What kind of proxy acl rules should be applied?

Question

I try to block sites in squid based on this article. Assuming you would want to block access to Yahoo (e.g http://www.yahoo.co.jp, http://www.yahoo.com, http://www.yahoo.co.in), you would ideally want to block all of the above URLs, if I use a regular expression and try to search something called yahoo it seems to get blocked.

We are just interested in applying rules which would be most commonly used across all companies (e.g. social networking sites like facebook, orkut), porn sites (e.g. sex), gaming sites (games), movie & song download sites, and sites where they can upload data (e.g. rapidshare)

What would be the common set of effective rules in achieving the above?

Answer 1

You should really consider using SquidGuard or something similar.

There are blacklists available on the Internet that you can download and use easily.

Answer 2

There are two main ways, pay someone else to do it for you, do it yourself.

You can get MessageLabs to filter your 'net for ya, cost a bit, but you get to specify what they can see using checkboxes, and you get lovely reports for your boss's at the end of the week/month emailed directly to ya. http://www.messagelabs.co.uk/products/web-security-services/

Or; You can create your own acl's (I use a short bash script to append my acl's and reinit squids config (below)) and maintain them based on your users own actual usage.

#!/bin/bash
#this will quickly add a new domain to the blocklist
#call with the domain you want to block eg; ./block_domain crap.com
start="(^|\.)"
#modify to escaped version
domain=$(echo $1 | sed 's/\./\\./g')
#combine and add to block list
output=${start}${domain}$
echo "Blocking $1"
echo $output >> /etc/squid/denied_domains.acl
#reload squid config (enforces new rule)
squid -k reconfigure

You could write something similar using vbs/batch for windows.

Then, use a neat little program: squid-report.pl (davehope.co.uk) to monitor the day's or week's logs, find the most used sites, or largest downloads etc, add the ones you don't want to the block list. Doesn't take much effort. Eventually (with custom error messages per acl, squid is great for that, I have a link that sends an email to me if you click it, so users can report errors with one click) you can train your staff not to visit porn/game sites at work. And, blocking ad's saves so much bandwidth and increases response!

I find sqstat handy for "Realtime" monitoring.. http://sourceforge.net/projects/sqstat/

Great for finding out who is listening to internet radio and wasting bandwidth!

Then, for your "Reports", you can use SARG: http://sarg.sourceforge.net/ Fantastic program, shows When/Who/What/Where the users were doing online.. ;-)