# e2guardian config file for version 5.5.9r

#NOTE This file (and any .Include<> files) are only read at start-up
#
# but the lists defined in this file are re-read on reload or gentle restart
# as is any rooms directory files.

### Config is now split into sections as follows
###
### QUICK_START 	- Items to check to get you started
### NAMES_PATHS 	- Names & Path settings
### NETWORK 		- Network settings
### MITM 		    - SSL MITM settings
### ICAP_SERVICE 	- ICAP server mode settings
### TRANSPARENT 	- Transparent proxy settings
### AUTH		    - Authentication (user and group assignment)
###				        settings and lists
### ACCESS_LOG		- Access log settings
### MONITORING		- Monitoring settings
### URL_FILTERING	- URL filtering settings
### LIST_SETTINGS	- Settings on how lists are handled
### AV_SCANNERS		- AV scanner settings and lists
### HEADER		    - HTTP Header handling
### BLOCK_PAGE		- Block Page formats and handling
### DOWNLOAD_MANAGER	- Download manager settings
### PHRASES		    - Content phrase settings
### TUNING		    - Tuning parameters
### DEBUG		    - Debug settings
### PROCESS		    - e2guardian process settings
### OBSOLETE		- Obsolete settings
### INFO		- Info on new features etc
###

### QUICK_START section
###
### e2guardian will work as a normal http/s proxy server
### listening on port 8080
### without you making any changes to this file.
### 
### This section contains settings that you may want to
### change, e.g language, dockermode, to set ICAP mode or enable SSL MITM
### support
### 

# language to use from languagedir.
language = 'ukenglish'

#.Define LISTDIR </etc/e2guardian/lists/common>
# LISTDIR 'variable' definition
# This works similarly to a shell environment variable
# The text between <> will replace occurrences of __LISTDIR__ in .conf and
#       list files.
# See INFO section for more details
# default LISTDIR value for e2guardian.conf is E2CONFDIR/lists/commom

#dockermode = off
#
# Container mode
# the process will not fork into the background AND will log in stdout
# In this mode systemd service is disabled !
#
# Also sets info, error and warning messages to stderr 
# Default: off
#
# This option is retained for backward compatibility
# Setting this 'on' is the same as making the following settings:
#
# nodaemon = on
# set_info = 'stderr'
# set_error = 'stderr'
# set_warning = 'stderr'
# set_accesslog = 'stdout'


# loop prevention
#
# For loop prevention purposes list all IPs e2g can be reached on
# Include all e2g host server IPs and any VIP used when when in an array.
# If squid in front then add ip of squid server and squid port in extracheckports
# Specify each IP on an individual checkip line or multiple IP on a single line separated by ':'
#
#checkip = 127.0.0.1
#checkip = ip_of_server
#checkip = 2nd ip of server
#checkip = VIP of server
#
# Defaults: Not set - only loop prevention for 127.0.0.1 requests
#
#extracheckports = 3128
#
# by default e2g will loop protect for all ports defined in filterports
# If you are using squid in front or other device which re-assigns ports
# then add the user-facing port(s) to extracheckports
# Specify each port on an individual extracheckports line or multiple ports on a single line separated by ':'

#transparenthttpsport = 8443
#
#port for transparent https
#NOTE: To make work firewall will need to redirect tcp port 443 on routed
# packets to this port and ssl must be enabled with enablessl = on
# default 0 - i.e. disabled 

#icapport = 1344
#
#port for ICAP server
#if defined enables icap server mode
# default is 0 - i.e. disabled

#proxyip = 127.0.0.1
#
# the ip of upstream proxy - optional - if blank e2g will go direct to sites.
# default is "" i.e. no proxy

#proxyport = 3128
#
# the port e2guardian connects to any upstream proxy on
# default 3128
# Is ignored if proxyip is blank.

#filtergroups = 1
#
# filtergroups sets the number of filter groups. 
# A filter group is a set of content filtering options you can apply to a 
# group of users.  
# The value must be 1 or more.
# e2guardian will automatically look for e2guardianfN.conf where N is the filter
# group.
# default 1

#defaultfiltergroup = 1;
#
# default filtergroup for standard (explicit proxy) mode
# optional defaults to 1

#enablessl = on
#
# Enable SSL support
# This must be present to enable MITM and Cert checking
# If on you must also check the MITM section.
# default is off

###
### END of QUICK_START section


### NAMES_PATHS section
###

# servername = 'my_name"
#
# Default is to use the system name of the host in logs

#daemonuser = '_e2guardian'
#daemongroup = '_e2guardian'
#
# Daemon runas user and group
# This is the user that e2guardian runs as.  Normally the user/group nobody.
# Uncomment to use.  Defaults to the user/group set at compile time.
#
# Temp files created during virus scanning are given owner and group read
# permmision so, if you have clamdscan plugin enabled,
# the two processes must run with either the same group or user ID.

languagedir = '/usr/local/share/e2guardian/languages'
#
# The HTML templates within this dir are only used when reportinglevel
# is set to 3. When used, e2guardian will display the HTML file instead of
# using the perl cgi script.  This option is faster, cleaner
# and easier to customise the access denied page.
# The language file is used no matter what setting however.
#

#preauthstoryboard = '/etc/e2guardian/preauth.story'
#
# default '/etc/e2guardian/preauth.story'

# perroomdirectory = '__LISTDIR__/../rooms/'
#
# Per-Room definition directory
# A directory containing text files containing the room's name followed by IPs or ranges
# and optionaly site and url lists
# Think of it as bannediplist and/or exceptions on crack

# Output of Error, Warning, Info messages
# set_error = 'stderr'
# set_info = 'stdout'
# set_warning = 'stderr'
#
# change error, info and warning message output from defaults
# defaults are:
# set_error = 'syslog:LOG_ERR'
# set_info = 'syslog:LOG_INFO'
# set_warning = 'syslog:LOG_WARNING'
#
###
### END of NAMES_PATHS section


