Large
enterprises and nuclear laboratories aren't the only organizations that
need an Internet access policy and a means of enforcing it. My
household has an Internet access policy, and the technique I've used to
enforce it is applicable to almost any organization. In our case, I'm
not too concerned about outside security threats. Our network is is
behind a NAT router, and our Wi-Fi has a ridiculously ugly password. Our
workstations are either Linux or properly patched Windows machines (if
there is such a thing). No, our concerns come from inside our network:
our kids like to play Web-based games, and that often gets in the way of
chores and homework.
We're also concerned they might stumble upon Web
content that we'd rather they not access. So no, we're not protecting
nuclear secrets or intellectual property, but we are enabling the
household to run smoothly without undue distractions.
In general, my wife and I don't care if our kids
play games on-line or stream media. But, if their homework or chores
don't get completed, we want a means of "grounding" them from this
content. The problem is that we also home school, and much of their
educational content is also on-line. So, we can't simply block their
access. We need something a bit more flexible.
When I set out to solve this problem, I made a list of the goals I wanted to accomplish:
-
I don't want managing my kid's Internet access to become a full-time job. I want to be able to set a policy and have it implemented.
-
My wife doesn't want to know how to log in, modify a configuration file and restart a proxy dæmon. She needs to be able to point her browser, check a few boxes and get on with her life.
-
I don't want to write too much code. I'm willing to write a little bit of code, but I'm not interested in re-inventing the wheel if it already exists.
-
I want to be able to enforce almost any policy that makes sense for our household.
-
I don't want anything I do to break their Internet access when they take their laptops outside the house.
I'm sure my household isn't the only
organization interested in these results. However, I made an assumption
that may not make sense in other organizations: my kids won't be taking
any sophisticated measures to circumvent our policy. However, I do
reserve the right to participate in the arms race if they do.
For the purpose of this article, anytime this
assumption leads to a configuration that may not make sense in more
sophisticated environments, I'll try to discuss a few options that will
allow you to strengthen your configuration.
I wasn't able to find any single software package
that was flexible enough to do what I wanted and also easy enough to
use, so that it wouldn't take considerable effort on the part of my wife
and me to employ it. I was able to see that the Squid proxy server had
the potential of doing what I wanted with just a little bit of coding on
my part. My code will tell the proxy server how to handle each request
as it comes in. The proxy either will complete the request for the user
or send the user a Web page indicating that the site the user is trying
to access has been blocked. This is how the proxy will implement
whatever policy we choose.
I've decided that I want to be able to give my
family members one of four levels of Internet access. At the two
extremes, family members with "open" access can go just about anywhere
they want, whereas family members with "blocked" access can't go
anywhere on the Internet. My wife and I will have open access, for
example. If one of the boys is grounded from the Internet, we'll simply
set him as blocked.
However, it might be nice to be able to allow our
kids to go to only a predetermined list of sites, say for educational
purposes. In this case, we need a "whitelist-only" access level.
Finally, I'm planning on a "filtered" access level where we can be a bit
more granular and block things like music download, Flash games and
Java applets. This is the access level the boys generally will have. We
then can say "no more games" and have the proxy enforce that policy.
Because I don't want to write an actual interface
for all of this, I simply use phpMyAdmin to update a database and set
policy (Figure 1). In order to grant a particular access level, I simply
update the corresponding cell in the grid, with 1 being on, and 0 being
off.
Figure 1. phpMyAdmin Interface for Changing Access Policy
Policy enforcement also will require some client
configuration, which I'll discuss in a moment. However, I'm also going
to discuss using OpenDNS as a means of filtering out things that I'd
rather not spend my time testing and filtering. This is a good example
of a security-in-depth posture.
Fuente: http://www.linuxjournal.com/content/flexible-access-control-squid-proxy…