiple times.
#    Note: never_direct overrides this option.
#We recommend you to use at least the following line.
hierarchy_stoplist cgi-bin ?
# MEMORY CACHE OPTIONS
# -----------------------------------------------------------------------------
#  TAG: cache_mem    (bytes)
#    NOTE: THIS PARAMETER DOES NOT SPECIFY THE MAXIMUM PROCESS SIZE.
#    IT ONLY PLACES A LIMIT ON HOW MUCH ADDITIONAL MEMORY SQUID WILL
#    USE AS A MEMORY CACHE OF OBJECTS. SQUID USES MEMORY FOR OTHER
#    THINGS AS WELL. SEE THE SQUID FAQ SECTION 8 FOR DETAILS.
#
#    'cache_mem' specifies the ideal amount of memory to be used
#    for:
#        * In-Transit objects
#        * Hot Objects
#        * Negative-Cached objects
#
#    Data for these objects are stored in 4 KB blocks.  This
#    parameter specifies the ideal upper limit on the total size of
#    4 KB blocks allocated.  In-Transit objects take the highest
#    priority.
#
#    In-transit objects have priority over the others.  When
#    additional space is needed for incoming data, negative-cached
#    and hot objects will be released.  In other words, the
#    negative-cached and hot objects will fill up any unused space
#    not needed for in-transit objects.
#
#    If circumstances require, this limit will be exceeded.
#    Specifically, if your incoming request rate requires more than
#    'cache_mem' of memory to hold in-transit objects, Squid will
#    exceed this limit to satisfy the new requests.  When the load
#    decreases, blocks will be freed until the high-water mark is
#    reached.  Thereafter, blocks will be used to store hot
#    objects.
#
#Default:
# cache_mem 8 MB
#  TAG: maximum_object_size_in_memory    (bytes)
#    Objects greater than this size will not be attempted to kept in
#    the memory cache. This should be set high enough to keep objects
#    accessed frequently in memory to improve performance whilst low
#    enough to keep larger objects from hoarding cache_mem.
#
#Default:
# maximum_object_size_in_memory 8 KB
#  TAG: memory_replacement_policy
#    The memory replacement policy parameter determines which
#    objects are purged from memory when memory space is needed.
#
#    See cache_replacement_policy for details.
#
#Default:
# memory_replacement_policy lru
# DISK CACHE OPTIONS
# -----------------------------------------------------------------------------
#  TAG: cache_replacement_policy
#    The cache replacement policy parameter determines which
#    objects are evicted (replaced) when disk space is needed.
#
#        lru       : Squid's original list based LRU policy
#        heap GDSF : Greedy-Dual Size Frequency
#        heap LFUDA: Least Frequently Used with Dynamic Aging
#        heap LRU  : LRU policy implemented using a heap
#
#    Applies to any cache_dir lines listed below this.
#
#    The LRU policies keeps recently referenced objects.
#
#    The heap GDSF policy optimizes object hit rate by keeping smaller
#    popular objects in cache so it has a better chance of getting a
#    hit.  It achieves a lower byte hit rate than LFUDA though since
#    it evicts larger (possibly popular) objects.
#
#    The heap LFUDA policy keeps popular objects in cache regardless of
#    their size and thus optimizes byte hit rate at the expense of
#    hit rate since one large, popular object will prevent many
#    smaller, slightly less popular objects from being cached.
#
#    Both policies utilize a dynamic aging mechanism that prevents
#    cache pollution that can otherwise occur with frequency-based
#    replacement policies.
#
#    NOTE: if using the LFUDA replacement policy you should increase
#    the value of maximum_object_size above its default of 4096 KB to
#    to maximize the potential byte hit rate improvement of LFUDA.
#
#    For more information about the GDSF and LFUDA cache replacement
#    policies see [url]http://www.hpl.hp.com/techreports/1999/HPL-1999-69.html[/url]
#    and [url]http://fog.hpl.external.hp.com/techreports/98/HPL-98-173.html[/url].
#
#Default:
