Hi,

Would like to setup Internet Gateway server...with authentication. As of now, already have a Linux 8.0 Installed with squid/ NAT. EVerything is working fine. Now i need to develop a system where in only authenticated users get access to the internet, not only to web browsing activity but also all related internet access such as Pcanywhere, telnet, etc etc...basically even ping , I mean they should not be able to even ping if they are not authenticated by the system. I guess would be something on dynamic firewall kinds. Any documentation/links would be of great help. Also if we can group users according to their departments & requirement and then apply the policy.

Thanks
Zapstar

Howzit

I would do it in the following manner. Setup a DHCP server and all normal users that u want to limit pings, services, etc would recieve this IP and on your FW u block what u would like. The other users that need certain or specific previliges u may give them a static IP and edit FW accordingly. I am not aware of any software that will authenticate u against a FW like in Checkpiont. For authentication I would use squid and also try block certain services from going through.

Hope this helps

chow

Using static IPs or better DHCP reservations assumes that your users only work on their dedicated machines.

A nice tweak would be to set the IP address at login. This works only for single user machines! (changing the IPs while users are connected will cause connection losses.

Example you have 2 IP ranges, one for privileged users, one for the poor ones.

During login, an IP address is selected from the DHCP range according to the user's
privilege. There should be a method to select a DHCP pool. I never did so.
i.e. execute a sophisticated dhclient in .profile.

You also may want to assign 2 static IPs for each machine in the IP inventory.
An ifconfig command is issued at login selecting one of them according to user privilege.

example:
Write 2 scripts on each computer. Each script has 1 ifconfig statement.

### scriptname_for_poor_ones
ifconfig eth0 blabla 192.168.111.001

### scriptname_for_privileged_ones
ifconfig eth0 blabla 192.168.222.001

do not allow the scripts to accept any parameters (this only makes them vulnerable).
chown them to root and set the SUID bit. (Somewhat dangerous. I tend to call it the suicide bit).
chown root scriptname_for_p*
chmod +s scriptname_for_p*
chmod 750 scriptname_for_p*
chgrp users scriptname_for_poor_ones
chgrp privileged_group_name scriptname_for_privileged_ones
call the respective script from .profile or such.

If it would be only web access, things could be simpler since some proxies allow user identification.

see here on linuxquestions.org
You should have searched.