Squid + оболочка для управления пользователями

не используй их.
потом будут проблемы. тот же SAMS правит squid.conf.

Я бы рад не использовать. Но нужно как то реализовать лимитирование месячного трафика для пользователей. Скажем в OpenLDAP у меня есть 2-ве группы full_internet и limit_internet (на 2 GB в месац). Нужно на основе этих групп создать списки доступа. В результате чего нужно парсить лог access.log и принимать решение о превышении лимита трафика для конкретного пользователя, а также периодически автоматически выполнять squid reload дабы новые настройки сквида вступили в силу.

# # Recommended minimum configuration: #

# Example rule allowing access from your local networks. # Adapt to list your (internal) IP networks from where browsing # should be allowed #acl localnet src 10.0.0.0/8 # RFC1918 possible internal network #acl localnet src 172.16.0.0/12 # RFC1918 possible internal network #acl localnet src 192.168.0.0/16 # RFC1918 possible internal network #acl localnet src # RFC 4193 local private network range #acl localnet src # RFC 4291 link-local (directly plugged) machines acl localnet src 192.168.20.0/25

# # Ldap authentifications auth_param basic program /usr/local/libexec/squid/basic_ldap_auth -b 'dc=example,dc=org' -f 'uid=%s' -D 'cn=root,dc=example,dc=org' -w ****************

auth_param basic realm Squid Digest Auth #acl ldap_user proxy_auth REQUIRED

# # external_acl_type ldap_group_rfc2307 %LOGIN /usr/local/libexec/squid/ext_ldap_group_acl -b «ou=Groups,dc=example,dc=org» -D 'cn=root,dc=example,dc=org' -w ******** -f '(&(cn=%g)(memberUid=%u))' acl acl_ldap_full_internet external ldap_group_rfc2307 full_internet acl acl_ldap_limit_internet external ldap_group_rfc2307 limit_internet

acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT

# # Recommended minimum Access Permission configuration: # # Deny requests to certain unsafe ports http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports http_access deny CONNECT !SSL_ports

# Only allow cachemgr access from localhost #http_access allow localhost

# We strongly recommend the following be uncommented to protect innocent # web applications running on the proxy server who think the only # one who can access services on «localhost» is a local user #http_access deny to_localhost

# # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS #

# Example rule allowing access from your local networks. # Adapt localnet in the ACL section to list your (internal) IP networks # from where browsing should be allowed #http_access allow localnet #http_access allow ldap_user

acl banusers proxy_auth_regex -i «/usr/local/etc/squid/deny_user.list»

http_access deny banusers http_access allow acl_ldap_full_internet http_access allow acl_ldap_limit_internet http_access allow localhost

# And finally deny all other access to this proxy http_access deny all

# Squid normally listens to port 3128 http_port 8080

# Uncomment and adjust the following to add a disk cache directory. #cache_dir ufs /var/squid/cache 100 16 256

# # Disable cache cache deny all

# Leave coredumps in the first cache dir coredump_dir /var/squid/cache

# # Add any of your own refresh_pattern entries above these. # refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320

Скрипт генерации deny_user.list

#!/usr/local/bin/bash

user=(`ldapsearch -x -w ****** -b dc=example,dc=org -D cn=root,dc=example,dc=org cn=limit_internet | grep memberUid | awk '{print $2}'`)

for i in ${user[@]}; do

byte=`cat /var/log/squid/access.log | grep $i | awk '{print $2}' | paste -sd+ - | bc`

if [[ $byte -ge 5000000 ]]; then

echo $i >> /usr/local/etc/squid/deny_user.list

fi

done

/usr/local/etc/rc.d/squid restart

exit 0

Для ведения статистики (по часам по дням и неделям) годится простой

free-sa

В установке прост. Доступ через вебморду.