Re: [apache-talk] Re: [apache-talk] ????? ????, ????? traffic accounting per virtual host ...

["Eugene B. Berdnikov" <berd@xxxxxxxxxxxxxx>]

On Fri, Jul 21, 2000 at 10:49:44AM +0400, Artem Chuprina wrote:
> On Thu, Jul 20, 2000 at 06:18:48PM +0400, Eugene B. Berdnikov wrote:
> 
> > > > а можно ли использовать в Squid multiple httpd_accel ?
> > 
> >   #  TAG: httpd_accel_uses_host_header    on|off
> >   #       HTTP/1.1 requests include a Host: header which is basically the
> >   #       hostname from the URL.  Squid can be an accelerator for
> >   #       different HTTP servers by looking at this header.  However,
> >   #       Squid does NOT check the value of the Host header, so it opens
> >   #       a big security hole.  We recommend that this option remain
> >   #       disabled unless you are sure of what you are doing. 
> >   #
> >   #       However, you will need to enable this option if you run Squid
> >   #       as a transparent proxy.  Otherwise, virtual servers which
> >   #       require the Host: header will not be properly cached.
> > 
> >   httpd_accel_uses_host_header on
> 
> Слова big security hole в данном случае существенны. Ибо честный httpd
> accelerator, в отличие от transparent proxy, не может быть защищен acl на его
> использование.

 Пакетным фильтром можно ограничить список хостов, к которым сможет
 обращаться этот hpptd-accel. Судя по тому, что писал инициатор треда,
 для него это не проблема. Проблема скорее в квалификации - поискать в доках
 и конфиге словa "accel|trans|proxy" особого труда не составляло.
--
 Eugene Berdnikov
=============================================================================
=               Apache-Talk@xxxxxxxxxxxxx mailing list                      =
Mail "unsubscribe apache-talk" to majordomo@xxxxxxxxxxxxx if you want to quit.
=       Archive avaliable at http://www.lexa.ru/apache-talk                 =