I'm obviously doing something wrong with my ACLs, and would appreciate
We require authentication via radius, and we only allow each user to
be logged on from workstation at a time. Anyone logged on to a server
can access the Internet from multiple machines (i.e., for maintenance
periods where one admin might be running updates on several boxes
If a user logs in from too many machines, or if he enters a wrong
password, he gets the error message in ERR_NO_SHARING. I would expect
a user who signs on too often to get ERR_NO_SHARING and a user who
fails to authenticate to get the default ERR_CACHE_ACCESS_DENIED.
Instead, all users get ERR_NO_SHARING. I would like to give the users
a useful error message, but obviously I am missing something.
The ACL portion of my squid.conf follows.
Thanks for any suggestions,
auth_param basic program /usr/local/squid/libexec/squid_radius_auth_new -f /etc/squid/squid_radius_auth.conf
auth_param basic children 5
auth_param basic realm 'Web'
#confirm our login is still good via Radius at this interval;
#this is not the time between password query popups at user's browser!
authenticate_ttl 15 minutes
acl all src 0.0.0.0/0.0.0.0 # all sources
acl manager proto cache_object # internal cache manager
acl localhost src 127.0.0.1/255.255.255.255 # This computer's loopback source
acl to_localhost dst 127.0.0.0/8 # This computer's loopback destinations
acl PURGE method PURGE
acl Safe_ports port 80 # http
acl Safe_ports port 20 # ftp
acl Safe_ports port 21 # ftp-data
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
On ons, 2007-07-25 at 13:31 -0400, Michael W. Lucas wrote:
> If a user logs in from too many machines, or if he enters a wrong
> password, he gets the error message in ERR_NO_SHARING. I would expect
> a user who signs on too often to get ERR_NO_SHARING and a user who
> fails to authenticate to get the default ERR_CACHE_ACCESS_DENIED.
> Instead, all users get ERR_NO_SHARING. I would like to give the users
> a useful error message, but obviously I am missing something.
> #clients may only log in from one IP at a time.
> http_access deny noPwSharing