# cache_replacement_policy lru
#  TAG: cache_dir
#    Usage:
#
#    cache_dir Type Directory-Name Fs-specific-data [options]
#
#    You can specify multiple cache_dir lines to spread the
#    cache among different disk partitions.
#
#    Type specifies the kind of storage system to use. Only "ufs"
#    is built by default. To enable any of the other storage systems
#    see the --enable-storeio configure option.
#
#    'Directory' is a top-level directory where cache swap
#    files will be stored.  If you want to use an entire disk
#    for caching, this can be the mount-point directory.
#    The directory must exist and be writable by the Squid
#    process.  Squid will NOT create this directory for you.
#
#    The ufs store type:
#
#    "ufs" is the old well-known Squid storage format that has always
#    been there.
#
#    cache_dir ufs Directory-Name Mbytes L1 L2 [options]
#
#    'Mbytes' is the amount of disk space (MB) to use under this
#    directory.  The default is 100 MB.  Change this to suit your
#    configuration.  Do NOT put the size of your disk drive here.
#    Instead, if you want Squid to use the entire disk drive,
#    subtract 20% and use that value.
#
#    'Level-1' is the number of first-level subdirectories which
#    will be created under the 'Directory'.  The default is 16.
#
#    'Level-2' is the number of second-level subdirectories which
#    will be created under each first-level directory.  The default
#    is 256.
#
#    The aufs store type:
#
#    "aufs" uses the same storage format as "ufs", utilizing
#    POSIX-threads to avoid blocking the main Squid process on
#    disk-I/O. This was formerly known in Squid as async-io.
#
#    cache_dir aufs Directory-Name Mbytes L1 L2 [options]
#
#    see argument descriptions under ufs above
#
#    The diskd store type:
#
#    "diskd" uses the same storage format as "ufs", utilizing a
#    separate process to avoid blocking the main Squid process on
#    disk-I/O.
#
#    cache_dir diskd Directory-Name Mbytes L1 L2 [options] [Q1=n] [Q2=n]
#
#    see argument descriptions under ufs above
#
#    Q1 specifies the number of unacknowledged I/O requests when Squid
#    stops opening new files. If this many messages are in the queues,
#    Squid won't open new files. Default is 64
#
#    Q2 specifies the number of unacknowledged messages when Squid
#    starts blocking.  If this many messages are in the queues,
#    Squid blocks until it receives some replies. Default is 72
#
#    When Q1 < Q2 (the default), the cache directory is optimized
#    for lower response time at the expense of a decrease in hit
#    ratio.  If Q1 > Q2, the cache directory is optimized for
#    higher hit ratio at the expense of an increase in response
#    time.
#
#    The coss store type:
#
#    NP: COSS filesystem in 3.0 has been deemed too unstable for
#        production use and has thus been removed from this 3.0
#        STABLE release. We hope that it can be made usable again
#        in a future release.
#
#    block-size=n defines the "block size" for COSS cache_dir's.
#    Squid uses file numbers as block numbers.  Since file numbers
#    are limited to 24 bits, the block size determines the maximum
#    size of the COSS partition.  The default is 512 bytes, which
#    leads to a maximum cache_dir size of 512<<24, or 8 GB.  Note
#    you should not change the coss block size after Squid
#    has written some objects to the cache_dir.
#
#    The coss file store has changed from 2.5. Now it uses a file
#    called 'stripe' in the directory names in the config - and
#    this will be created by squid -z.
#
#    The null store type:
#
#    no options are allowed or required
#
#    Common options:
#
#    no-store, no new objects should be stored to this cache_dir
#
#    max-size=n, refers to the max object size this storedir supports.
#    It is used to initially choose the storedir to dump the object.
#    Note: To make optimal use of the max-size limits you should order
#    the cache_dir lines with the smallest max-size value first and the
#    ones with no max-size specification last.
#
#    Note for coss, max-size must be less than COSS_MEMBUF_SZ,
#    which can be changed with the --with-coss-membuf-size=N configure
#    option.
#
#Default:
# cache_dir ufs /var/spool/squid3 100 16 256
#  TAG: store_dir_select_algorithm
#    Set this to 'round-robin' as an alternative.
#
#Default:
# store_dir_select_algorithm least-load
#  TAG: max_open_disk_fds
#    To avoid having disk as the I/O bottleneck Squid can optionally
#    bypass the on-disk cache if more than this amount of disk file
#    descriptors are open.
#
#    A value of 0 indicates no limit.
#
#Default:
# max_open_disk_fds 0
#  TAG: minimum_object_size    (bytes)
#    Objects smaller than this size will NOT be saved on disk.  The
#    value is specified in kilobytes, and the default is 0 KB, which
#    means there is no minimum.
#
#Default:
# minimum_object_size 0 KB
#  TAG: maximum_object_size    (bytes)
#    Objects larger than this size will NOT be saved on disk.  The
#    value is specified in kilobytes, and the default is 4MB.  If
#    you wish to get a high BYTES hit ratio, you should probably
#    increase this (one 32 MB object hit counts for 3200 10KB
#    hits).  If you wish to increase speed more than your want to
#    save bandwidth you should leave this low.
#
#    NOTE: if using the LFUDA replacement policy you should increase
#    this value to maximize the byte hit rate improvement of LFUDA!
#    See replacement_policy below for a discussion of this policy.
#
#Default:
# maximum_object_size 4096 KB
#  TAG: cache_swap_low    (percent, 0-100)
#  TAG: cache_swap_high    (percent, 0-100)
#
#    The low- and high-water marks for cache object replacement.
#    Replacement begins when the swap (disk) usage is above the
#    low-water mark and attempts to maintain utilization near the
#    low-water mark.  As swap utilization gets close to high-water
#    mark object eviction becomes more aggressive.  If utilization is
#    close to the low-water mark less replacement is done each time.
#
#    Defaults are 90% and 95%. If you have a large cache, 5% could be
#    hundreds of MB. If this is the case you may wish to set these
#    numbers closer together.
#
#Default:
# cache_swap_low 90
# cache_swap_high 95
# LOGFILE OPTIONS
# -----------------------------------------------------------------------------
#  TAG: logformat
#    Usage:
#
#    logformat <name> <format specification>
#
#    Defines an access log format.
#
#    The <format specification> is a string with embedded % format codes
#
#    % format codes all follow the same basic structure where all but
#    the formatcode is optional. Output strings are automatically escaped
#    as required according to their context and the output format
#    modifiers are usually not needed, but can be specified if an explicit
#    output format is desired.
#
#        % ["|[|'|#] [-] [[0]width] [{argument}] formatcode
#
#        "    output in quoted string format
#        [    output in squid text log format as used by log_mime_hdrs
#        #    output in URL quoted format
#        '    output as-is
#
#        -    left aligned
#        width    field width. If starting with 0 the
#            output is zero padded
#        {arg}    argument such as header name etc
#
#    Format codes:
#
#        >a    Client source IP address
#        >A    Client FQDN
#        >p    Client source port
#        <A    Server IP address or peer name
#        la    Local IP address (http_port)
#        lp    Local port number (http_port)
#        ts    Seconds since epoch
#        tu    subsecond time (milliseconds)
#        tl    Local time. Optional strftime format argument
#            default %d/%b/%Y:%H:%M:%S %z
#        tg    GMT time. Optional strftime format argument
#            default %d/%b/%Y:%H:%M:%S %z
#        tr    Response time (milliseconds)
#        >h    Request header. Optional header name argument
#            on the format header[:[separator]element]
#        <h    Reply header. Optional header name argument
#            as for >h
#        un    User name
#        ul    User name from authentication
#        ui    User name from ident
#        us    User name from SSL
#        ue    User name from external acl helper
#        Hs    HTTP status code
#        Ss    Squid request status (TCP_MISS etc)
#        Sh    Squid hierarchy status (DEFAULT_PARENT etc)
#        mt    MIME content type
#        rm    Request method (GET/POST etc)
#        ru    Request URL
#        rp    Request URL-Path excluding hostname
#        rv    Request protocol version
#        et    Tag returned by external acl
#        ea    Log string returned by external acl
#        <st    Reply size including HTTP headers
#        >st    Request size including HTTP headers
#        st    Request+Reply size including HTTP headers
#        <sH    Reply high offset sent
#        <sS    Upstream object size
#        %    a literal % character
#
#    The default formats available (which do not need re-defining) are:
#
#logformat squid %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt
#logformat squidmime %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt [%>h] [%<h]
#logformat common %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %<st %Ss:%Sh
#logformat combined %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh
#
#Default:
# none
#  TAG: access_log
#    These files log client request activities. Has a line every HTTP or
#    ICP request. The format is:
#    access_log <filepath> [<logformat name> [acl acl ...]]
#    access_log none [acl acl ...]]
#
#    Will log to the specified file using the specified format (which
#    must be defined in a logformat directive) those entries which match
#    ALL the acl's specified (which must be defined in acl clauses).
#    If no acl is specified, all requests will be logged to this file.
#
#    To disable logging of a request use the filepath "none", in which case
#    a logformat name should not be specified.
#
#    To log the request via syslog specify a filepath of "syslog":
#
#    access_log syslog[:facility.priority] [format [acl1 [acl2 ....]]]
#    where facility could be any of:
#    authpriv, daemon, local0 .. local7 or user.
#
#    And priority could be any of:
#    err, warning, notice, info, debug.
access_log /var/log/squid3/access.log squid
#  TAG: log_access    allow|deny acl acl...
#    This options allows you to control which requests gets logged
#    to access.log (see access_log directive). Requests denied for
#    logging will also not be accounted for in performance counters.
#
#Default:
# none
#  TAG: cache_log
#    Cache logging file. This is where general information about
#    your cache's behavior goes. You can increase the amount of data
#    logged to this file with the "debug_options" tag below.
#
#Default:
# cache_log /var/log/squid3/cache.log
#  TAG: cache_store_log
#    Logs the activities of the storage manager.  Shows which
#    objects are ejected from the cache, and which objects are
#    saved and for how long.  To disable, enter "none". There are
#    not really utilities to analyze this data, so you can safely
#    disable it.
#
#Default:
# cache_store_log /var/log/squid3/store.log
#  TAG: cache_swap_state
#    Location for the cache "swap.state" file. This index file holds
#    the metadata of objects saved on disk.  It is used to rebuild
#    the cache during startup.  Normally this file resides in each
#    'cache_dir' directory, but you may specify an alternate
#    pathname here.  Note you must give a full filename, not just
#    a directory. Since this is the index for the whole object
#    list you CANNOT periodically rotate it!
#
#    If %s can be used in the file name it will be replaced with a
#    a representation of the cache_dir name where each / is replaced
#    with '.'. This is needed to allow adding/removing cache_dir
#    lines when cache_swap_log is being used.
#
#    If have more than one 'cache_dir', and %s is not used in the name
#    these swap logs will have names such as:
#
#        cache_swap_log.00
#        cache_swap_log.01
#        cache_swap_log.02
#
#    The numbered extension (which is added automatically)
#    corresponds to the order of the 'cache_dir' lines in this
#    configuration file.  If you change the order of the 'cache_dir'
#    lines in this file, these index files will NOT correspond to
#    the correct 'cache_dir' entry (unless you manually rename
#    them).  We recommend you do NOT use this option.  It is
#    better to keep these index files in each 'cache_dir' directory.
#
#Default:
# none
#  TAG: logfile_rotate
#    Specifies the number of logfile rotations to make when you
#    type 'squid -k rotate'. The default is 10, which will rotate
#    with extensions 0 through 9. Setting logfile_rotate to 0 will
#    disable the file name rotation, but the logfiles are still closed
#    and re-opened. This will enable you to rename the logfiles
#    yourself just before sending the rotate signal.
#
#    Note, the 'squid -k rotate' command normally sends a USR1
#    signal to the running squid process.  In certain situations
#    (e.g. on Linux with Async I/O), USR1 is used for other
#    purposes, so -k rotate uses another signal.  It is best to get
#    in the habit of using 'squid -k rotate' instead of 'kill -USR1
#    <pid>'.
#    
#    Note2, for Debian/Linux the default of logfile_rotate is
#    zero, since it includes external logfile-rotation methods.
#
#Default:
# logfile_rotate 0
#  TAG: emulate_httpd_log    on|off
#    The Cache can emulate the log file format which many 'httpd'
#    programs use.  To disable/enable this emulation, set
#    emulate_httpd_log to 'off' or 'on'.  The default
#    is to use the native log format since it includes useful
#    information Squid-specific log analyzers use.
#
#Default:
# emulate_httpd_log off
#  TAG: log_ip_on_direct    on|off
#    Log the destination IP address in the hierarchy log tag when going
#    direct. Earlier Squid versions logged the hostname here. If you
#    prefer the old way set this to off.
#
#Default:
# log_ip_on_direct on
#  TAG: mime_table
#    Pathname to Squid's MIME table. You shouldn't need to change
#    this, but the default file contains examples and formatting
#    information if you do.
#
#Default:
# mime_table /usr/share/squid3/mime.conf
#  TAG: log_mime_hdrs    on|off
#    The Cache can record both the request and the response MIME
#    headers for each HTTP transaction.  The headers are encoded
#    safely and will appear as two bracketed fields at the end of
#    the access log (for either the native or httpd-emulated log
#    formats).  To enable this logging set log_mime_hdrs to 'on'.
#
#Default:
# log_mime_hdrs off
#  TAG: useragent_log
# Note: This option is only available if Squid is rebuilt with the
#       --enable-useragent-log option
#
#    Squid will write the User-Agent field from HTTP requests
#    to the filename specified here.  By default useragent_log
#    is disabled.
#
#Default:
# none
#  TAG: referer_log
# Note: This option is only available if Squid is rebuilt with the
#       --enable-referer-log option
#
#    Squid will write the Referer field from HTTP requests to the
#    filename specified here.  By default referer_log is disabled.
#    Note that "referer" is actually a misspelling of "referrer"
#    however the misspelt version has been accepted into the HTTP RFCs
#    and we accept both.
#
#Default:
# none
#  TAG: pid_filename
#    A filename to write the process-id to.  To disable, enter "none".
#
#Default:
 pid_filename /var/run/squid3.pid
#  TAG: debug_options
#    Logging options are set as section,level where each source file
#    is assigned a unique section.  Lower levels result in less
#    output,  Full debugging (level 9) can result in a very large
#    log file, so be careful.  The magic word "ALL" sets debugging
#    levels for all sections.  We recommend normally running with
#    "ALL,1".
#
#Default:
# debug_options ALL,1
#  TAG: log_fqdn    on|off
#    Turn this on if you wish to log fully qualified domain names
#    in the access.log. To do this Squid does a DNS lookup of all
#    IP's connecting to it. This can (in some situations) increase
#    latency, which makes your cache seem slower for interactive
#    browsing.
#
#Default:
# log_fqdn off
#  TAG: client_netmask
#    A netmask for client addresses in logfiles and cachemgr output.
#    Change this to protect the privacy of your cache clients.
#    A netmask of 255.255.255.0 will log all IP's in that range with
#    the last digit set to '0'.
#
#Default:
# client_netmask 255.255.255.255
#  TAG: forward_log
# Note: This option is only available if Squid is rebuilt with the
#       -DWIP_FWD_LOG define
#
#    Logs the server-side requests.
#
#    This is currently work in progress.
#
#Default:
# none
#  TAG: strip_query_terms
#    By default, Squid strips query terms from requested URLs before
#    logging.  This protects your user's privacy.
#
#Default:
# strip_query_terms on
#  TAG: buffered_logs    on|off
#    cache.log log file is written with stdio functions, and as such
#    it can be buffered or unbuffered. By default it will be unbuffered.
#    Buffering it can speed up the writing slightly (though you are
#    unlikely to need to worry unless you run with tons of debugging
#    enabled in which case performance will suffer badly anyway..).
#
#Default:
# buffered_logs off
# OPTIONS FOR FTP GATEWAYING
# -----------------------------------------------------------------------------
#  TAG: ftp_user
#    If you want the anonymous login password to be more informative
#    (and enable the use of picky ftp servers), set this to something
#    reasonable for your domain, like wwwuser@somewhere.net
#
#    The reason why this is domainless by default is the
#    request can be made on the behalf of a user in any domain,
#    depending on how the cache is used.
#    Some ftp server also validate the email address is valid
#    (for example perl.com).
#
#Default:
# ftp_user Squid@
#  TAG: ftp_list_width
#    Sets the width of ftp listings. This should be set to fit in
#    the width of a standard browser. Setting this too small
#    can cut off long filenames when browsing ftp sites.
#
#Default:
# ftp_list_width 32
#  TAG: ftp_passive
#    If your firewall does not allow Squid to use passive
#    connections, turn off this option.
#
#Default:
# ftp_passive on
#  TAG: ftp_sanitycheck
#    For security and data integrity reasons Squid by default performs
#    sanity checks of the addresses of FTP data connections ensure the
#    data connection is to the requested server. If you need to allow
#    FTP connections to servers using another IP address for the data
#    connection turn this off.
#
#Default:
# ftp_sanitycheck on
#  TAG: ftp_telnet_protocol
#    The FTP protocol is officially defined to use the telnet protocol
#    as transport channel for the control connection. However, many
#    implementations are broken and does not respect this aspect of
#    the FTP protocol.
#
#    If you have trouble accessing files with ASCII code 255 in the
#    path or similar problems involving this ASCII code you can
#    try setting this directive to off. If that helps, report to the
#    operator of the FTP server in question that their FTP server
#    is broken and does not follow the FTP standard.
#
#Default:
# ftp_telnet_protocol on
# OPTIONS FOR EXTERNAL SUPPORT PROGRAMS
# -----------------------------------------------------------------------------
#  TAG: diskd_program
#    Specify the location of the diskd executable.
#    Note this is only useful if you have compiled in
#    diskd as one of the store io modules.
#
#Default:
# diskd_program /usr/lib/squid3/diskd
#  TAG: unlinkd_program
#    Specify the location of the executable for file deletion process.
#
#Default:
# unlinkd_program /usr/lib/squid3/unlinkd
#  TAG: pinger_program
# Note: This option is only available if Squid is rebuilt with the
#       --enable-icmp option
#
#    Specify the location of the executable for the pinger process.
#
#Default:
# pinger_program /usr/lib/squid3/pinger
# OPTIONS FOR URL REWRITING
# -----------------------------------------------------------------------------
#  TAG: url_rewrite_program
#    Specify the location of the executable for the URL rewriter.
#    Since they can perform almost any function there isn't one included.
#
#    For each requested URL rewriter will receive on line with the format
#
#    URL <SP> client_ip "/" fqdn <SP> user <SP> method [<SP> kvpairs]<NL>
#
#    In the future, the rewriter interface will be extended with
#    key=value pairs ("kvpairs" shown above).  Rewriter programs
#    should be prepared to receive and possibly ignore additional
#    whitespace-separated tokens on each input line.
#
#    And the rewriter may return a rewritten URL. The other components of
#    the request line does not need to be returned (ignored if they are).
#
#    The rewriter can also indicate that a client-side redirect should
#    be performed to the new URL. This is done by prefixing the returned
#    URL with "301:" (moved permanently) or 302: (moved temporarily).
#
#    By default, a URL rewriter is not used.
#
#Default:
# none
#  TAG: url_rewrite_children
#    The number of redirector processes to spawn. If you start
#    too few Squid will have to wait for them to process a backlog of
#    URLs, slowing it down. If you start too many they will use RAM
#    and other system resources.
#
#Default:
 url_rewrite_children 5
#  TAG: url_rewrite_concurrency
#    The number of requests each redirector helper can handle in
#    parallel. Defaults to 0 which indicates the redirector
#    is a old-style single threaded redirector.
#
#Default:
# url_rewrite_concurrency 0
#  TAG: url_rewrite_host_header
#    By default Squid rewrites any Host: header in redirected
#    requests.  If you are running an accelerator this may
#    not be a wanted effect of a redirector.
#
#    WARNING: Entries are cached on the result of the URL rewriting
#    process, so be careful if you have domain-virtual hosts.
#
#Default:
# url_rewrite_host_header on
#  TAG: url_rewrite_access
#    If defined, this access list specifies which requests are
#    sent to the redirector processes.  By default all requests
#    are sent.
#
#Default:
# none
acl Sams2Proxy dst localhost
url_rewrite_access deny Sams2Proxy
#  TAG: url_rewrite_bypass
#    When this is 'on', a request will not go through the
#    redirector if all redirectors are busy.  If this is 'off'
#    and the redirector queue grows too large, Squid will exit
#    with a FATAL error and ask you to increase the number of
#    redirectors.  You should only enable this if the redirectors
#    are not critical to your caching system.  If you use
#    redirectors for access control, and you enable this option,
#    users may have access to pages they should not
#    be allowed to request.
#
#Default:
# url_rewrite_bypass off
# OPTIONS FOR TUNING THE CACHE
# -----------------------------------------------------------------------------
#  TAG: cache
#    A list of ACL elements which, if matched and denied, cause the request to
#    not be satisfied from the cache and the reply to not be cached.
#    In other words, use this to force certain objects to never be cached.
#
#    You must use the words 'allow' or 'deny' to indicate whether items
#    matching the ACL should be allowed or denied into the cache.
#
#    Default is to allow all to be cached
#
#Default:
# none
#  TAG: refresh_pattern
#    usage: refresh_pattern [-i] regex min percent max [options]
#
#    By default, regular expressions are CASE-SENSITIVE.  To make
#    them case-insensitive, use the -i option.
#
#    'Min' is the time (in minutes) an object without an explicit
#    expiry time should be considered fresh. The recommended
#    value is 0, any higher values may cause dynamic applications
#    to be erroneously cached unless the application designer
#    has taken the appropriate actions.
#
#    'Percent' is a percentage of the objects age (time since last
#    modification age) an object without explicit expiry time
#    will be considered fresh.
#
#    'Max' is an upper limit on how long objects without an explicit
#    expiry time will be considered fresh.
#
#    options: override-expire
#         override-lastmod
#         reload-into-ims
#         ignore-reload
#         ignore-no-cache
#         ignore-no-store
#         ignore-private
#         ignore-auth
#         refresh-ims
#
#        override-expire enforces min age even if the server
#        sent an explicit expiry time (e.g., with the
#        Expires: header or Cache-Control: max-age). Doing this
#        VIOLATES the HTTP standard.  Enabling this feature
#        could make you liable for problems which it causes.
#
#        Note: override-expire does not enforce staleness - it only extends
#        freshness / min. If the server returns a Expires time which
#        is longer than your max time, Squid will still consider
#        the object fresh for that period of time.
#
#        override-lastmod enforces min age even on objects
#        that were modified recently.
#
#        reload-into-ims changes client no-cache or ``reload''
#        to If-Modified-Since requests. Doing this VIOLATES the
#        HTTP standard. Enabling this feature could make you
#        liable for problems which it causes.
#
#        ignore-reload ignores a client no-cache or ``reload''
#        header. Doing this VIOLATES the HTTP standard. Enabling
#        this feature could make you liable for problems which
#        it causes.
#
#        ignore-no-cache ignores any ``Pragma: no-cache'' and
#        ``Cache-control: no-cache'' headers received from a server.
#        The HTTP RFC never allows the use of this (Pragma) header
#        from a server, only a client, though plenty of servers
#        send it anyway.
#
#        ignore-no-store ignores any ``Cache-control: no-store''
#        headers received from a server. Doing this VIOLATES
#        the HTTP standard. Enabling this feature could make you
#        liable for problems which it causes.
#
#        ignore-private ignores any ``Cache-control: private''
#        headers received from a server. Doing this VIOLATES
#        the HTTP standard. Enabling this feature could make you
#        liable for problems which it causes.
#
#        ignore-auth caches responses to requests with authorization,
#        as if the originserver had sent ``Cache-control: public''
#        in the response header. Doing this VIOLATES the HTTP standard.
#        Enabling this feature could make you liable for problems which
#        it causes.
#
#        refresh-ims causes squid to contact the origin server
#        when a client issues an If-Modified-Since request. This
#        ensures that the client will receive an updated version
#        if one is available.
#
#    Basically a cached object is:
#
#        FRESH if expires < now, else STALE
#        STALE if age > max
#        FRESH if lm-factor < percent, else STALE
#        FRESH if age < min
#        else STALE
#
#    The refresh_pattern lines are checked in the order listed here.
#    The first entry which matches is used.  If none of the entries
#    match the default will be used.
#
#    Note, you must uncomment all the default lines if you want
#    to change one. The default setting is only active if none is
#    used.
#
#Suggested default:
refresh_pattern ^ftp:        1440    20%    10080
refresh_pattern ^gopher:    1440    0%    1440
refresh_pattern (cgi-bin|\?)    0    0%    0
refresh_pattern .        0    20%    4320
#  TAG: quick_abort_min    (KB)
#  TAG: quick_abort_max    (KB)
#  TAG: quick_abort_pct    (percent)
#    The cache by default continues downloading aborted requests
#    which are almost completed (less than 16 KB remaining). This
#    may be undesirable on slow (e.g. SLIP) links and/or very busy
#    caches.  Impatient users may tie up file descriptors and
#    bandwidth by repeatedly requesting and immediately aborting
#    downloads.
#
#    When the user aborts a request, Squid will check the
#    quick_abort values to the amount of data transfered until
#    then.
#
#    If the transfer has less than 'quick_abort_min' KB remaining,
#    it will finish the retrieval.
#
#    If the transfer has more than 'quick_abort_max' KB remaining,
#    it will abort the retrieval.
#
#    If more than 'quick_abort_pct' of the transfer has completed,
#    it will finish the retrieval.
#
#    If you do not want any retrieval to continue after the client
#    has aborted, set both 'quick_abort_min' and 'quick_abort_max'
#    to '0 KB'.
#
#    If you want retrievals to always continue if they are being
#    cached set 'quick_abort_min' to '-1 KB'.
#
#Default:
# quick_abort_min 16 KB
# quick_abort_max 16 KB
# quick_abort_pct 95
#  TAG: read_ahead_gap    buffer-size
#    The amount of data the cache will buffer ahead of what has been
#    sent to the client when retrieving an object from another server.
#
#Default:
# read_ahead_gap 16 KB
#  TAG: negative_ttl    time-units
#    Time-to-Live (TTL) for failed requests.  Certain types of
#    failures (such as "connection refused" and "404 Not Found") are
#    negatively-cached for a configurable amount of time.  The
#    default is 5 minutes.  Note that this is different from
#    negative caching of DNS lookups.
#
#    WARNING: This setting VIOLATES RFC 2616 when non-zero.
#    If you have problems with eror pages caching, set to '0 seconds'
#
#Default:
# negative_ttl 5 minutes
#  TAG: positive_dns_ttl    time-units
#    Upper limit on how long Squid will cache positive DNS responses.
#    Default is 6 hours (360 minutes). This directive must be set
#    larger than negative_dns_ttl.
#
#Default:
# positive_dns_ttl 6 hours
#  TAG: negative_dns_ttl    time-units
#    Time-to-Live (TTL) for negative caching of failed DNS lookups.
#    This also sets the lower cache limit on positive lookups.
#    Minimum value is 1 second, and it is not recommendable to go
#    much below 10 seconds.
#
#Default:
