Welcome to this demo clip, Using Access Control Lists.
In this clip, we'll learn how to use access control elements. From these
elements, we'll build access control lists, which can be used to manage
access to your proxy cache. Let's get started.
Access control elements are the basic building blocks of user
authentication in Squid. Elements essentially allow you to specify
the type of access control list you're creating.
For example,
you might use the src ACL element to declare a list of IP
addresses that are able to access your server.
Likewise,
you may use the port ACL element to specify which of your
server's ports are open for access. In the next demo where we
talk about user authentication,
we'll make use of the proxy_auth ACL element in order to force
users of a proxy to authenticate via an authentication mechanism
that we choose. Using ACL elements,
we can then easily create an access control list.
Let's do that now.
So here we are in a basic sample squid.conf file.
This is the recommended simplest configuration for a Squid server.
As you can see here, by default,
Squid builds a simple access control list for us. To build an access
control list, you first use the acl declaration here. From there,
you can name your access control list. By default, Squid has named
this one localnet since it refers to IP addresses relative to the
local server network.
Next, you specify the ACL element or the ACL type that you want to use.
Since this access control list is meant to specify a list of
client IP addresses that have access to our server, we use the
src access control list element. And next, you specify the
parameter for your ACL element.
For the src element, you must specify an IP address or a list of IP addresses.
Further down in this simple configuration,
you can see that the ports ACL element is being used here.
So, let's say we want to allow managers and employees access to
our proxy where each manager/employee login will be coming from a
client from a specific IP address.
We can simply build our ACL like this, one for managers
and one for employees. From there,
we then specify what kind of access our access control list provides.
Since we're talking HTTP here, we use the http_access directive to
give these access control lists access to the proxy. And that's
the basics of user access in Squid.
It all revolves around access control lists. So far, we
haven't added any user authentication though.
Please join me for the next demo where we'll build on this knowledge by
enforcing users within the access control lists to actually
authenticate in order to gain access to the proxy.