Introduction:

Squid is a versatile proxy server that enhances network performance by caching content and optimizing web page delivery. However, to ensure security and control access to sensitive resources, it's essential to configure access restrictions effectively. This guide outlines the process of restricting access to the Squid HTTP proxy server, focusing on enforcing access control rules to enhance security.

Installing and Configuring Squid: Before configuring access restrictions, ensure Squid is installed and running on your system. Follow these steps to install and configure Squid:

1. Installation: Use your package manager (dnf in this case) to install Squid.

    sudo dnf install squid
   

2. Starting and Enabling Squid: Start the Squid service and enable it to start automatically at boot time.

    sudo systemctl start squid
    sudo systemctl enable squid
   

3. Firewall Configuration: Allow access to the Squid service through the firewall.

    sudo firewall-cmd --add-service=squid
    sudo firewall-cmd --add-service=squid --permanent
   

Access Control Configuration: Access control in Squid is managed through ACLs (Access Control Lists) defined in the squid.conf configuration file. Follow these steps to restrict access to specific domains:

1. Editing squid.conf: Open the Squid configuration file for editing.

    sudo vi /etc/squid/squid.conf
   

2. Defining ACLs: Define ACLs to specify the access control rules. In this example, we'll restrict access to the YouTube domain.

    acl youtube dstdomain .youtube.com
   

3. Denying Access: Use http_access deny to deny access to the defined ACLs.

    http_access deny youtube
   

   Alternatively, you can use http_access allow to explicitly allow access to specific ACLs and deny access to all others.

    http_access allow localnet !youtube
   

4. Applying Changes: After configuring access control rules, reload the Squid service to apply the changes.

    sudo systemctl reload squid.service
   

sudo dnf install squid
sudo systemctl start squid
sudo systemctl enable squid
sudo firewall-cmd --add-service=squid
sudo firewall-cmd --add-service=squid --permanent

#Adding access rules
#By default, the /etc/squid/squid.conf file contains the http_access allow localnet rule 
#that allows using the proxy from all IP ranges specified in localnet ACLs.
sudo vi /etc/squid/squid.conf
#acl:access control list
#localnet : name of access control list


#After we add all the things we need in an access control list,
#we'll also need to specifically allow or deny access to each ACL
#to actually enforce the rules


#To deny access to a particular domain (exampe: Youtube)
#dstdomain: destination source type domain
#To denay youtube and all its subdomains use (.youtube.com) and 
#to deny only Youtube and not its subdomains (youtube.com)
acl youtube dstdomain .youtube.com
http_access deny youtube

#or use this
http_access allow localnet !youtube #(this will trigger both rules together)


#to apply changes
sudo systemctl reload squid.service

Conclusion:

By configuring access restrictions in Squid, administrators can effectively control access to web resources and enhance security by preventing unauthorized access to sensitive domains. By following the steps outlined in this guide, organizations can leverage Squid's caching capabilities while maintaining strict control over access policies, thereby ensuring a secure and optimized web browsing experience for users.