### NETWORK section
###

#filterip =
#
# the IP that e2guardian listens on.  If left blank e2guardian will
# listen on all IPs.  That would include all NICs, loopback, modem, etc.
# Normally you would have your firewall protecting this, but if you want
# you can limit it to a certain IP. To bind to multiple interfaces,
# specify each IP on an individual filterip line or specify multiple ips
# on a single line separated by ':'
# default "" - listen on all IPs

#filterports = 8080
#filterports = 8080:8081:8082
#
# The port(s) that e2guardian listens to for http proxy traffic.
# Specify one line per port used for standard explict proxy or specify multiple ports
# on a single line separated by ':'
# These ports can also be used for redirected transparent HTTP
# Default is to listen on 8080 for proxy traffic

#tlsfilterports = 8090
#tlsfilterports = 8090:9091
#
# The port(s) that e2guardian listens to for TLS (secure) proxy traffic.
# Specify one line per port used for secure explict proxy or
#  specify multiple ports on a single line separated by ':'
# Note that using TLS proxy consumes double the number of file descriptors (4)
#     and httpsworker threads (2) per session
# The MITM root CA must also be installed on the client even when not using
#     MITM.
# Default is none

#tlsproxycn = 192.168.1.25
#tlsproxycn = mye2g.anydomain
#tlsproxycn = 192.168.1.25:mye2g.anydomain:mye2g.internal.domain  # v5.5.6 onwards
#
# The common name (CN) to be used to generate the server certificate for 
# TLS proxy.  Can be IP or DNS name but must match entry used in clients
# proxy settings.  
# default is system name.
#
# From v5.5.6 multiple multiple DNS names and/or IP can be can be defined separated by ':'

###
### END of NETWORK section


### MITM section
###

#   Check these settings if enablessl = on
#   For instructions on how to set this up
#   see notes/ssl_mitm

#sslcertificatepath = ''
#
#SSL certificate checking path
#Path to CA certificates used to validate the certificates of https sites.
# if left blank openssl default ca certificate bundle will be used
#Leave as default unless you want to load non-default cert bundle

#SSL man in the middle

cacertificatepath = '/etc/e2guardian/private/ca.pem'
#
#CA certificate path
#Path to the CA certificate to use as a signing certificate for
#generated certificates.
# required if ssl_mitm is enabled.

caprivatekeypath = '/etc/e2guardian/private/ca.key'
#
#CA private key path
#path to the private key that matches the public key in the CA certificate.
# required if ssl_mitm is enabled.

certprivatekeypath = '/etc/e2guardian/private/cert.key'
#
#Cert private key path
#The public / private key pair used by all generated certificates
# required if ssl_mitm is enabled.

generatedcertpath = '/etc/e2guardian/private/generatedcerts/'
#
#Generated cert path
#The location where generated certificates will be saved for future use.
#(must be writable by the e2 user)
# required if ssl_mitm is enabled.

#Warning: it is advisable to prune the generated certificate
#         store regularly to avoid the 
#         number of files getting to large and the file system running out
#	  of inodes.  An example of a script to do this is:
#	     cd generatedcertpath (replace with actual path on your system)
#	     find . -atime +7 -delete
#	  i.e delete all cached certs not accessed in last 7 days

# generatedcertstart = auto
#
#Generated cert start time (in unix time) - optional
# defaults to auto

# 'auto' will make generatedcertstart time last January or June and
# generatedcertend 12 months after generatedcertstart.  This ensures 
# generated certificates are only changed every 6 months while 
# limiting life to 12 months

# generatedcertend =
#
#Generated cert end time (in unix time) - optional
# defaults to generatedcertstart + 1 years

# Note: start/end times are now also checked against root dates
# and where needed adjusted to fit the root cert dates.  A warning is 
# issued when this happens.

#useopensslconf = off
#
# Use openssl configuration file
# switch this on if you want e2g to read in openssl configuration
# This is useful if you want to use a hardware acceleration engine.
# default is off

# opensslconffile = '/etc/e2guardian/openssl.conf'
#
# Alternate openssl configuration file
# only used if useopensslconf = on
# default is to use standard openssl configuration file
# only use this if an alternate openssl configuration file is used for e2g

# setcipherlist = "HIGH:!ADH:!MD5:!RC4:!SRP:!PSK:!DSS"
#
# Sets the cipher list used by openssl
# Default is "HIGH:!ADH:!MD5:!RC4:!SRP:!PSK:!DSS"
# May be withdrawn in future versions as best defined in openssl.conf

# Sites that are impossible or undesirable to MITM
#
sitelist = 'name=nomitm,path=__LISTDIR__/nomitmsitelist'
ipsitelist = 'name=nomitm,path=__LISTDIR__/nomitmsiteiplist'

###
### END of MITM section


### ICAP_SERVICE section
###

#defaulticapfiltergroup = 1
#
# default filtergroup for ICAP mode
# defaults to 1

#icapreqmodurl = 'request'
#Url to respond to ICAP reqmod queries
# default 'request'

#icapresmodurl = 'response'
#Url to respond to ICAP respmod queries
# default 'response'

###
### END of ICAP_SERVICE section


### TRANSPARENT section
###

#defaulttransparentfiltergroup = 1;
#
# default filtergroup for transparent proxy mode (http and thttps)
# optional defaults to 1

#useoriginalip = on
#
# This option only applies when request is transparent (http or https),
# when no upstream proxy is used, and where it is possible to detect
# the original destination ip & port
# When enabled the upstream request will be directed at the original ip and port
# and no DNS lookup will be performed.
# This solves the 'snapchat' issue and also should increase speed of connection.
# Currently this ONLY works on linux systems.  
# BSD developers, PLEASE HELP fix this for BSD, pfsense etc!
# default = on (linux) ignored (bsd)

