up vote 1 down vote favorite
share [g+] share [fb]

I have a linux server that many users connect to. I use Squid for http access but I need a software that can grant access control to different ports based on a MySQL database.

IPtables is great but I need something that will work with MySQL and grant control based on certain IF conditions.

Thanks

link|improve this question
Can you go into a bit more detail about what kind of authentication you are trying to implement? – TokenMacGuy Feb 7 at 14:57
It's a very simple one: IP authentication. I know IPtables allow you to set a range of allowed IP addresses. I need to do the same thing but based on a list of ip addresses in a database. In a sense, the authentication won't be done here. I just need an access control to do some Mysql query "query IP_list, if allow_IP exists, allow access; else Deny." – user106377 Feb 7 at 15:15
1  
Have you thought about the performance issues of trying to do this? Do you really want a mysql query run for every single packet? – Zoredache Feb 7 at 16:55
You are right. Is there any way to do a transparent SOCKS proxy? – user106377 Feb 7 at 23:38
feedback

2 Answers

up vote 2 down vote

iptables permits you to do special processing per packet, by assigning the packet to the QUEUE chain; each packet must then be processed by a userland program that will decide the fate of the packet (Accept, drop, et-cetera). Writing such a handler is described here: http://imchris.org/projects/libipq.html. Because this technique involves making a routing decision per-packet in userland; it may have some serious throughput implications. If possible, you really should consider using ErikA's suggestion of just writing a script that manages rules as needed.

link|improve this answer
feedback
up vote 1 down vote

IPtables/netfilter is your only option. What you'll need is some custom script that manages netfilter rules according to information in your database.

I know of nothing that can do this out of the box. You'll likely need to roll this one yourself.

link|improve this answer
Thanks Erik. My question is how to make Iptables work with MySQL. Is there a plugin? – user106377 Feb 7 at 15:16
Not that I know of, and even if there were, it would likely require a large amount of customization to get it to fit your needs. – ErikA Feb 7 at 15:17
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.