Restricting web access based on User ID w/ a twist

[josel]

Howdy!

A coleague of mine asked about how to restrict web access to a group of users and/or allow access to ONLY specified URLs. To this, I suggested he used a linux box to setup a firewall ...

He then came back with this question

I have a question with regards to your suggestion to use an internal PC. If 
we go that route or use an independent Linux box (more preferably the Linux 
box), we have both thin clients and pc's with IP addresses and user names 
which sits in the 2003 server. Can the user name then be passed to the Linux 
box which has the software to restrict.

I assume the flow is from the thinclients/pc's to the 2003 server to the 
Linux box.

I must be able to pick up the user name not the IP address for the 
restrictions to work properly.

Any thoughts would be appreciated.

I am posting this on his behalf. Is this possible? Could we setup a linux firewall and base the configuration based on user IDs even when those users are loging on a Thin Client Server?

My first thoughts were LDAP or Active Dirctories but, I do not know much about them so ... I figure I ask you guys/gals.

Thank you all in advance!


Jose Lerebours

KNOWLEDGE: Something you can give away endlessly and gain more of it in the process! - Jose Lerebours

 

[oppcos]

I have seen Squid (

http://www.squid-cache.org/)

work wonders as a Linux proxy to do what you require. It will let you authenticate in several ways. If you can't get it working with what you have and don't want to use LDAP, etc, then you can always set it to "Proxy Authentication" and they'll get a login box the first time they try to access restricted URLs / content (which you can set up some pretty advanced filters). (Think wireless Internet Cafe kind of stuff.)

Squid also comes with very advanced features, such as restrictions based on time, MAC address, etc. I recommend using it instead of trying to wrap your head around Linux's kernel networking support (which is, actually what's doing most of the work behind the scenes.)

I recommend getting ClamAV on the Linux box listening to all incoming TCP/IP streams to make sure you filter out any Windows viruses before they enter your network as well.

http://www.clamav.net/

 

[thedaver]

Along the lines of the Internet Cafe' model, you should also read up on NoCat Auth, a program extensively used for cafe's. I can't speak to it's restrictions in destination URLs, but it's very much of the model of controlling outbound IP to "authorized" customers/users.

http://nocat.net/

Hosting Solutions for Home or Business.

http://www.surfinbox.com/hosting/