<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>What i want if it's possible is :<div><br></div><div>Users can't access Internet, except during two periods each day i 'll define. During these two periods, they can access only a few sites i define in the file (basic url http or https per line)</div><div>I have to know if it's possible with Squid ? or Squidguard ? Or not at all ?</div><div><br></div><div>Thank you !<br><br><div>> From: Antony.Stone@squid.open.source.it<br>> To: squid-users@lists.squid-cache.org<br>> Date: Thu, 12 Nov 2015 17:04:06 +0100<br>> Subject: Re: [squid-users] ACL and http_access<br>> <br>> On Thursday 12 November 2015 at 15:55:10, Magic Link wrote:<br>> <br>> > Hi,<br>> > I want people don't have access to Internet, except one hour twice a day<br>> > with only some urls.listed in a file.I use the ACL type "time" and<br>> > "url_regex" but it doesn't work.<br>> <br>> Please elaborate on "it doesn't work".<br>> <br>> Do you mean people cannot access the Internet when they are supposed to be <br>> able to?<br>> <br>> Do you mean they can access the Internet when they are not supposed to be able <br>> to?<br>> <br>> Do you mean that can access sites which they are not supposed to access?<br>> <br>> What, specifically, does and does not work?<br>> <br>> > I think i don't do well with the order of http_access too. Is it possible<br>> > with squid only to do what i want ? Here is my squid.conf :<br>> <br>> > acl network src 10.2.0.0/16<br>> > acl working_hours time MTWHF 09:30-10:30<br>> > acl out_working_hours MTWHF 17:30-18:30<br>> > acl whitelist url_regex "/etc/squid3/allow.acl"<br>> <br>> We need to see the contents (or at least, some examples) from that file.<br>> <br>> > acl SSL_ports port 443<br>> > acl Safe_ports port 80 # http<br>> > acl Safe_ports port 21 # ftp<br>> > acl Safe_ports port 443 # https<br>> > acl Safe_ports port 70 # gopher<br>> > acl Safe_ports port 210 # wais<br>> > acl Safe_ports port 1025-65535 # unregistered ports<br>> > acl Safe_ports port 280 # http-mgmt<br>> > acl Safe_ports port 488 # gss-http<br>> > acl Safe_ports port 591 # filemaker<br>> > acl Safe_ports port 777 # multiling http<br>> > acl CONNECT method CONNECT<br>> > http_access deny !Safe_ports<br>> > http_access deny CONNECT !SSL_ports<br>> > http_access allow localhost manager<br>> > http_access deny manager<br>> <br>> > http_access allow localhost<br>> > http_access deny out_working_hours<br>> > http_access allow working_hours whitelist<br>> > http_access allow network<br>> > http_access deny all<br>> <br>> So the above 5 directives will:<br>> <br>> 1. Allow access from the local machine (good).<br>> <br>> 2. Deny access from anywhere between M-F 17:30-18:30 - is that really what you <br>> meant? You said you want to allow access for one hour twice a day, yet here <br>> you are denying access during a one hour timeslot.<br>> <br>> 3. Allow access from anywhere M-F 09:30-10:30 to sites matching your regex <br>> list.<br>> <br>> 4. Allow access from any address 10.2.0.0/16 - this looks bad<br>> <br>> 5. Deny anything else.<br>> <br>> > http_port 3128<br>> > coredump_dir /var/spool/squid3<br>> > refresh_pattern ^ftp: 1440 20% 10080<br>> > refresh_pattern ^gopher: 1440 0% 1440<br>> > refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>> > refresh_pattern . 0 20% 4320<br>> > debug_options 28,4<br>> <br>> I would suggest (assuming your regex list is good) trying:<br>> <br>> http_access allow localhost<br>> http_access allow network working_hours whitelist<br>> http_access allow network out_working_hours whitelist<br>> http_access deny all<br>> <br>> The above should allow access from 10.2.0.0/16 to the sites in your regex list <br>> between the hours 09:30-10:30 and 17:30-18:30 M-F<br>> <br>> If that isn't what you wanted, please specify the requirement and we'll see if <br>> we can help further.<br>> <br>> <br>> <br>> Antony.<br>> <br>> -- <br>> +++ Divide By Cucumber Error. Please Reinstall Universe And Reboot +++<br>> <br>> Please reply to the list;<br>> please *don't* CC me.<br>> _______________________________________________<br>> squid-users mailing list<br>> squid-users@lists.squid-cache.org<br>> http://lists.squid-cache.org/listinfo/squid-users<br></div></div> </div></body>
</html>