上網防護: 使用 Squid + qlproxy 過濾不良內容

1. 過濾不良內容 (Content Filtering)
2. 擋廣告 (Ad Blocking)
3. 網站黑名單 (HTTP Blocking)
4. 禁止瀏覽成人內容 (Adult Blocking)
5. 網址黑名單 (URL Blocking)
6. 強迫 Google "嚴格篩選" 搜尋結果 (url_rewrite)

環境: Fedora 14, squid 3.1.15, qlproxy 1.4.0, php-cli 5.3.6

以下操作全部以 root 身份進行

su -

下載並安裝 qlproxy (QuintoLabs Content Security Download Page)

wget http://www.quintolabs.com/qlproxy/binaries/1.4.0/qlproxy-1.4.0-72bbf.i386.rpm
yum localinstall --nogpgcheck qlproxy-*.rpm

提升成人內容過濾等級

vi adultblock.conf

heuristics_level = high

禁止使用 IP Address 連線

vi httpblock.conf

url = http://\d+\.\d+\.\d+\.\d+/.*

摘除誤植黑名單的 blogspot.com

cd /var/opt/quintolabs/qlproxy/spool/urlblock/blacklists
find ./ -type f -name domains -exec sed -i -e '/^blogspot.com$/d' {} \;

啟動 qlproxy

chkconfig qlproxy on
service qlproxy start

讓 squid 使用 qlproxy 過濾不良內容

vi /etc/squid/squid.conf

#於檔尾加入以下內容 (Ref: /opt/quintolabs/qlproxy/README)

icap_enable on

icap_preview_enable on

icap_preview_size 4096

icap_persistent_connections on

icap_send_client_ip on

icap_send_client_username on

icap_client_username_header X-Client-Username

icap_service qlproxy1 reqmod_precache bypass=0 icap://127.0.0.1:1344/reqmod

icap_service qlproxy2 respmod_precache routing=on icap://127.0.0.1:1344/respmod

adaptation_access qlproxy1 allow all

adaptation_access qlproxy2 allow all

#若只想針對特定使用者進行內容過濾, 可設置 acl, 並修改 adaptation_access 如下

acl mychildren src 192.168.1.104/29 #IP Range: 192.168.1.105 ~ 192.168.1.110

adaptation_access qlproxy1 allow mychildren

adaptation_access qlproxy2 allow mychildren

service squid restart

使用瀏覽器通過 squid proxy 進行以下測試

#AdBlock 測試
http://thepcspy.com/blockadblock/
#eicar.com 測試
http://eicar.org/download/eicar.com
#搜尋關鍵字測試
http://www.google.com/search?q=adult

若要排除阻擋內容, 可編輯 /opt/quintolabs/qlproxy/etc/exceptions.conf 再 service qlproxy reload 即可生效
-
進階設置: 使用 url_rewrite_program 功能強迫 Google 搜尋使用 "嚴格篩選"
vi /usr/local/bin/rewrite.php

01	#!/usr/bin/php

02

<?php

03	$temp = array();

04	while ( $input = fgets(STDIN) ) {

05	// Split the output (space delimited) from squid into an array.

06	$temp = split(' ', $input);

07	// Set the URL from squid to a temporary holder.

08	$output = $temp[0] . "\n";

09	// Check the URL and rewrite it if it matches foo.example.com

10	if ( strpos($temp[0], "google.com") !== false && strpos($temp[0], "q=") !== false ) {

11	$output = $temp[0] . "&safe=strict\n";

12

}

13	echo $output;

14

} ?>

chmod +x /usr/local/bin/rewrite.php
vi /etc/squid/squid.conf
url_rewrite_program /usr/local/bin/rewrite.php
service squid reload
參考資料:

• Tiny Web Proxy And Content Filtering Appliance On CentOS 6 (Version 1.4)
• Google 網頁搜尋說明 - 鎖定安全搜尋 : 搜尋記錄和設定
• [ubuntu] Squid Script Problems [Archive] - Ubuntu Forums