URL Filtering with Squid

Next to my digital life, I’m also the happy father of two young girls. The first one is already ten years old and smoothly discovers the “Wonderful Internet“. Being an Infosec guy, it sounds logical for me to implement some safeguards.

First, let the technical stuff aside and talk! Some security awareness is always good. The first lesson was to learn how to use a password and  not share it with her sister. It must be seen like a game! Both have their own access on the family laptop. Then, discuss with your children and explain, using simple words, what the Internet is and what they can find: the best as the worst! Communication is the key.  Countermeasures will not be efficient if you don’t explain the reasons. For me also, two golden rules:

• Do not let the children use the computer in a closed room. Shoulder surfing is good in this case.
• If they find something “strange”, encourage them to report it to you and to not be afraid to “ask“.

Unfortunately, it won’t take time before the children will experiment and try to break the rules. Risks are big to find nasty stuff. So, how to protect them and keep an eye on their online activity? Let’s use open source software! I’m not a big fan of the  commercial parental control solutions for several reasons. Why pay if you can build something for free? We have at home more than one computer, not always running Windows. Finally, I can integrate the alerts in my personal SIEM (read “OSSEC” ;-)).

Disclaimer: this setup will protect your children from unappropriated content but has also limitations. It can be used as a starting point in a corporate environment but it must be hardened. It could be easily bypassed by experienced people.

Step one, installation of Squid. This software is the number-one proxy cache that supports multiple protocols. Squid is available as a package on many Linux distributions. The installation is pretty straight forward. The out-of-the-box configuration will work for most of the environments. But one big choice must be made: how will you tell the browser to use the proxy? In corporate environments, you can use a GPO, a ProxyPAC files but at home? You can manually configure the proxy settings in the browser but it could be disabled once they will parse the menu. Do not underestimate them! My choice was to use Squid as a transparent proxy. At firewall level, all the web traffic (as well as other protocols) is redirected to the Squid box. My firewall is based on pf. The traffic redirection is done via a simple rule:

  ...
  proxy_protocols = '{80, 443, 8080, 8000, 21}'
  int="fxp0"
  rdr pass on $i inet proto tcp to any port $proxy_protocols -> $i port 3128
  ...

Step two, installation of SquidGuard. Squid has a nice feature called “URL rewriting”. You can pass all URLs processed by Squid to an external program.

  url_rewrite_program /usr/local/bin/squidGuard -c /usr/local/squidGuard/squidGuard.conf

SquidGuard works like this. All URLs are passed to SquidGuard which compares them against a database. If one of them matches a blacklist condition, a default URL is returned (which will display a warning or any other protection). SquidGuard is easy to compile and install, just follow the INSTALL file.

Step three, setup your policy. For a successful protection, SquidGuard must rely on a strong database. Two approaches are available: working with a whitelist or a blacklist. The first one will be more easy to build but very restrictive. Don’t forget that modern web services are often split across multiple platforms. It will quickly become a nightmare to maintain such a list. Blacklists contain a list of prohibited URLs. In this case, there are always risks to see new sites not listed. My choice was to implement a blacklist. Here again, commercial lists are for sale on the Internet but let’s try to keep the solution free of charge. After some investigations, I found a nice blacklist maintained by the University of Toulouse, France. The blacklist contains the following categories of “bad” sites:

Another big advantage of this selection of sites: They contain lot of French websites (my daughters speak French). Once you downloaded the blacklists and compiled them (to speed up the lookups), it’s time to create your policy. SquidGuard is powerful and can restrict/allow access based on the time, the source IP address, the authenticated user. In my home setup, the proxy is transparent. IP addressed are assigned via DHCP. By using fixed leases, it’s possible to allow all the traffic from those IP addresses. Here is a sample of my configuration:

  #
  # CONFIG FILE FOR SQUIDGUARD
  #

  dbhome /data/squid/squidGuard/db
  logdir /data/squid/log
  dest porn {
    domainlist      porn/domains
    urllist         porn/urls
    log             blocked.log
  }
  # --- All categories are configured as "porn" ---
  src trusted {
    ip 192.168.254.1-192.168.254.10
  }
  acl {
    trusted {
      pass all
    }
    default {
      pass !porn !agressif !astrology !celebrity !chat !child !dangerous_material \
           !dating !drugs !filehosting !financial !forums !gambling !games !hacking \
           !malware !manga !marketingware !mixed_adult !mobile-phone !phishing \
           !publicite !reaffected !redirector !remote-control !sect !sexual_education \
           !strict_redirector !strong_redirector !tricheur !warez !webmail all
      redirect http://proxy.home/block.php?clientaddr=%a&targetgroup=%t&url=%u
    }
  }

This configuration will allow an unrestricted access to the 10 first IP addresses of the subnet. All other users (dynamic IP’s) will have all the categories restricted. Blocked websites will be logged to the “blocked.log” file. I don’t use authentication for two reasons: first, it’s not supported by Squid in transparent mode. Second, I don’t want a double authentication on the computer. When an URL is rejected by Squid/SquidGuard, the following page is displayed in the browser:

To serve this page, a small Apache instance must be available in your network.

Step four, setup the alerts. Squid can now prevent my kids to access nasty content but I don’t have time to keep an eye on the generated logfile. Why not use OSSEC to notify me when an URL has been blocked? Here is an example of event generated by SquidGuard:

2011-01-17 17:33:53 [9039] Request(default/porn/-) http://playboy.com/ 192.168.254.240/- - GET REDIRECT

Add the new logfile in the list of files to monitor at agent level and create a new alert:

  <!-- SquidGuard Alert -->
  <rule id="100026" level="7">
    <regex>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d [\d+] Request\.</regex>
    <description>Unauthorized URL blocked by SquidGuard</description>
  </rule>

This solution will prevent your children from most bad sites until… they will find other ways to access online resources. Don’t underestimate them! Are you ready to play the cat & mouse game? 😉