###
### END of TRANSPARENT section


### AUTH section
###
### In the context of e2guardian authentication is primarly
### the determination of the filter group to be used.
###
### Some of the plug-in also return a username which is
### then used in the access log

# Auth plugins
#
# Handle the extraction of client usernames and groups from various sources,
# enabling requests to be handled according to the settings of the user's 
# filter group.
#

## There are five ways that e2g can be deployed and this affects the auth
## plugins available
## 
##
## 'Standalone' - e2g handles client and upstream traffic 
##
## 'Proxy-First' - client is logged in by proxy (squid)
##		   and proxy passes e2g the user name in a 'basic' proxy
##		   auth header
##
## 'Proxy-After' - client points to e2g which then uses upstream proxy
##		   This is the method used by dg/e2g until v5.
##                 If authentication is enabled on proxy, then
##                 sslreplace, 'Transparent' or IP auth and possibly
##		   other features will not work. 
##		   NOTE: Withdrawn in v5.5!
##
## 'Transparent' - 80/443 requests are redirected to e2g on gateway
##	           Can be used with Standalone or Proxy-After mode
##                 Note: only IP based plugins will be used in this
##                 and so normaly it is not possible to capture the
##                 user name.  However, devices using transparent
##                 can be put in their own default group.
##
## 'ICAP mode' - All trafic goes via squid and squid uses e2g as an
##                 ICAP server.
## ICAP has built in auth as username is supplied in the ICAP header
## by squid. The user is checked against the filtergroupslist to get the
## group.  To cater for the situation where user is missing ip based 
## plugins such as 'ip' can be used as fall back.
##
## Note that e2g can support multiple methods at the same time, 
## e.g. Standalone, Transparent and ICAP server


## There are two types of plugin
## 'Native' or 'Proxy-first' 

## 'Native' plugins - these do not require use of a proxy

#authplugin = '/etc/e2guardian/authplugins/ident.conf'
# Requires identd running on each client - gives username

# Group based on ip or ip range - pseudo username of the ip
#authplugin = '/etc/e2guardian/authplugins/ip.conf'

# Group based on e2g port number - pseudo username of the port
# for this option the ports have to be declared as multiple filterport line
#authplugin = '/etc/e2guardian/authplugins/port.conf'

# User and group obtained from dns entries mapping ip to user/group
# dns entries maintained by separate authentication program.
#authplugin = '/etc/e2guardian/authplugins/dnsauth.conf'

# HELP - more native plugins needed!  'basic' etc.

## 'Proxy-first' plugin - requires a proxy in front to do the user 
##  authentication.

# Use pf-basic.conf where proxy is doing auth in front of e2g
#authplugin = '/etc/e2guardian/authplugins/pf-basic.conf'

# User defined in header - requires interception prior to e2g
# to add headers
#authplugin = '/etc/e2guardian/authplugins/proxy-header.conf'

# ip plugin can also be used in Proxy first mode.

## 'Proxy-after' plugins - requires a proxy behind.
## These are pass-through plugins which reply on sniffing the
## proxy auth headers between client and proxy to get username
## - DEPRECIATED and are removed from this release
## - Use Proxy-first plugin and squid in front of e2g instead

# Basic auth on back-end proxy
#authplugin = '/etc/e2guardian/authplugins/proxy-basic.conf'
## - DEPRECIATED and has been removed from this release

# Digest auth on back-end proxy
#authplugin = '/etc/e2guardian/authplugins/proxy-digest.conf'
## - DEPRECIATED and has been removed from this release

# NTLM (only v1) auth on back-end proxy
#@NTLMSUPPORT@authplugin = '/etc/e2guardian/authplugins/proxy-ntlm.conf'
## - DEPRECIATED and has been removed from this release

# All native plugins can also be used in proxy-after mode
# but only when auth is not forced by the upstream proxy


## Auth mapping files - Map users (or client IPs) to filter groups
## Note that from v5.4 lists used by auth plugins are defined here and 
## not in auth *.conf files

# Generic user to group mapping - used by default by basic, digest, ntlm, 
# ident & icap plugins
maplist = 'name=defaultusermap, path=__LISTDIR__/../authplugins/filtergroupslist'
# for ip auth
ipmaplist = 'name=ipmap, path=__LISTDIR__/../authplugins/ipgroups'

# for port auth
maplist = 'name=portmap, path=__LISTDIR__/../authplugins/portgroups'


# If on a user without group is considered like unauthenfied
# E2guardian tries the next plugin
# If off the user is connected with defaultgroup
# Defaults to off
# authrequiresuserandgroup = off

# Authentication exception/banned clients
#
# bannediplist is ONLY for banned client IP
iplist = 'name=bannedclient,messageno=100,logmessageno=103,path=__LISTDIR__/bannediplist'
# exceptioniplist is ONLY for exception client IP
iplist = 'name=exceptionclient,messageno=600,path=__LISTDIR__/exceptioniplist'

reverseclientiplookups = off
# Reverse lookups for banned and exception IP clients.
# If set to on, e2guardian will look up the forward DNS for the IP
# of the connecting computer.
# If a client computer is matched against an IP given in the lists, then the
# IP will be recorded in any log entries; if forward DNS is successful and a
# match occurs against a hostname, the hostname will be logged instead.
# It will reduce searching speed somewhat so unless you have a local DNS server,
# leave it off.

