Access restrictions

The Access section (safesquid-access(5)) defines the primary security perimeter: who may connect, whether they authenticate, which proxy features they may use, and which User-Groups and bypass flags attach to the connection.

​

Core mechanics

​

Default policy and list order

With Default Access Policy = Deny (recommended):

1. Walk the Allow list top-down; first enabled row whose gates pass wins for that pass.
2. If an Allow row matched, walk the Deny list; a Deny match revokes access.
3. If no Allow row matched, access is denied.

With Default Allow, Deny is walked first, then Allow. Within one list, first match wins — lower rows are not evaluated for that pass.

​

Inner gate order

For each enabled row: Profiles → Interface → IP → LDAP Profiles. Any failure skips to the next row.

​

Client IP and X-Forwarded-For

When X-Forwarded-For is present, it replaces the TCP client IP for ip matching.

​

Two-pass authentication

• First pass (no credentials) — If gates pass and pamauth=TRUE or User name is set, the row matches and issues a 407/401 challenge. If pamauth=FALSE and User name is blank, the row matches immediately — unauthenticated access.
• Second pass (credentials present) — SafeSquid populates the connection’s LDAP distinguished name with group strings (commas stored as spaces). LDAP Profiles rows can match; PAM validation runs during the access check.

​

Kerberos / SSO (ntlm_authentication)

UI label Kerberos / SSO; internal field ntlm_authentication. When TRUE, SafeSquid offers Negotiate (GSSAPI/Kerberos). When FALSE, Negotiate is not advertised. Requires HTTP.keytab for SSO to succeed. See Authentication.

​

DLP bypass

Requires both the Allow bypassing access right (BYPASS) and the DLP bypass checkbox. Either alone leaves DLP active.

​

Recommended entry ordering

1. IP/interface no-auth rows (specific addresses first)
2. Profile-bypass rows (e.g. BYPASS AUTHENTICATION) — before auth rows
3. LDAP Profiles — before PAM regex (group beats username pattern)
4. PAM regex and entry-credential rows
5. Profile-gated showcase rows (each has a profiles constraint)
6. PAM catch-all — last Allow row
7. Deny exceptions — paired with an Allow range to demonstrate revoke

​

Global fields

• Default Access Policy — Deny recommended. Controls default when no row matches and which list is walked first.
• Kerberos / SSO — Enables Negotiate when keytab is present.

​

Rule fields

All configured criteria on a row must match. Blank means any.

• IP Address — Single IP, comma list, or hyphen range. CIDR not supported. Uses XFF when present.
• Interface — Listen socket IP:port of the accept.
• System authentication — Cache → PAM → LDAP bind; User name is a regex filter; Password ignored.
• User name / Password — With System auth off: exact case-sensitive match. Non-empty User name still triggers challenge on first pass.
• LDAP Profiles — Exact match against the connection’s LDAP distinguished name; write DNs with spaces not commas.
• Access — CONFIG, PROXY, HTTP, TRANSPARENT, CONNECT, BYPASS — independent rights.
• MAX Concurrent Connections — Keyed username@client-ip; 0 = no cap.

​

Examples

​

How to verify

1. Test from a known client IP without spoofed XFF (unless testing that path).
2. Reports → Detailed logs — username, IP, access filter.
3. Enable Trace Entry on one row; check native logs.
4. SECURITY log family for authentication outcomes.