Topic: Papercut as an internet usage monitor

[axessit]

I have installed Papercut and have it working great - it monitors print usage and stops printing when the credit runs out, and it monitors internet use and decreases the balance on internet use - but when the credit runs out, users can still access the internet.

The papercut manual http://www.papercut.com/products/ng/manual/apdx-proxy-squid.html#apdx-proxy-squid-acl mentions about inserting lines in the squid.conf file to make it stop the internet when credit is up, however i am finding it doesn't.

I have set the squid.conf file as suggested, restarted squid. Do I need to reconfigure first (although I tried this it did not work) with squid -k reconfigure ?

my squid.conf:

http_port 192.168.2.5:3128
http_port 127.0.0.1:3128
udp_incoming_address 192.168.2.5
udp_outgoing_address 0.0.0.0

redirect_program /etc/squid/redirect/redir.pl
redirect_children 6

external_acl_type papercut_credit ttl=60 %LOGIN /opt/papercut/providers/net/bin/linux-i686/squid-acl-helper -s localhost

auth_param basic program /usr/lib/squid/pam_auth
auth_param basic children 5
auth_param basic realm SME_Server_Proxy
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl requireauth proxy_auth REQUIRED

acl localsrc src 127.0.0.1 192.168.2.0/255.255.255.0
acl localdst dst 127.0.0.1 192.168.2.0/255.255.255.0
acl SSL_ports port 443 563
acl Safe_ports port 21 70 80 81 119 210 443 563 980 1024-65535

acl papercut_allow external papercut_credit

acl CONNECT method CONNECT
acl webdav method PROPFIND TRACE PURGE PROPPATCH MKCOL COPY MOVE LOCK UNLOCK
pid_filename /var/log/squid/squid.pid
logfile_rotate 0
append_domain .mydomain
cache_mgr admin@mydoman
ftp_user nobody@mydomain
extension_methods REPORT MERGE MKACTIVITY CHECKOUT
acl siteexempt dstdomain .125.236.232.157 .ad.au.doubleclick.net .www.wordle.net
http_access allow siteexempt
http_access allow requireauth

http_access allow manager localsrc
http_access deny manager

http_access deny CONNECT !SSL_ports
http_access allow localsrc

http_access allow papercut_allow

http_access deny all

icp_access allow all
miss_access allow all

store_avg_object_size 3 KB
always_direct allow webdav
always_direct allow all

Once I get it working, I'll tidy it up and put in custom template fragments, but for now I am just direct editing my squid.conf knowing that I can fix it all up pretty easy with expand-template squid.conf.

[cactus]

my squid.conf:
Once I get it working, I'll tidy it up and put in custom template fragments, but for now I am just direct editing my squid.conf knowing that I can fix it all up pretty easy with expand-template squid.conf.

Do yourself a favor and start using the custom-template fragments as soon as you can as your changes might get wiped out when you update your configuration or install updates or additional packages.

At least the following events will remove your changes:

Code: [Select]

[root@smetest~]# find /etc/e-smith/events/*/templates2expand/ -name squid.conf | sed -e 's/^.*events\///' -e 's/\/templates.*$//'
proxy-update
network-create
console-save
network-delete
bootstrap-console-save
[root@smetest ~]#
The only way to keep your changes over such events is to use custom template fragments. It is not that hard to master the custom template fragment logic, so why wait?

[axessit]

It's only three lines of code, but are they in the right place ? I can't seem to get it to stop internet with a zero balance.

Is the external_acl_type in the right place in the file ?

[bentbostad]

Did you get it to work, the web auth works for me, and i see the acl helper works,  but it doesnt cut off internet when balance goes to zero.

/usr/lib/squid3/squid-acl-helper -s 10.5.6.41
pounder
OK
Administrator
OK
kiana
ERR

[axessit]

No, didn't get it working due to lack of help. It does work for printing and has saved me heaps of paper (kids just print without thinking otherwise) but cutting the internet off would be good.

[bentbostad]

I've got the authenticating with ldap working, and i see the acl-helper gets response from Papercut server, but it doesnt cut off internet, i guess the problem is where the acl's are put in the squid.conf, i've been testing a few days now, all works except the internet-cutoff. What kind of linux are you running squid on, and which version?

[axessit]

running on SME 7.6. I think I saw the other day there was an update for papercut, but I haven't gone there since the cut off feature didn't work, I kind of gave up on that. I was really only assessing it's worth to see if it was worth marketing as a tool. I also use Dansguardian for internet filtering. But the counter for internet usage works and decreases the balance as I would expect and stops the printing.