# Put client dns names in bannedclientlist if required
#sitelist = 'name=bannedclient,messageno=100,logmessageno=104,path=__LISTDIR__/bannedclientlist'
# Put client dns names in exceptionclientlist if required
#sitelist = 'name=exceptionclient,messageno=631,path=__LISTDIR__/exceptionclientlist'

# authexception lists are for exception sites/urls allowed before authentication
# to allow for machines to update without user authentication
ipsitelist = 'name=authexception,messageno=602,path=__LISTDIR__/authexceptioniplist'
sitelist = 'name=authexception,messageno=602,path=__LISTDIR__/authexceptionsitelist'
urllist = 'name=authexception,messageno=603,path=__LISTDIR__/authexceptionurllist'

regexpboollist = 'name=browser,path=__LISTDIR__/browserregexplist'
#
# List of regexp that match match User-agent of browsers
# Used to determine if client is a browser
# and decide whether to send a block page or go MITM


###
### END of AUTH section


### ACCESS_LOG section
###

## Location and format

#set_accesslog = 'file:/var/log/e2guardian/access.log'
#set_accesslog = 'syslog:LOG_INFO'
#set_accesslog = 'stderr'
# Sets output for access log
# default is 'file:access.log'

#loglocation = '/var/log/e2guardian/access.log'
# Log file location
#
# Defines the log directory and filename.
# Retained for backward compatibility
# - ignored if set_accesslog is defined

#logsyslog = off
# Syslog logging
# Use syslog for access logging instead of logging to the file
# at the defined or built-in "loglocation"
# Retained for backward compatibility
# - ignored if set_accesslog is defined

#namesuffix = ""
#Suffix to append to program name when logging through syslog
# Default is blank

#logfileformat = 8
# Log File Format
# 1 = Dansguardian format (space delimited)
# 2 = CSV-style format
# 3 = Squid Log File Format
# 4 = Tab delimited
# Protex format type 5 Tab delimited, squid style format with extra fields
# for filter block/result codes, reasons, filter group, and system name
# used in arrays so that combined logs show originating server.
# 5 = Protex format
# Protex format type 6 Same format as above but system name field is blank
# used in stand-alone systems.
# 6 = Protex format with server field blanked
# 7 = Same as 5, but with searchterms and EXTFLAGS added
#     See notes/New_log_fileds_in_log_format7-8.pdf for details
# 8 = Same as 7, but with server field blanked
# Default is 8

#anonymizelogs = off
# anonymize logs (blank out client usernames & IPs)
# default off

#tag_logs = on
# This option adds a tag to the front of each log line
# It is useful where multiple outputs are made to the same
# output source (e.g. stderr) to identify which type of of log 
# entry it is.
# default 'off'

## What requests to log

# Note: These options may be replaced by storyboard function in v5.5
# With the settings as distributed all requests (apart from ADs) will
# be logged.

#loglevel = 3
# 0 = none  1 = just denied  2 = all text based  3 = all requests
# default 3

#logexceptionhits = 2
# Log Exception Hits
# Log if an exception (user, ip, URL, phrase) is matched and so
# the page gets let through.  Can be useful for diagnosing
# why a site gets through the filter.
# 0 = never log exceptions
# 1 = log exceptions, but do not explicitly mark them as such
# 2 = always log & mark exceptions (default)

#logadblocks = off
# Enable logging of "ADs" category blocks
# on|off (defaults to off)

## What extra data is to be logged

#showweightedfound = on
# Show weighted phrases found
# If enabled then the phrases found that made up the total which excedes
# the naughtyness limit will be logged and, if the reporting level is
# high enough, reported. on | off
# default is on

#showallweightedfound = off
# Show all weighted phrases found
# If enabled then the phrases found that made up the total will be logged and, if the reporting level is
# high enough, reported. on | off
# default is off

#logclienthostnames = off
# Perform reverse lookups on client IPs for successful requests.
# If set to on, e2guardian will look up the forward DNS for the IP
# of the connecting computer, and log host names (where available) rather than
# IPs against requests.
# This is not dependent on reverseclientiplookups being enabled; however, if it
# is, enabling this option does not incur any additional DNS requests.

#loguseragent = off
# Enable logging of client User-Agent
# Some browsers will cause a *lot* of extra information on each line!
# on|off (defaults to off)

#logclientnameandip = on
# Enable logging of both client hostname and its IP
# If off the hostname will be logged instead of IP
# Applies only to log formats 5, 6, 7 & 8.
# on|off (defaults to on)
# Needs to be turned off if you are using sarg log analysis.

#dnsuserloggingdomain = ""
# Used to get user/domain from special dns zone for logging purposes only
# Similar to dnsauth plugin operation but only for logging.

## Log formating options

#usedashforblank = on
# use dash ('-') instead of blank fields in log
# This is essential for space delimited log formats, and makes all log types easier to read
# But can be turned off if this causes a problem with log analysis
# on|off (defaults to on)

#logtimestamp = off
# Add unix timestamp to time field so that date/time in readable format 
# and unix timestamp - applies only to log formats 1,2 and 4
# default off

#logid1 = ""
#logid2 = ""
# only used in logformats 1, 2 and 4
# default ""

#productid = '2'
# Used in SG_LOGFORMAT
# default 2

# NEW in v5.5.6
#addECHtoFlags = on
# add 'E' indicator to EXTFLAGS when Encrypted Client Hello (ECH) TLS extension is present
# (only applies to Transparent https requests)
# This indicates that SNI may be unreliable
# The ECH may be real or fake, it is not possible to tell which, although if connection via
#  MITM succeeds then is likely to be fake.
#  When the SNI is trusted then it maybe real or fake as MITM is not used.
# This may be useful information to log, but does not change any logic in v5.5
# default is off for backward compatibility

## Other access log options

#maxlogitemlength = 2000
# truncate large items in log lines
# allowable values 10 to 32000
# default 2000
# unlimited not longer allowed - 0 will now set default of 2000

###
### END of ACCESS_LOG section


### MONITORING section
###

# set_dstatslog = 'file:/var/log/e2guardian/dstats.log'
# Dymamic statistics log file output
#
# Defines the dstats file directory and filename.
# Once every 'dstatinterval' seconds, stats on number of threads in use,
# Q sizes and other useful information is written to this file.
# Format is similar to sar.  See notes/dstats_format for more details.
# Default - do not to write stats.

