squid proxy server not allowing MSN Messenger login

Hi Guys

I have setup a basic squid 3 proxy server and I am struggling to get users to login to there MSN messenger accounts.

I have tried the various ACL's available but still no luck.

Please let me know what information you need from me to get started.
Who is Participating?
arnoldConnect With a Mentor Commented:
You have a requirement for ncsa_users I think this is what the issue is i.e. the user login is not handled by msn messenger.

I didn't understand... Usually the administrador has diffilcuty to deny MSN Messenger...

Are you sure that you haven't rules in iptaples?

Can you post your ACL's?
You might be filtering cookies.
How are the proxy settings in the workstations configured?  Does it secure only http traffic or does it secure all protocols?

Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!


Make sure you have  open and allow TCP Port 1863 and have access to login.live.com
Have to verify on Squid ACL and IPtables/Firewall or Gateway Rules.

mfg1Author Commented:
Hi Guys

Please see my squid config, I have even tried to setup a new squid system and it never worked either.

also I do have port 1863 open.
Also no IP tables very basic setup.

This config is a bit messy because its in testing.

auth_param basic program /usr/sbin/ncsa_auth /etc/squid/passwd
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off
acl ncsa_users proxy_auth REQUIRED

acl all src all
acl manager proto cache_object
acl localhost src
acl to_localhost dst
acl localnet src
acl whitelist dstdomain "/etc/squid/WL/sites.whitelist.txt"
acl localnet src
acl localnet src

# MSN Messenger

acl msn url_regex -i gateway.dll
acl msnd dstdomain messenger.msn.com gateway.messenger.hotmail.com
acl msn1 req_mime_type ^application/x-msn-messenger$

acl SSL_ports port 443 563 1495 1494
acl Safe_ports port 80
acl Safe_ports port 21
acl Safe_ports port 443 563 1495 1494
acl Safe_ports port 70
acl Safe_ports port 210
acl Safe_ports port 1025-65535
acl Safe_ports port 280
acl Safe_ports port 488
acl Safe_ports port 591
acl Safe_ports port 777
acl shoutcast rep_header X-HTTP09-First-Line ^ICY.[0-9]
acl apache rep_header Server ^Apache
acl HTTPS proto HTTPS
acl SSL method CONNECT
acl SSLVPN port 8832

access_log /var/log/squid/access.log squid
http_access allow whitelist

http_access allow ncsa_users
http_access allow manager localhost
http_access allow all
http_access deny manager
http_access deny msnd
http_access deny msn
http_access deny msn1
http_access allow SSL
http_access allow !Safe_ports
http_access allow CONNECT !SSL_ports
http_access allow localnet
http_access allow localhost
http_access deny all

icp_access allow localnet
icp_access deny all

always_direct allow all

#Connecting squid to squidGuard (RYAN)
redirect_program /usr/sbin/squidGuard /etc/squidguard.conf


Any help appreciated.

mfg1Author Commented:
by the way it does work fine with the proxy settings entered on client machine
the client settings I am using are the IP x.x.x.x and port 3128 and nsca authentication but have tried with no auth and still same issue.
mfg1Author Commented:
sorry mistake in last post it should have read.
by the way it does work fine without the proxy settings entered on client machine

on sites.whitelist.txt (watch the "dot" at the beginning of the domain address).

Add acl All_dst dst all (to allow all address access at whitelist)

Whe a Rule Marches, then Squid stop validating the rest, so then the client matches this:
http_access allow all
The rest of the rules aren't chechecked

Start your rules with:
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access allow whitelist
#Next is new#
http_access allow All_dst !all

Then apply deny Rules as you need.

mfg1Author Commented:
i will give this a try tomorrow thanks.
modify the rules as allow

http_access allow msnd
http_access allow msn
http_access allow msn1
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.