Linux - ServerThis forum is for the discussion of Linux Software used in a server related context.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
Hey you guys, I have got a question to all you linux wizzards. I can't figure it out by myself, so maybe one of you guys can help me with the squid config file.
I have 2 networks, both used by parents and kids; but they all have a specific adress range.
Wired: parents have the IP range 10.0.0.10 to .100 and the kids have the range 10.0.101 to .200. Wireless: parents have the range 10.0.1.1 to .10 and the kids from 10.0.1.11 to .100
What i want is that both, parents and kids, to authenticate themselves on the proxysever using the ncsa_auth program. The kids, on both networks are allowed to surf the internet from monday to friday from 16:00 (4pm) to 19:00 (7pm). Saturday they can surf the entire day and on sunday until 20:00 (8pm). The kids are also not allowed to visit websites containing the words in pornwords.txt (acl porno url_regex -i "/etc/squid pornwords.txt").
Can anyone help me correct this or help me set the squid.conf up?
Hi, although I do not use similar restrictions on my system (one user) I have used squid for some time.
The protocols have undergone changes from version to version, and I may miss the mark, but a few discrepancies I see are notated below with references.
Code:
Restricting Web Access By Time
You can create access control lists with time parameters. For example, you can allow only business hour access from the home network, while always restricting access to host 192.168.1.23.
#
# Add this to the bottom of the ACL section of squid.conf
#
acl home_network src 192.168.1.0/24
acl business_hours time M T W H F 9:00-17:00
#(edit glenn, not sure if the spaces are required(?), and H is correct for tHursday, sorry, my bad)
acl RestrictedHost src 192.168.1.23
#
# Add this at the top of the http_access section of squid.conf
#
http_access deny RestrictedHost
http_access allow home_network business_hours
should "netmask" be appended to the address ranges?
Code:
ACL TYPE src
Description The IP address of the requesting client, or the clients IP Address
Build Option Default
Usage acl aclname src ip-address/netmask ... (clients IP address)
acl aclname src addr1-addr2/netmask ... (range of addresses)
Synopsis Matching done based on clients ip address
Arguments
aclname Access list name
ip-address Clients ip address
netmask Network mask
add1-addr2 Range of ip address
Example(s)
acl network1 src 172.16.1.0/24 - refers to the whole Network with address 172.16.1.0
acl source1 src 172.16.1.25/32 - refers to a single source
acl srcrange src 172.16.1.25-172.16.1.35/32 - refers range of IP Addresses from 172.16.1.25-172.16.1.35
In the default squid config file it also mentions netmask
Code:
# TAG: acl
# Defining an Access List
#
# Every access list definition must begin with an aclname and acltype,
# followed by either type-specific arguments or a quoted filename that
# they are read from.
#
# acl aclname acltype argument ...
# acl aclname acltype "file" ...
#
# When using "file", the file should contain one item per line.
#
# By default, regular expressions are CASE-SENSITIVE. To make
# them case-insensitive, use the -i option.
#
#
# ***** ACL TYPES AVAILABLE *****
#
# acl aclname src ip-address/netmask ... # clients IP address
# acl aclname src addr1-addr2/netmask ... # range of addresses
# acl aclname dst ip-address/netmask ... # URL host's IP address
# acl aclname myip ip-address/netmask ... # local socket IP address
#
# acl aclname arp mac-address ... (xx:xx:xx:xx:xx:xx notation)
# # The arp ACL requires the special configure option --enable-arp-acl.
# # Furthermore, the ARP ACL code is not portable to all operating systems.
# # It works on Linux, Solaris, Windows, FreeBSD, and some other *BSD variants.
# #
# # NOTE: Squid can only determine the MAC address for clients that are on
# # the same subnet. If the client is on a different subnet, then Squid cannot
# # find out its MAC address.
#
# acl aclname srcdomain .foo.com ... # reverse lookup, from client IP
# acl aclname dstdomain .foo.com ... # Destination server from URL
# acl aclname srcdom_regex [-i] \.foo\.com ... # regex matching client name
# acl aclname dstdom_regex [-i] \.foo\.com ... # regex matching server
# # For dstdomain and dstdom_regex a reverse lookup is tried if a IP
# # based URL is used and no match is found. The name "none" is used
# # if the reverse lookup fails.
#
# acl aclname src_as number ...
# acl aclname dst_as number ...
# # Except for access control, AS numbers can be used for
# # routing of requests to specific caches. Here's an
# # example for routing all requests for AS#1241 and only
# # those to mycache.mydomain.net:
# # acl asexample dst_as 1241
# # cache_peer_access mycache.mydomain.net allow asexample
# # cache_peer_access mycache_mydomain.net deny all
#
# acl aclname time [day-abbrevs] [h1:m1-h2:m2]
# # day-abbrevs:
# # S - Sunday
# # M - Monday
# # T - Tuesday
# # W - Wednesday
# # H - Thursday
# # F - Friday
# # A - Saturday
# # h1:m1 must be less than h2:m2
#
Hi, although I do not use similar restrictions on my system (one user) I have used squid for some time.
