Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a linux server that many users connect to. I use Squid for http access but I need a software that can grant access control to different ports based on a MySQL database.

IPtables is great but I need something that will work with MySQL and grant control based on certain IF conditions.

Thanks

share|improve this question
    
Can you go into a bit more detail about what kind of authentication you are trying to implement? –  TokenMacGuy Feb 7 '12 at 14:57
    
It's a very simple one: IP authentication. I know IPtables allow you to set a range of allowed IP addresses. I need to do the same thing but based on a list of ip addresses in a database. In a sense, the authentication won't be done here. I just need an access control to do some Mysql query "query IP_list, if allow_IP exists, allow access; else Deny." –  user106377 Feb 7 '12 at 15:15
1  
Have you thought about the performance issues of trying to do this? Do you really want a mysql query run for every single packet? –  Zoredache Feb 7 '12 at 16:55
    
You are right. Is there any way to do a transparent SOCKS proxy? –  user106377 Feb 7 '12 at 23:38

2 Answers 2

iptables permits you to do special processing per packet, by assigning the packet to the QUEUE chain; each packet must then be processed by a userland program that will decide the fate of the packet (Accept, drop, et-cetera). Writing such a handler is described here: http://imchris.org/projects/libipq.html. Because this technique involves making a routing decision per-packet in userland; it may have some serious throughput implications. If possible, you really should consider using ErikA's suggestion of just writing a script that manages rules as needed.

share|improve this answer

IPtables/netfilter is your only option. What you'll need is some custom script that manages netfilter rules according to information in your database.

I know of nothing that can do this out of the box. You'll likely need to roll this one yourself.

share|improve this answer
    
Thanks Erik. My question is how to make Iptables work with MySQL. Is there a plugin? –  user106377 Feb 7 '12 at 15:16
    
Not that I know of, and even if there were, it would likely require a large amount of customization to get it to fit your needs. –  EEAA Feb 7 '12 at 15:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.