dstatlocation = '/var/log/e2guardian/dstats.log'
# Dymamic statistics log file location
#
# Retained for backward compatiblity
# Ignored if set_dstatslog is defined

#dstatinterval = 300  # = 5 minutes
# Interval in seconds between stats output
# Default 300 (= 5 mins)
# Minimum 10
# Maximum 3600 (= 1 hour)

#statshumanreadable = off
# Time format for dstat is epoch GMT+0 by default | statshumanreadable 
# change to local zone
# default off

# internaltesturl = 'internal.test.e2guardian.org'
#
# A pretend url for testing e2g is working.
#
# It returns a small page containing OK if working ok.
#
# Used by loadbalancers and monitoring software (e.g. smokeping)
# to detect if e2g is functioning.
#
# It is tested for after connection is successful and a worker thread is 
# assigned, but before user auth and group assignment is made.
#
# This has been built in to e2g since v3, but this option allows the 
# url to be changed.
#
# default 'internal.test.e2guardian.org'

# internalstatusurl = 'internal.status.e2guardian.org'
#
# A pretend url for checking the status of a user.
#
# It returns a small page providing various information
# such as user name, ip, filtering group, server name,
# e2guardian version, flags field.
#
# Designed to used by status software and by technical staff for testing
# user access/assignment.
#
# It is tested for after user auth and group assignment is made, but
# before any filtering is performed.

# New in v5.4.3, this option allows the 
# url to be changed.
#
# default 'internal.status.e2guardian.org'

# monitorflagprefix = '/var/run/e2g_flag_'
# monitor flag prefix path
# If defined path will be used to generate flag files as follows:-
#
# At start after e2guardian has started listener and worker threads with
#  'running' appended
# When e2guardian is stopping with 'paused' appended
# default '' - flags disabled

###
### END of MONITORING section


### URL_FILTERING section
###

reverseaddresslookups = off
# Reverse lookups for site and URL lists.
# If set to on, e2guardian will look up the forward DNS for an IP URL
# address and search for both in the banned site and URL lists.  This would
# prevent a user from simply entering the IP for a banned address.
# It will reduce searching speed somewhat so unless you have a local caching
# DNS server, leave it off and use the Blanket IP Block option in the
# f1.story file instead.


###
### END of URL_FILTERING section


### LIST_SETTINGS section
###

# abortiflistmissing = off  
# Abort if a list is missing or unreadable
# default is to warn but then ignore missing lists
# To abort on missing list set to on
# default "off"

#searchsitelistforip = on
#Search sitelist for ip sites
# In v5 a separate set of lists has been introduced for IP sites
# and normally e2g will no longer check site lists for ip's
# If you want to keep backward list compatablity then set this to
# 'on' - but note this incurs an overhead - putting IP in ipsitelists
# and setting this to off gives the fastest implementation.
# default is 'on'

###
### END of LIST_SETTINGS section


### AV_SCANNERS section
###

# Content Scanners (Also known as AV scanners)
# These are plugins that scan the content of all files your browser fetches
# for example to AV scan.  You can have more than one content
# scanner. The plugins are run in the order you specify.
# This is one of the few places you can have multiple options of the same name.
#
# Some of the scanner(s) require 3rd party software and libraries eg clamav.
# See the individual plugin conf file for more options (if any).
#
#contentscanner = '/etc/e2guardian/contentscanners/clamdscan.conf'
#!! Not compiled !! contentscanner = '/etc/e2guardian/contentscanners/avastdscan.conf'
#!! Not compiled !! contentscanner = '/etc/e2guardian/contentscanners/kavdscan.conf'
#!! Not compiled !! contentscanner = '/etc/e2guardian/contentscanners/icapscan.conf'

# Warning: The commandlinescan plugin uses 'fork()' which does not work well
#  in a large multi-threaded program like e2g. It can cause unpredictable 
#  crashes.
# On a small scale system (home user) it may work ok, but not recommended for
#  larger scale systems.  The more active threads, the more likely a crash is.
#
#!! Not compiled !! contentscanner = '/etc/e2guardian/contentscanners/commandlinescan.conf'

#contentscannertimeout = 60
# Content scanner timeout
# Some of the content scanners support using a timeout value to stop
# processing (eg AV scanning) the file if it takes too long.
# If supported this will be used.
# defaults to value of pcontimeout

###
### END of AV_SCANNERS section


### HEADER section
###

#addforwardedfor = off
#
# if on it adds an X-Forwarded-For: <clientip> to the HTTP request
# header.  This may help solve some problem sites that need to know the
# source ip. on | off
# default off

# forwardedfor = off
#
# old name for addforwardedfor - retained for compatiblity.

usexforwardedfor = off
#
# if on it uses the X-Forwarded-For: <clientip> to determine the client
# IP. This is for when you have squid between the clients and e2guardian.
# Warning - headers are easily spoofed. on | off
# default off

# xforwardedforfilterip =
#
# as mentioned above, the headers can be easily spoofed in order to fake the
# request origin by setting the X-Forwarded-For header. If you have the
# "usexforwardedfor" option enabled, you may want to specify the IPs from which
# this kind of header is allowed, such as another upstream proxy server for
# instance If you want authorize multiple IPs, specify each one on an individual
# xforwardedforfilterip line.
# default no entries

# maxheaderlines = 2000
#
# Limit number of http header lines in a request/response
# (to guard against attacks)
# Minimum 10 max 2500
# default 2000

###
### END of HEADER section


### BLOCK_PAGE section
###

#reportinglevel = 3
#
# reportinglevel
#
# -1 = log, but do not block - Stealth mode
#  0 = just say 'Access Denied'
#  1 = report why but not what denied phrase
#  2 = report fully
#  3 = use HTML template file (accessdeniedaddress ignored) - recommended
#
#  Defines the global setting - can be overrided in e2guardianf1.conf
#
# default 3

