I searched to see if I have any old acl lists but couldn't find them. I did
this a long time back but remember enough to give you a start.
For the actual syntax, there are a *lot* of articles on the net.
1. You will have to define groups of computers(IP addresses) or users(people).
1.1 Lets look at IP addresses:
1.1.1 You can have lists of individual IP addresses: Eg.
developers=192.168.0.2, 192.168.0.4, 192.168.0.5, ......
test_engineers=192.168.0.3, 192.168.0.6, ......
1.1.2 You can have a group defined as a net mask:
developers=192.168.0.0/255
test_engineers=192.168.1.0/255
2. You can create groups of URLs, whitelists and blacklists....
Eg: blacklist1=*facebook.com, *myspace.com, *exe....
blacklist2=*flickr.com, *picasa*, *zip....
whitelist1=sourceforge.net, rubyforge.net
whitelist2=google.com, rediff.com
You can have these as external text files. Also accepts regex....
You can restrict downloads too using this process - notice the *exe above.
A group can consist of single IP too. A single IP can be in multiple groups but
try to avoid that as it leads to confusion on what is allowed and what is
denied.
3. Finally define which group can access which list. (acl = access control list)
3.1 For a tightly restrictive system, first DENY everything to everybody and
then allow access to individual whitelistslists/sites to individual groups.
3.2 For loose system, ALLOW everything to everybody and then DENY individual
balcklists/sites to individual groups.
3.3 Make sure that you set relatively loose permissions to CEO and top mgmt.
4 MOST IMPORTANT: Make sure you communicate well with all people in the firm.
4.1 First send out an email that you are introducing usage policies and that
they will be some teething problems and that they will be streamlined over
time. Tell your users that they may initially face issues in accessing regular
sites too as the rules are not fully tested. Ask them to send emails with
requests - this will reduce a lot of friction during the initial phases and you
will also have a list so that you will not forget.
4.2 Start with a small group, stabilise it, then move on to bigger groups - do
not try a big bang approach. You will face a lot of problems with a big-bang
approach.
4.3 Finally remember that you are trying to reduce wastage and bandwidth usage
to enhance productivity - be responsive to allowing productivity sites like
technical help...be proactive about helping them be more productive.
5. You can also ask squid to use your Directory Server so that you monitor
based on user rather than IP address. That is slightly advanced and you can try
it later.
Thanks,
kc
K. C. Ramakrishna
www.rknowsys.com
_______________________________________________
To unsubscribe, email [email protected] with
"unsubscribe <password> <address>"
in the subject or body of the message.
http://www.ae.iitm.ac.in/mailman/listinfo/ilugc