The protocols have undergone changes from version to version, and I may miss the mark, but a few discrepancies I see are notated below with references.
Code:
Restricting Web Access By Time
You can create access control lists with time parameters. For example, you can allow only business hour access from the home network, while always restricting access to host 192.168.1.23.
#
# Add this to the bottom of the ACL section of squid.conf
#
acl home_network src 192.168.1.0/24
acl business_hours time M T W H F 9:00-17:00
#(edit glenn, not sure if the spaces are required(?), and H is correct for tHursday, sorry, my bad)
acl RestrictedHost src 192.168.1.23
#
# Add this at the top of the http_access section of squid.conf
#
http_access deny RestrictedHost
http_access allow home_network business_hours
should "netmask" be appended to the address ranges?
Code:
ACL TYPE src
Description The IP address of the requesting client, or the clients IP Address
Build Option Default
Usage acl aclname src ip-address/netmask ... (clients IP address)
acl aclname src addr1-addr2/netmask ... (range of addresses)
Synopsis Matching done based on clients ip address
Arguments
aclname Access list name
ip-address Clients ip address
netmask Network mask
add1-addr2 Range of ip address
Example(s)
acl network1 src 172.16.1.0/24 - refers to the whole Network with address 172.16.1.0
acl source1 src 172.16.1.25/32 - refers to a single source
acl srcrange src 172.16.1.25-172.16.1.35/32 - refers range of IP Addresses from 172.16.1.25-172.16.1.35
In the default squid config file it also mentions netmask
Code:
# TAG: acl
# Defining an Access List
#
# Every access list definition must begin with an aclname and acltype,
# followed by either type-specific arguments or a quoted filename that
# they are read from.
#
# acl aclname acltype argument ...
# acl aclname acltype "file" ...
#
# When using "file", the file should contain one item per line.
#
# By default, regular expressions are CASE-SENSITIVE. To make
# them case-insensitive, use the -i option.
#
#
# ***** ACL TYPES AVAILABLE *****
#
# acl aclname src ip-address/netmask ... # clients IP address
# acl aclname src addr1-addr2/netmask ... # range of addresses
# acl aclname dst ip-address/netmask ... # URL host's IP address
# acl aclname myip ip-address/netmask ... # local socket IP address
#
# acl aclname arp mac-address ... (xx:xx:xx:xx:xx:xx notation)
# # The arp ACL requires the special configure option --enable-arp-acl.
# # Furthermore, the ARP ACL code is not portable to all operating systems.
# # It works on Linux, Solaris, Windows, FreeBSD, and some other *BSD variants.
# #
# # NOTE: Squid can only determine the MAC address for clients that are on
# # the same subnet. If the client is on a different subnet, then Squid cannot
# # find out its MAC address.
#
# acl aclname srcdomain .foo.com ... # reverse lookup, from client IP
# acl aclname dstdomain .foo.com ... # Destination server from URL
# acl aclname srcdom_regex [-i] \.foo\.com ... # regex matching client name
# acl aclname dstdom_regex [-i] \.foo\.com ... # regex matching server
# # For dstdomain and dstdom_regex a reverse lookup is tried if a IP
# # based URL is used and no match is found. The name "none" is used
# # if the reverse lookup fails.
#
# acl aclname src_as number ...
# acl aclname dst_as number ...
# # Except for access control, AS numbers can be used for
# # routing of requests to specific caches. Here's an
# # example for routing all requests for AS#1241 and only
# # those to mycache.mydomain.net:
# # acl asexample dst_as 1241
# # cache_peer_access mycache.mydomain.net allow asexample
# # cache_peer_access mycache_mydomain.net deny all
#
# acl aclname time [day-abbrevs] [h1:m1-h2:m2]
# # day-abbrevs:
# # S - Sunday
# # M - Monday
# # T - Tuesday
# # W - Wednesday
# # H - Thursday
# # F - Friday
# # A - Saturday
# # h1:m1 must be less than h2:m2
#
I hope this helps, sorry for the bum-steer.
regards Glenn
About the H thing, no problem dude We all can make mistakes, it's about being human
The Netmask thing:
Well, i tried this too... no luck at all... the problem seems to be somewhere located near the order of the http_access. I've tried any possible combination... Maybe, it could be because i don't know why the and when the ! sign is used in thoseh a statements.. I know squid reads them from top to bottom and stops when he finds a match, but i still am a little confused about the ! sign. I know squid interpreterps a ! as false, so true & false = false... Due to the complexity of my network layout, it is a little confusing... anyway, up for some more testing... I still got 70 yrs to make it work lol
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
*