#usecustombannedimage = on
#
#custombannedimagefile = '/usr/local/share/e2guardian/transparent1x1.gif'
# Banned image replacement
# Images that are banned due to domain/url/etc reasons including those
# in the adverts blacklists can be replaced by an image.  This will,
# for example, hide images from advert sites and remove broken image
# icons from banned domains.
# on (default) | off

#usecustombannedflash = on
#
#custombannedflashfile = '/usr/local/share/e2guardian/blockedflash.swf'
#
#Banned flash replacement

###
### END of BLOCK_PAGE section


### DOWNLOAD_MANAGER section
###

# Download Managers
# These handle downloads of files to be filtered and scanned.
# They differ in the method they deal with large downloads.
# Files usually need to be downloaded 100% before they can be
# filtered and scanned before being sent on to the browser.
# Normally the browser can just wait, but with content scanning,
# for example to AV, the browser may timeout or the user may get
# confused so the download manager has to do some sort of
# 'keep alive'.
#
# There are various methods possible but not all are included.
# Also, not all methods work with all
# browsers and clients.  Specifically some fancy methods don't
# work with software that downloads updates.  To solve this,
# each plugin can support a regular expression for matching
# the client's user-agent string, and lists of the mime types
# and extensions it should manage.
#
# Note that these are the matching methods provided by the base plugin
# code, and individual plugins may override or add to them.
# See the individual plugin conf files for supported options.
#
# The plugins are matched in the order you specify and the last
# one is forced to match as the default, regardless of user agent
# and other matching mechanisms.
#
# NOTE FOR v5.5 - ONLY default download manager is supported
#		- trickle should be regarded as experimental
#		- coding for fancy is incomplete and DOES NOT work
#downloadmanager = '/etc/e2guardian/downloadmanagers/trickle.conf'
downloadmanager = '/etc/e2guardian/downloadmanagers/default.conf'

#filecachedir = '/tmp'
#
# File cache dir
# Where E2 will download files to be scanned if too large for the
# RAM cache.
# default "/tmp"

#deletedownloadedtempfiles = on
#
# Delete file cache after user completes download
# When a file gets save to temp it stays there until it is deleted.
# You can choose to have the file deleted when the user makes a sucessful
# download.  This will mean if they click on the link to download from
# the temp store a second time it will give a 404 error.
# You should configure something to delete old files in temp to stop it filling up.
# on|off (defaults to on)

#initialtrickledelay = 20
#
# Initial Trickle delay
# This is the number of seconds a browser connection is left waiting
# before first being sent *something* to keep it alive.  The
# *something* depends on the download manager chosen.
# Do not choose a value too low or normal web pages will be affected.
# A value between 20 and 110 would be sensible
# This may be ignored by the configured download manager.
# default 20

#trickledelay = 10
#
# Trickle delay
# This is the number of seconds a browser connection is left waiting
# before being sent more *something* to keep it alive.  The
# *something* depends on the download manager chosen.
# This may be ignored by the configured download manager.
# default 10

###
### END of DOWNLOAD_MANAGER section


### PHRASES section
###

weightedphrasemode = 2
#
# Weighted phrase mode
# There are 3 possible modes of operation:
# 0 = off = do not use the weighted phrase feature.
# 1 = on, normal = normal weighted phrase operation.
# 2 = on, singular = each weighted phrase found only counts once on a page.
#
# IMPORTANT: Note that setting this to "0" turns off all features which
# extract phrases from page content, including banned & exception
# phrases (not just weighted), search term filtering, and scanning for
# links to banned URLs.
#

#phrasefiltermode = 2
#
# Smart, Raw and Meta/Title phrase content filtering options
# Smart is where the multiple spaces and HTML are removed before phrase filtering
# Raw is where the raw HTML including meta tags are phrase filtered
# Meta/Title is where only meta and title tags are phrase filtered (v. quick)
# CPU usage can be effectively halved by using setting 0 or 1 compared to 2
# 0 = raw only
# 1 = smart only
# 2 = both of the above 
# 3 = meta/title
# default 2

#preservecase = 0
#
# Lower casing options
# When a document is scanned the uppercase letters are converted to lower case
# in order to compare them with the phrases.  However this can break Big5 and
# other 16-bit texts.  If needed preserve the case.  As of version 2.7.0 accented
# characters are supported.
# 0 = force lower case (default)
# 1 = do not change case
# 2 = scan first in lower case, then in original case

# Note:
# If phrasefiltermode and preserve case are both 2, this equates to 4 phrase
# filtering passes. If you have a large enough userbase for this to be a
# worry, and need to filter pages in exotic character encodings, it may be
# better to run two instances on separate servers: one with preservecase 1
# (and possibly forcequicksearch 1) and non ASCII/UTF-8 phrase lists, and one
# with preservecase 0 and ASCII/UTF-8 lists.

