Sq and Rad server

Squid and Radius server

Squid
Download the squid tar file squid-3.1.18.tar.gz in the /root then:
# tar -xzf squid-3.1.18.tar.gz
# cd squid-3.1.18
# ./configure –prefix=/usr/local/squid –enable-basic-auth-helpers=”squid_radius_auth”
#make all
#make install
# /usr/local/squid/sbin/squid -z
#/usr/local/squid/sbin/squid &
#chown -R nobody.nobody /usr/local/squid
#ps -ax |grep squid
# killall -9 squid
creat a file where squid server will connect with the radius server thatis
#vi /usr/local/squid/squid_radius_auth.conf
#squid_rad_auth configuration file
# MvS: 28-10-1998
server localhost
secret testing123
port 1812
open the squid configuration file
#vi /usr/local/squid/etc/squid.conf
and write the following line on the start of the configuration file
auth_param basic program /usr/local/squid/libexec/squid_radius_auth -f /usr/local/squid/ squid_radius_auth.conf
auth_param basic children 5
auth_param basic realm Web-Proxy
auth_param basic credentialsttl 5 minute
auth_param basic casesensitive off
acl radius-auth proxy_auth REQUIRED
#http_access allow radius-auth
#http_access allow 127.0.0.1
http_access deny all
more policy for squid config
acl buetnet dstdomain “/etc/squid/buetnet.txt”
http_access allow buetnet
#Recommended minimum configuration:
acl all src 0.0.0.0/0.0.0.0
acl target src 172.16.24.25/255.255.255.255
acl cseproxy src 172.16.101.0/255.255.255.0
acl cseproxy1 src 172.16.101.1/255.255.255.255
acl buetbackbone src 172.16.0.0/255.255.0.0
acl libraryproxy src 172.16.180.251/255.255.255.255
acl libraryproxy2 src 172.16.180.252/255.255.255.255
acl manager proto cache_object
After
acl CONNECT method CONNECT
add the following
acl porn url_regex “/usr/local/squid/etc/lporn.txt”
acl noporn url_regex “/usr/local/squid/etc/noporn.txt”
http_access deny porn !noporn
http_access allow radius-auth
acl password proxy_auth REQUIRED
# And finally deny all other access to this proxy
http_access deny porn !noporn
http_access deny target
http_access deny cseproxy
http_access deny cseproxy1
http_access allow localhost password
http_access allow libraryproxy2 password
http_access allow buetbackbone password
http_access allow radius-auth
http_access deny all
Radius
#tar -xzf freeradius-server-2.1.12.tar.gz
#cd freeradius-server-2.1.12
#./configure
#make all
#make install
#vi /usr/local/etc/raddb/users
the user file has value
joysana Cleartext-Password := “joy”
testing Cleartext-Password := “password”
Here joysana and testing is user name and “joy” and “password” is the password
After adding the user and password you can run the radius as debugging mode
#radiusd –X
If you want to use the system user and password the write the following in the radius users file
DEFAULT Auth-Type := System
Fall-Through = 1
Buetnet.txt file
## Buetnet Access
.buet.ac.bd
https://ecampus.uri.edu:7008/
#www.buet.ac.bd
#biis.buet.ac.bd
#webmail.buet.ac.bd
#.yahoo.com
porno.txt file
.babe
babydoll.
nude
kidsx
penis
.playboy.
.playgirl.
.playhouse.
.porno.
.seks.
sex
teensex
.vagina.
xxx
adult
.babe
babydoll.
nude
kidsx
penis
.playboy.
.playgirl.
.playhouse.
.porno.
.seks.
sex
teensex
.vagina.
xxx
adult
babe
dirty
fetis
fetish
flick
hotboy
hotchatfree.com
kiss
love
male
mamada
nasty
nastyhabits
naughty
panties
pantless
panty
pene
penis
porn
rape
rapist
seks
sex
teen
vagina
woman
women
:::Squid configuration file for backbone::::
acl buetnet dstdomain “/usr/local/squid/buetnet.txt”
auth_param basic program /usr/local/squid/libexec/squid_radius_auth -f /usr/local/squid/radius_config.conf
auth_param basic children 5
auth_param basic realm Web-Proxy
auth_param basic credentialsttl 5 minute
auth_param basic casesensitive off
acl radius-auth proxy_auth REQUIRED
#http_access allow radius-auth
#http_access allow 127.0.0.1
#http_access deny all
#
# Recommended minimum configuration:
#
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
#add new
acl target src 172.16.24.25/32
acl cseproxy src 172.16.101.0/24
acl cseproxy1 src 172.16.101.1/32
acl buetbackbone src 172.16.0.0/16
acl libraryproxy src 172.16.180.251/32
acl libraryproxy2 src 172.16.180.252/32
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access allow buetnet
#add new
acl porn url_regex “/usr/local/squid/etc/lporn.txt”
acl noporn url_regex “/usr/local/squid/etc/noporn.txt”
# add new
http_access deny porn !noporn
http_access deny target
http_access deny cseproxy
http_access deny cseproxy1
http_access allow localhost radius-auth
http_access allow libraryproxy2 radius-auth
http_access allow buetbackbone radius-auth
http_access allow radius-auth
#
# Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on “localhost” is a local user
#http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost
# And finally deny all other access to this proxy
http_access deny all
# Squid normally listens to port 3128
http_port 3128
# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /usr/local/squid/var/cache 100 16 256
# Leave coredumps in the first cache dir
coredump_dir /usr/local/squid/var/cache
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320