Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In squid.conf, there are directives for safe ports and ssl ports:

acl safe_ports (list of ports)
acl ssl_port 443

then:

http_access deny !safe_ports
http_access deny !ssl_port

My question is: why the default for http_access is deny !safe_ports and !ssl_port, why not http_access allow safe_ports or http_access allow ssl_port ?

share|improve this question

migrated from stackoverflow.com Apr 25 '11 at 6:48

This question came from our site for professional and enthusiast programmers.

1 Answer 1

If you do something like:

http_access allow safe_ports

Then all your ports will be open unless you add a directive after it to deny every port access:

http_access deny unsafe_ports

where unsafe_ports is exactly !safe_ports, but it is much easier to define a list of safe ports, than a list of unsafe ports, since the later has almost 65536 entries.

Then it is a lot easier and probably more efficient to do

http_access deny !safe_ports
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.