#hexdecodecontent = off
#
# Hex decoding options
# When a document is scanned it can optionally convert %XX to chars.
# If you find documents are getting past the phrase filtering due to encoding
# then enable.  However this can break Big5 and other 16-bit texts.
# off = disabled (default)
# on = enabled

#forcequicksearch = off
#
# Force Quick Search rather than DFA search algorithm
# The current DFA implementation is not totally 16-bit character compatible
# but is used by default as it handles large phrase lists much faster.
# If you wish to use a large number of 16-bit character phrases then
# enable this option.
# off (default) | on (Big5 compatible)

###
### END of PHRASES section


### TUNING section
###

httpworkers = 50
#
#sets the number of worker threads to use
#
# This figure is the maximum number of concurrent connections.
# If more connections are made, connections will queue until a worker thread is free.
# On large site you might want to try 5000 (max value 20000)
# 500 is the default suitable for home or samll office use on 64-bit systems
# On 32-bit systems reduce this to 300 to avoid exceeding the <4GB
# virtual memory limit and on Linux decrease the thread stack size from
# 10MB to 2MB (ulimit -s 2048)
# default 500

#maxcontentfiltersize = 2048
#
# Max content filter size
# Sometimes web servers label binary files as text which can be very
# large which causes a huge drain on memory and cpu resources.
# To counter this, you can limit the size of the document to be
# filtered and get it to just pass it straight through.
# This setting also applies to content regular expression modification.
# The value must not be higher than maxcontentramcachescansize
# Do not set this too low as this will result in pages that contain a
#  long preamble not being content filtered
# The size is in Kibibytes - eg 2048 = 2Mb
# default 2048

#maxcontentramcachescansize = 2048
#
# Max content ram cache scan size
# This is only used if you use a content scanner plugin such as AV
# This is the max size of file that e2g will download and cache
# in RAM.  After this limit is reached it will cache to disk
# This value must be less than or equal to maxcontentfilecachescansize.
# The size is in Kibibytes - eg 10240 = 10Mb
# use 0 to set it to maxcontentfilecachescansize
# This option may be ignored by the configured download manager.
# default 2048

#maxcontentfilecachescansize = 20000
#
# Max content file cache scan size
# This is only used if you use a content scanner plugin such as AV
# This is the max size file that E2 will download
# so that it can be scanned or virus checked.
# This value must be greater or equal to maxcontentramcachescansize.
# The size is in Kibibytes - eg 10240 = 10Mb
# default 20000


#proxytimeout = 5
#
# Proxy timeout
# Set tcp timeout between the Proxy and e2guardian
# This is a connection timeout
# If proxy is remote you may need to increase this to 10 or more.
# Min 5 - Max 100
# default 5

#connecttimeout = 10
#
# Connect timeout
# Set tcp timeout between the e2guardian and upstream service (proxy or target host)
 # This is a connection timeout
 # For slow remote sites you may need to increase this to 10 or more.
 # if always using a local proxy decrease this setting to 5
# Min 1 - Max 100
# default 10

# connectretries = 1
#
# Connect retries
# Set the number of retries to make on connection failure before giving up
# Min 1 - Max 100
# default 1

#proxyexchange = 61
#
# Proxy header exchange
# Set timeout between an upstream Proxy and e2guardian
# Min 20 - Max 300
# If this is higher than proxies timeout user will get proxy Gateway error page
# If lower e2guardian Gateway error page
# default 61

#pcontimeout = 55
#
# Pconn timeout
# how long a persistent connection will wait for another request before closing
# Min 5 - Max 300
# default 55

###
### END of TUNING section


### DEBUG section
###

# Configure standard logging (see notes/HOWTO_Logger.md)
#   format:
#     set_{source}={destination}[:{filename}]
#   example:
#     set_debug=stdout
#   defaults:
#     set_info=stdout
#     set_error=stderr
#     set_access=file,access.log

# udp_source_port = 39000
# Source port for UDP logging
# currently hard coded to 39000
# You need to know this in order to set firewall rules etc
# Will be able to be changed in a future release


## Things that can used on production binaries

# storyboardtrace = on
#
# Storyboard tracing
# Warning - produces very verbose output - must not be used in production
# By default output goes to syslog  - destination can be changed by using set_storytrace
# default off
# Use to debug storyboard logic flow

#set_storytrace = "file:/tmp/storytrace.txt"

# Output for storyboard tracing
# Note this does not enable storyboardtrace but only changes the destination from the standard syslog.

#logsslerrors = on
#
# Logs openssl error 'stack' in syslog
# Used to diagnose openssl errors
# It is normal for some openssl errors to occur
# Can be left on or off
# default off

#logconnectionhandlingerrors = on
#
# if on it logs some debug info regarding accept()ing and failed connections
# which
# can usually be ignored.  These are logged by syslog.  It is safe to leave
# it on or off
# default off

#set_requestlog = 'none'
#set_requestlog = 'file:/var/log/e2guardian/request.log'
# Set optional request log output
# This is for useful for debug purposes to log all requests before processing or setting filter group
# See notes/LogRequests for details
# default is 'none'


#rqloglocation = '/var/log/e2guardian/request.log'
#
# Defines optional request log path
# Default is "" - no request log
# Retained for backward compatiblity
# Ignored if set_requestlog is defined

#set_responselog = 'none'
#set_responselog = 'file:/var/log/e2guardian/response.log'
# Set optional response log output
# This is for useful for debug purposes to log all responses - unlike access.log all responses are logged
# default is 'none'

#set_alertlog = 'none'
#set_alertlog = 'file:/var/log/e2guardian/alert.log'
# Set optional alert log output
# Output log entries which need an alert, so that external process can generate alerts on user activity
# default is 'none'


## The new debug system uses a extended format
## but is backward compatible with the "NewDebug" system.

## debuglevel is used to  define the debug categories
## and optionally the destination of the debug logs
##

## format is:
## debuglevel = 'debugtypes[:destination[:filename|sysloglevel|host:udp_port]]'
##
## debugtypes can be single type or muliple types separated by ','
##   'ALL' can be used to enable all debug types available
##   'HIGH' can be used to enable all high level debug types available
##   'LOW' can be used to enable all low level debug types available
##   and types can be switched off by pre-fixing them with '-'
##
## destination can be:
##   stdout - output to stdout
##   stderr - output to stderr
##   syslog - output to syslog at sysloglevel
##   file - output to filename
##   udp - output to host on udp_port
##
## if destination is omitted then output will be to the default debug 
## destination or whatever is defined in the last debuglevel.
##
## Multiple debuglevel options can be used to allow different debug sets 
## to be output to different destinations. If a a debug type is repeated
## then the last debuglevel wins.


