About controlling access

Controlling individual and group access

ACLs can be applied explicitly to authorized users, but they are also effective for administering access control to individuals as part of a group, such as finance.

Note
You can create groups, add users, and assign group memberships using the Authentication feature of the Appliance Manager. See Chapter 1, Authenticating NetCache Users, for information about configuring the NetCache user database.

Controlling administrative access

ACLs can be applied to members of administrative groups that are assigned "Admin, Full" and "Admin, Read-Only" access permissions.

Controlling specific types of requests

To allow or deny requests for a particular protocol, for example, FTP, then carefully combine variables to limit that type of request.

Note
Rules for controlling access to protocols can also be applied from protocol-specific pages in the Appliance Manager, for example, Setup tab > FTP > General.

Request-type rules

The following table lists examples of rules and explains how those rules govern requests.

Request	Rule	Explanation
Gopher	`deny time 9am - 5pm`	Denies Gopher requests between 9 a.m. and 5 p.m.
HTTP	`deny smartfilter worthless`	Denies HTTP requests for Web content in the SmartFilter "Worthless" category.
Tunnel	`deny any`	Denies all Tunnel requests.

Note
Access to protocols must be enabled before rules that control client requests apply. See Chapter 1, Authenticating NetCache Users, for information on enabling access to NetCache supported protocols.

Controlling access to Web content

You can allow or deny user or group access to Web objects or domains using variables and pattern-matching expressions that specify the URLs or servers to which you want to restrict access.

Global rules

The following table lists examples of rules and explains how those rules govern requests.

Rule	Explanation
`deny url "http://www.corp.com"`	Denies access to a specific URL.
`deny server-ip 10.10.10.11`	Denies access to a specific server.
`deny server-name matches "www\.bad\.com"`	Denies access to a specific server.

Note
Because requests can be made by specifying an IP address, the server-ip variable is more secure than specifying server-name for denying access to a server.

Controlling client access

You can allow or deny access, based on the IP addresses from which users make requests, by using variables and pattern-matching expressions that represent the IP addresses of a specific host, a subnet, or an entire network.

The following table lists examples of rules and explains how those rules govern requests.

Rule	Explanation
`allow client-ip 192.168.1.4`	Allows a specific client access to NetCache services.
`deny client-ip 128.148.37`	Denies a specific client subnet access to NetCache services.
`deny client-domain corp.com`	Denies a specific client domain access to NetCache services.
`allow time 9am - 5pm`	Allows access to NetCache services from 9 a.m. to 5 p.m.
`deny group finance`	Denies requests to access NetCache services from members of the finance group.

Redirecting requests

A redirect action will immediately send a redirect response to the client, causing the client's browser to attempt to fetch the new URL, usually through the cache. You can redirect NetCache-generated "access denied" messages to a URL explaining why the access was denied with instructions on how the user can resolve the problem.

Example

To redirect requests from server subnet 128.125.51 to an internal Web page, specify the following rule:

redirect "http://www.mycorp.com/restricted.html" server-ip 128.125.51

Because redirect causes the client to issue a new request to the cache, a redirection loop may occur. To avoid a redirection loop, use the Global Access Control option on the Setup tab > Access Control > Access Control Lists page of the Appliance Manager to explicitly allow the redirection URL. For example:

allow url "http://www.mycorp.com/gambling.html"

Rewriting requests

A rewrite will internally rewrite a URL, causing NetCache to fetch a different object and return it to the client, if the request is allowed. You can also rewrite requests for restricted objects to other URLs by creating a pattern-matching expression or rule that represents the URL to which requests are directed.

Note
The ACL rewrite action does not support HTTP-based tunneling requests.

Example

To rewrite requests for block.com to safe.com, specify the following rule:

rewrite "http://www.safe.com/restrict.html" url-prefix http://www.block.com

Note
Rewrite should be used only when absolutely necessary, as relative links and inline images may not work. Use of redirect avoids this problem.

Optional syntax

Rewrite and redirect rules have the same action expression syntax. Optionally, however, the action can be followed by a URL that is the redirection target. The URL must be included in double quotation marks.

Example

To follow an action by a URL that is a redirection target for example, <action> "URL" <expression>, specify the following rule:

redirect "http://mycorp.com/no-gopher.html" gopher

Note
If a URL is not specified for a rewrite or redirect action, the Default Redirect/Rewrite URL setting in the Appliance Manager Access Control Options is used. To enter a default rewrite/redirect URL, use the following command line interface command: set config.acl.default_url URL name