# negative_dns_ttl 1 minutes
#  TAG: range_offset_limit    (bytes)
#    Sets a upper limit on how far into the the file a Range request
#    may be to cause Squid to prefetch the whole file. If beyond this
#    limit Squid forwards the Range request as it is and the result
#    is NOT cached.
#
#    This is to stop a far ahead range request (lets say start at 17MB)
#    from making Squid fetch the whole object up to that point before
#    sending anything to the client.
#
#    A value of -1 causes Squid to always fetch the object from the
#    beginning so it may cache the result. (2.0 style)
#
#    A value of 0 causes Squid to never fetch more than the
#    client requested. (default)
#
#Default:
# range_offset_limit 0 KB
#  TAG: minimum_expiry_time    (seconds)
#    The minimum caching time according to (Expires - Date)
#    Headers Squid honors if the object can't be revalidated
#    defaults to 60 seconds. In reverse proxy environments it
#    might be desirable to honor shorter object lifetimes. It
#    is most likely better to make your server return a
#    meaningful Last-Modified header however. In ESI environments
#    where page fragments often have short lifetimes, this will
#    often be best set to 0.
#
#Default:
# minimum_expiry_time 60 seconds
#  TAG: store_avg_object_size    (kbytes)
#    Average object size, used to estimate number of objects your
#    cache can hold.  The default is 13 KB.
#
#Default:
# store_avg_object_size 13 KB
#  TAG: store_objects_per_bucket
#    Target number of objects per bucket in the store hash table.
#    Lowering this value increases the total number of buckets and
#    also the storage maintenance rate.  The default is 20.
#
#Default:
# store_objects_per_bucket 20
# HTTP OPTIONS
# -----------------------------------------------------------------------------
#  TAG: request_header_max_size    (KB)
#    This specifies the maximum size for HTTP headers in a request.
#    Request headers are usually relatively small (about 512 bytes).
#    Placing a limit on the request header size will catch certain
#    bugs (for example with persistent connections) and possibly
#    buffer-overflow or denial-of-service attacks.
#
#Default:
# request_header_max_size 20 KB
#  TAG: reply_header_max_size    (KB)
#    This specifies the maximum size for HTTP headers in a reply.
#    Reply headers are usually relatively small (about 512 bytes).
#    Placing a limit on the reply header size will catch certain
#    bugs (for example with persistent connections) and possibly
#    buffer-overflow or denial-of-service attacks.
#
#Default:
# reply_header_max_size 20 KB
#  TAG: request_body_max_size    (bytes)
#    This specifies the maximum size for an HTTP request body.
#    In other words, the maximum size of a PUT/POST request.
#    A user who attempts to send a request with a body larger
#    than this limit receives an "Invalid Request" error message.
#    If you set this parameter to a zero (the default), there will
#    be no limit imposed.
#
#Default:
# request_body_max_size 0 KB
# TIMEOUTS
# -----------------------------------------------------------------------------
# ADMINISTRATIVE PARAMETERS
# -----------------------------------------------------------------------------
# OPTIONS FOR THE CACHE REGISTRATION SERVICE
# -----------------------------------------------------------------------------
# HTTPD-ACCELERATOR OPTIONS
# -----------------------------------------------------------------------------
# DELAY POOL PARAMETERS
# -----------------------------------------------------------------------------
# PERSISTENT CONNECTION HANDLING
# -----------------------------------------------------------------------------
# CACHE DIGEST OPTIONS
# -----------------------------------------------------------------------------
# ICP OPTIONS
# -----------------------------------------------------------------------------
#  TAG: icp_port
#    The port number where Squid sends and receives ICP queries to
#    and from neighbor caches.  The standard UDP port for ICP is 3130.
#    Default is disabled (0).
#Default:
# icp_port 0
#
icp_port 3130
#  TAG: coredump_dir
coredump_dir /var/spool/squid3

auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
acl Sams2Time1 time MTWHFAS 23:00-23:59
acl Sams2Template10 proxy_auth kovalev
acl Sams2Allow3 dstdom_regex http://ya.ru/
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32
acl SSL_ports port 443
acl Safe_ports port 80        # http
acl Safe_ports port 21        # ftp
acl Safe_ports port 443        # https
acl Safe_ports port 70        # gopher
acl Safe_ports port 210        # wais
acl Safe_ports port 1025-65535    # unregistered ports
acl Safe_ports port 280        # http-mgmt
acl Safe_ports port 488        # gss-http
acl Safe_ports port 591        # filemaker
acl Safe_ports port 777        # multiling http
acl CONNECT method CONNECT
http_access allow Sams2Template10 Sams2Allow3
http_access allow Sams2Template10 Sams2Time1
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access deny all
icp_access deny all
http_port 10.17.17.1:3128
hierarchy_stoplist cgi-bin ?
access_log /var/log/squid3/access.log squid
 pid_filename /var/run/squid3.pid
 url_rewrite_children 5
acl Sams2Proxy dst localhost
url_rewrite_access deny Sams2Proxy
refresh_pattern ^ftp:        1440    20%    10080
refresh_pattern ^gopher:    1440    0%    1440
refresh_pattern (cgi-bin|\?)    0    0%    0
refresh_pattern .        0    20%    4320
icp_port 3130
coredump_dir /var/spool/squid3