WEBVTT 00:00:01.140 --> 00:00:04.860 Welcome to this demo clip, Using Access Control Lists. 00:00:05.740 --> 00:00:10.490 In this clip, we'll learn how to use access control elements. From these 00:00:10.490 --> 00:00:14.530 elements, we'll build access control lists, which can be used to manage 00:00:14.530 --> 00:00:17.860 access to your proxy cache. Let's get started. 00:00:19.140 --> 00:00:22.750 Access control elements are the basic building blocks of user 00:00:22.750 --> 00:00:27.520 authentication in Squid. Elements essentially allow you to specify 00:00:27.520 --> 00:00:30.050 the type of access control list you're creating. 00:00:30.740 --> 00:00:31.660 For example, 00:00:32.340 --> 00:00:36.210 you might use the src ACL element to declare a list of IP 00:00:36.210 --> 00:00:38.850 addresses that are able to access your server. 00:00:39.640 --> 00:00:40.440 Likewise, 00:00:40.450 --> 00:00:44.200 you may use the port ACL element to specify which of your 00:00:44.200 --> 00:00:49.030 server's ports are open for access. In the next demo where we 00:00:49.030 --> 00:00:50.790 talk about user authentication, 00:00:50.940 --> 00:00:56.180 we'll make use of the proxy_auth ACL element in order to force 00:00:56.180 --> 00:01:00.250 users of a proxy to authenticate via an authentication mechanism 00:01:00.250 --> 00:01:03.420 that we choose. Using ACL elements, 00:01:03.430 --> 00:01:06.060 we can then easily create an access control list. 00:01:06.540 --> 00:01:07.760 Let's do that now. 00:01:08.440 --> 00:01:12.160 So here we are in a basic sample squid.conf file. 00:01:13.040 --> 00:01:16.960 This is the recommended simplest configuration for a Squid server. 00:01:18.140 --> 00:01:20.410 As you can see here, by default, 00:01:20.410 --> 00:01:24.420 Squid builds a simple access control list for us. To build an access 00:01:24.420 --> 00:01:29.250 control list, you first use the acl declaration here. From there, 00:01:29.250 --> 00:01:33.470 you can name your access control list. By default, Squid has named 00:01:33.470 --> 00:01:37.410 this one localnet since it refers to IP addresses relative to the 00:01:37.410 --> 00:01:38.560 local server network. 00:01:39.740 --> 00:01:44.450 Next, you specify the ACL element or the ACL type that you want to use. 00:01:45.140 --> 00:01:48.430 Since this access control list is meant to specify a list of 00:01:48.430 --> 00:01:52.700 client IP addresses that have access to our server, we use the 00:01:52.700 --> 00:01:57.690 src access control list element. And next, you specify the 00:01:57.690 --> 00:01:59.960 parameter for your ACL element. 00:02:00.740 --> 00:02:06.050 For the src element, you must specify an IP address or a list of IP addresses. 00:02:07.140 --> 00:02:09.060 Further down in this simple configuration, 00:02:09.539 --> 00:02:13.160 you can see that the ports ACL element is being used here. 00:02:14.540 --> 00:02:19.140 So, let's say we want to allow managers and employees access to 00:02:19.140 --> 00:02:24.350 our proxy where each manager/employee login will be coming from a 00:02:24.350 --> 00:02:27.160 client from a specific IP address. 00:02:28.340 --> 00:02:35.270 We can simply build our ACL like this, one for managers 00:02:35.280 --> 00:02:38.240 and one for employees. From there, 00:02:38.280 --> 00:02:42.200 we then specify what kind of access our access control list provides. 00:02:42.740 --> 00:02:48.260 Since we're talking HTTP here, we use the http_access directive to 00:02:48.260 --> 00:02:52.660 give these access control lists access to the proxy. And that's 00:02:52.660 --> 00:02:54.660 the basics of user access in Squid. 00:02:55.140 --> 00:02:59.410 It all revolves around access control lists. So far, we 00:02:59.410 --> 00:03:01.550 haven't added any user authentication though. 00:03:02.340 --> 00:03:06.040 Please join me for the next demo where we'll build on this knowledge by 00:03:06.040 --> 00:03:09.700 enforcing users within the access control lists to actually 00:03:09.700 --> 00:03:12.450 authenticate in order to gain access to the proxy.