Squid ACL Question

kemplej · 07-29-2004, 11:41 PM

I have a box running squid2.6stable at a customer's site. We currently use ncsa username/passwords to track users' sites. However they are now wanting to completely block internet access from 8pm to 8 am. How would I go about doing this?

slidesystems · 08-02-2004, 08:51 PM

hello,
plz i am trying to configure bandwith management and squid on linux machine. i dont want browsing bandwith to chop into call bandwith. need help on how to shape bandwith between the two and how to get squid well configured.
regards.

kaazzman@yahoo.com

Ankheg · 08-02-2004, 09:22 PM

Learning as I go here...

An excerpt from squid.conf under the ACL tag information...

Code:

#       acl aclname time     [day-abbrevs]  [h1:m1-h2:m2]
#           day-abbrevs:
#               S - Sunday
#               M - Monday
#               T - Tuesday
#               W - Wednesday
#               H - Thursday
#               F - Friday
#               A - Saturday
#           h1:m1 must be less than h2:m2

I believe this combined with http_access is what you're looking for.

So, if you were to add these line (in the appropriate area, probably by the rest of the acl/http_access tags, after any specific allow designations, is my guess):

Code:

acl 8to8http time MTWHF 20:00-8:00
http_access 8to8http deny

I think that might be exactly what you're looking for. This is assuming you only want access during business hours...but you can probably see that it'd be easy to add/remove days and adjust times given this information.

As I understand it: The acl is an "access list" tag that can be defined in a large number of ways, with the time method being what you need in this specific instance. The http_access tag is simply a tag that will take the form of: http_access <previously defined acl> allow|deny.

Again, I must state that I really don't know here, but in the time I was looking at documentation and at the squid.conf itself (this is incredibly well documented compared to most config files), but I think this is along the lines of what you need.

Ankheg · 08-02-2004, 09:24 PM

Oh...

I guess the other quick and dirty way to get this done might be a cron job that would swap out /etc/hosts.allow and /etc/hosts.deny... However, I would only use that as a last resort since that seems not only very hackish, but potentially dangerous to do. But the option would be there, I suppose.

Capt_Caveman · 08-03-2004, 09:22 AM

@slidesystems:
Please do not post the same question in mulitple forums. Select the most relevant forum and post a single thread there. Also, please start your own new threads rather than asking your questions in another users thread as this can prevent users from getting replies to their questions and is considered poor forum ettiquette. Thank you.
-CC

Ankheg · 08-03-2004, 11:56 AM

Man oh man I must have been brain fried yesterday...

When I actually thought about it after I went home, the more I realized that the hosts.allow/hosts.deny thing is something that was just stupid... Please ignore that post.