#debuglevel = 'icap:file:/var/log/e2guardian/icap.log'
#Enable ICAP debug information only in specified file
#
#debuglevel = 'ALL:syslog,LOG_DEBUG'
# enable all debugs available and output to syslog LOG_DEBUG level
#
#debuglevel = 'icap,network:stderr'
#Enable ICAP and NETWORK debug to stderr
#
#Subtractive mode:
#debuglevel = 'ALL,-icap'
#Enable all debug informations but without ICAP debug informations

#debuglevel = 'ALL,-icap,-network'
#Enable all debug but without ICAP, NETWORK debug informations

## Types of debug available when compliled with E2DEBUG_HIGH
##
## icap - ICAP main debug
## proxy - proxy (normal) debug
## thttps - Transparent HTTPS debug
## auth - authentication plugins debug
## avscan - AV scan debug
## dwload - download manager debug

## Types of debug available when compliled with E2DEBUG_LOW
## (only useful for developers)
##
## trace - trace program flow
## network - low level network functions
## story - storyboard debug
## regexp - regexp debug
## config - debug configuration and lists set-up
## content - debug content checking
## debug - debug not yet included in a more specific type



# debugformat = 1
#
# There is a choice of debug formats available
# 1: thread_id: message function():file:line
# 2: thread_id: function():file:line message
# 3: thread_id: message
# 4: (type) thread_id: message function():file:line
# 5: (type) thread_id: function():file:line message
# 6: (type) thread_id: message
#
# Formats 1,3,4,6 are better for developers and bug-fixing
# Formats 2,5 for those exploring the program flow.
# default 1


###
### END of DEBUG section


### PROCESS section
###
# Process options
# (Change these only if you really know what you are doing).
# These options allow you to run multiple instances of e2guardian on a single machine.
# Remember to edit the log file path also if that is your intention.

#pidfilename = '/var/run/e2guardian.pid'
#
# PID filename
#
# Defines process id directory and filename.

#nodaemon = off
#
# Disable daemoning
# If enabled the process will not fork into the background.
# It is not usually advantageous to do this.
# on|off (defaults to off)

##!! Not compiled !!mailer = '/usr/sbin/sendmail -t'   
#
# Mail program
# Path (sendmail-compatible) email program, with options.
# Not used if usesmtp is disabled (filtergroup specific).
## Note that this is experimental in v5 - no support from maintainers


###
### END of PROCESS section


### OBSOLETE section
###
### Directives here are depreciated and may already not work
###

originalip = off
# NOTE: This option is removed in v5.4 - if left and enabled would give too many
# false positives.

# contentscanexceptions = off
# Content scan exceptions // THIS MOVED to e2guardianf1.conf

#mapportstoips = off
#mapauthtoports = off
# Map auth to ports/ports to ip  - does not work work correctly
#  - very confusing options
# default off - to be removed in v5.5.

# logheadervalue = 'proxy-authorization:'
# Log a specific value from header
# low case only
# only used with logs: 1,5 and 6

#statlocation = "" 
#  url cache/stats no  longer in use

#blockedcontentstore = "" 
#  no  longer in use

#softrestart = off
#  no  longer in use

#proxyfailureloginterval = 0
#  no  longer in use

#scancleancache = true
#  no  longer in use

#urlcachenumber = 0
#  no  longer in use

#groupnamesfile = ''
#  no longer supportied 

#urlcacheage= 0
#  no  longer in use

#recheckreplacedurls = off - option does not work - may be removed in v5.5
#
# Re-check replaced URLs
# As a matter of course, URLs undergo regular expression search/replace (urlregexplist)
# *after* checking the exception site/URL/regexpURL lists, but *before* checking against
# the banned site/URL lists, allowing certain requests that would be matched against the
# latter in their original state to effectively be converted into grey requests.
# With this option enabled, the exception site/URL/regexpURL lists are also re-checked
# after replacement, making it possible for URL replacement to trigger exceptions based
# on them.
# Defaults to off.

#logchildprocesshandling - will be removed in v5.5
# no longer in use

# monitorhelper = '/usr/local/bin/mymonitor' - to remove in v5.5
# monitor helper path
# Not recommended - likely to cause crashes as it uses fork()
# If defined this script/binary will be called with start or stop appended as follows:-
# At start after e2guardian has started listener and worker threads with
# ' start' appended
# When e2guardian is stopping with ' stop' appended
# default '' - monitor helper disabled

###
### END of OBSOLETE section


### INFO section
###
### No settings just info on new(ish) features etc

# Relative paths (from v5.4.2)
# Relative paths can used in .Include<> and list files.
#       The directory of current file will be inserted where the file name
#       does not start with '/'

# LISTDIR 'variable' definition (from v5.4.2)
# LISTDIR can be defined in .conf files.
# This allows for more readable configuration and for templating.
# This works similarly to a shell environment variable
# The text between <> will replace occurances of __LISTDIR__ in .conf and
#       list files.
# Note: Currently only LISTDIR may be defined.
#
# The mapping is actioned as the file is read and is valid until another LISTDIR
#       is defined later in the file, or in an included .conf file.
#
# The scope of LISTDIR is in the rest of file it is defined in and all
# .Include<> files or list files in that portion of the file.

# It should be noted that re-definitions of single-line directives will 
# over write any earlier ones.

# The same is true of list definitions.  Later unique definitions will 
# override earlier ones. A unique list definition is formed from the
# list type and the name.
#
# So,

# sitelist = 'name=banned,path=x...'
# and
# urllist = 'name=banned,path=y...'
# are both unique

# but

# sitelist = 'name=banned,path=x...'
# and
# sitelist = 'name=banned,path=z...'
# are not and the later definition will override the first.


###
### END of INFO section
