Re: [squid-users] ACLs and localhost

paul cooper wrote:
> so is what i want to do actually possible ?

If I understand your intentions correctly yes it is:

   http_access deny !Safe_ports
   http_access emma weekends
   http_access andrew
   http_access deny

non-safe port access denied
emma only logging in on weekends, not accepted otherwise.
andrew logging in anytime.
nobody else allowed.

>
> unixlogin emma logged into VT7
> unixlogin andrew -> VT8
>
> web page request from either -> squid requests login
>
> if its emma & !testing -> access denied
> if its emma & testing -> access allowed
>
> switch to VT8 ( andrews desktop)
> web page request -> squid requests login
> if its andrew -> access allowed
> if its emma && !testing (eg kids messing around) -> access denied
>
>
>
> hepworth squid # grep ^auth_param /etc/squid/squid.conf
> auth_param basic program /usr/libexec/squid/ncsa_auth /etc/squid/htpasswd
> hepworth squid # grep ^acl /etc/squid/squid.conf | grep -v '#'
> acl all src 0.0.0.0/0.0.0.0
> acl localhost src 127.0.0.1/255.255.255.255
> acl SSL_ports port 443
> acl purge method PURGE
> acl CONNECT method CONNECT
> acl andrew proxy_auth REQUIRED
> acl emma proxy_auth REQUIRED
> acl QUERY urlpath_regex cgi-bin \?
> acl apache rep_header Server ^Apache
> acl testing time MTWHF 07:30-08:00
> hepworth squid # grep ^http /etc/squid/squid.conf | grep -v '#'
> http_port 3128
> http_access allow emma testing
> http_access allow andrew
> http_access deny all
> hepworth squid #
>
>
> 008/03/25 15:04:03| aclMatchIp: '127.0.0.1' found
> 2008/03/25 15:04:03| aclMatchAclList: returning 1
> 2008/03/25 15:04:03| aclCheck: checking 'http_access allow emma testing'
> 2008/03/25 15:04:03| aclMatchAclList: checking emma
> 2008/03/25 15:04:03| aclMatchAcl: checking 'acl emma proxy_auth REQUIRED'
> 2008/03/25 15:04:03| aclCacheMatchAcl: cache hit on acl '0x82a7cc8'
> 2008/03/25 15:04:03| aclMatchAclList: checking testing
> 2008/03/25 15:04:03| aclMatchAcl: checking 'acl testing time MTWHF
> 07:30-08:00'
> 2008/03/25 15:04:03| aclMatchTime: checking 904 in 450-480, weekbits=3e
> 2008/03/25 15:04:03| aclMatchAclList: no match, returning 0
> 2008/03/25 15:04:03| aclCheck: checking 'http_access allow andrew '
> 2008/03/25 15:04:03| aclMatchAclList: checking andrew
> 2008/03/25 15:04:03| aclMatchAcl: checking 'acl andrew proxy_auth REQUIRED'
> 2008/03/25 15:04:03| aclCacheMatchAcl: cache hit on acl '0x82a7d38'
>
> but i havent AFAIK logged in , in this browser session, as andrew ( the
> browser cache is flushed when its closed
>
> so is this login stored in the cache somewhere ?
> I need to flush the cache when i change user ?
>
>
> 2008/03/25 15:04:03| aclMatchAclList: returning 1
> 2008/03/25 15:04:03| aclCheck: match found, returning 1
> 2008/03/25 15:04:03| aclCheckCallback: answer=1
> 2008/03/25 15:04:03| The request GET http://grolma.no-ip.org/favicon.ico
> is ALLOWED, because it matched 'andrew'
> 2008/03/25 15:04:03| aclCheck: checking 'cache deny QUERY'
> 2008/03/25 15:04:03| aclMatchAclList: checking QUERY
> 2008/03/25 15:04:03| aclMatchAcl: checking 'acl QUERY urlpath_regex
> cgi-bin \?'
> 2008/03/25 15:04:03| aclMatchRegex: checking '/favicon.ico'
> 2008/03/25 15:04:03| aclMatchRegex: looking for 'cgi-bin'
> 2008/03/25 15:04:03| aclMatchRegex: looking for '\?'
> 2008/03/25 15:04:03| aclMatchAclList: no match, returning 0
> 2008/03/25 15:04:03| aclCheck: NO match found, returning 1
> 2008/03/25 15:04:03| aclCheckCallback: answer=1
> 2008/03/25 15:04:03| aclCheckFast: list: 0x8481608
> 2008/03/25 15:04:03| aclMatchAclList: checking all
> 2008/03/25 15:04:03| aclMatchAcl: checking 'acl all src 0.0.0.0/0.0.0.0'
> 2008/03/25 15:04:03| aclMatchIp: '127.0.0.1' found
> 2008/03/25 15:04:03| aclMatchAclList: returning 1
> 2008/03/25 15:04:03| aclCheck: checking 'http_reply_access allow all'
> 2008/03/25 15:04:03| aclMatchAclList: checking all
> 2008/03/25 15:04:03| aclMatchAcl: checking 'acl all src 0.0.0.0/0.0.0.0'
> 2008/03/25 15:04:03| aclMatchIp: '127.0.0.1' found
> 2008/03/25 15:04:03| aclMatchAclList: returning 1
> 2008/03/25 15:04:03| aclCheck: match found, returning 1
> 2008/03/25 15:04:03| aclCheckCallback: answer=1
> 2008/03/25 15:04:03| The reply for GET http://grolma.no-ip.org/favicon.ico
> is ALLOWED, because it matched 'all'
>
>
>

-- 
Please use Squid 2.6STABLE17+ or 3.0STABLE1+
There are serious security advisories out on all earlier releases.