RE: [cobalt-users] Hijacking of Cache Servers

[Mark Spieth <mspieth@xxxxxxxxxxxx>]

I believe that uses squid for its httpd proxy. Therefore you can create an
access-list. See www.squid-cache.org



Access control lists are the part of Squid's configuration that cause most
people problems. Some things are not necessarily immediately obvious, but
they allow you to be very specific as to what to deny in a short form. 

Basics 

Stopping or allowing people from using you as a proxy server is only one of
the functions of ACLs. ACLs are also used for cache hierarchies. Thus you
will define an ACL first, and then deny or allow access to a function of the
cache. In 99% of cases this feature will be "http_access", which allows or
denies a web browser's to access you. We will use this as an example for all
further cases, though principles apply to the other options (such as
"icp_access"). 

Squid works it's way through the http_access list from top to bottom when
deciding which class you fall into, and also as to if you are denied or
allowed access. Thus if you have a /24 (normally called a class C) network,
and you want to allow only those machines access to the web through the
proxy, you would use the following (assuming that you want the "class C"
(properly a /24) 196.4.160.0 - 196.4.160.255 to have access: 


----------------------------------------------------------------------------
----

acl ourallowedhosts src 196.4.160.0/255.255.255.0
acl all src 0.0.0.0/0.0.0.0

http_access allow ourallowedhosts
http_access deny all


----------------------------------------------------------------------------
----

-----Original Message-----
From: Pete Starnes [mailto:sysop@xxxxxxxx]
Sent: Wednesday, February 23, 2000 1:47 PM
To: cobalt-users@xxxxxxxxxxxxxxx
Subject: [cobalt-users] Hijacking of Cache Servers


I've got a serious problem here and Cobalt seems unwilling to help (unless
of course I'm willing to pay $200 per hour for support).  I have 3
CacheRaq's that are being hijacked by ISP's over seas...lots from Japan,
Russia, England...all over...are for some reason pointing their dial in
clients to my cache servers.  It's eating up all of my incoming and outgoing
bandwidth.

Can someone please tell me how to restrict client access to only those
clients from within my IP ranges?

Thanks in advance.

Pete Starnes
President
NorthEast Texas Online, Inc.


_______________________________________________
cobalt-users mailing list
cobalt-users@xxxxxxxxxxxxxxx
http://list.cobalt.com/mailman/listinfo/cobalt-users