Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I try to block sites in squid based on this article. Assuming you would want to block access to Yahoo (e.g http://www.yahoo.co.jp, http://www.yahoo.com, http://www.yahoo.co.in), you would ideally want to block all of the above URLs, if I use a regular expression and try to search something called yahoo it seems to get blocked.

We are just interested in applying rules which would be most commonly used across all companies (e.g. social networking sites like facebook, orkut), porn sites (e.g. sex), gaming sites (games), movie & song download sites, and sites where they can upload data (e.g. rapidshare)

What would be the common set of effective rules in achieving the above?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

You should really consider using SquidGuard or something similar.

There are blacklists available on the Internet that you can download and use easily.

share|improve this answer
    
thanks for the reply, is SquidGuard available on the Windows platform? my proxy actually runs on Win 2k3 –  user42891 May 23 '10 at 13:43
    
No. I don't know what you can use for Windows... –  Antoine Benkemoun May 23 '10 at 13:50
    
the blacklists are good, but this is way too much information out there. If there are simple regular expressions which can be enforced then it would be easier to control the acl file –  user42891 Jun 10 '10 at 7:14
    
I agree but it's more work and I don't like that :P –  Antoine Benkemoun Jun 10 '10 at 7:45

There are two main ways, pay someone else to do it for you, do it yourself.

You can get MessageLabs to filter your 'net for ya, cost a bit, but you get to specify what they can see using checkboxes, and you get lovely reports for your boss's at the end of the week/month emailed directly to ya. http://www.messagelabs.co.uk/products/web-security-services/

Or; You can create your own acl's (I use a short bash script to append my acl's and reinit squids config (below)) and maintain them based on your users own actual usage.

#!/bin/bash
#this will quickly add a new domain to the blocklist
#call with the domain you want to block eg; ./block_domain crap.com
start="(^|\.)"
#modify to escaped version
domain=$(echo $1 | sed 's/\./\\./g')
#combine and add to block list
output=${start}${domain}$
echo "Blocking $1"
echo $output >> /etc/squid/denied_domains.acl
#reload squid config (enforces new rule)
squid -k reconfigure

You could write something similar using vbs/batch for windows.

Then, use a neat little program: squid-report.pl (davehope.co.uk) to monitor the day's or week's logs, find the most used sites, or largest downloads etc, add the ones you don't want to the block list. Doesn't take much effort. Eventually (with custom error messages per acl, squid is great for that, I have a link that sends an email to me if you click it, so users can report errors with one click) you can train your staff not to visit porn/game sites at work. And, blocking ad's saves so much bandwidth and increases response!

I find sqstat handy for "Realtime" monitoring.. http://sourceforge.net/projects/sqstat/

Great for finding out who is listening to internet radio and wasting bandwidth!

Then, for your "Reports", you can use SARG: http://sarg.sourceforge.net/ Fantastic program, shows When/Who/What/Where the users were doing online.. ;-)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.