> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safesquid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Access restrictions

<Note>
  CLI man page: `safesquid-access(5)`
</Note>

The **Access** section (`safesquid-access(5)`) defines the primary security perimeter: who may connect, whether they authenticate, which proxy features they may use, and which User-Groups and bypass flags attach to the connection.

<Note>
  Configure authentication mechanisms in [Authentication](/admin_guide/start_here/authentication). LDAP directory setup is in [Integrate LDAP](/admin_guide/infrastructure_and_access/integrate_ldap). Content allow/deny is in [Access Profiles](/admin_guide/policies_and_profiles/access_profiles).
</Note>

## Core mechanics

### Default policy and list order

With **Default Access Policy = Deny** (recommended):

1. Walk the **Allow** list top-down; first enabled row whose gates pass wins for that pass.
2. If an Allow row matched, walk the **Deny** list; a Deny match revokes access.
3. If no Allow row matched, access is denied.

With Default Allow, Deny is walked first, then Allow. Within one list, **first match wins** — lower rows are not evaluated for that pass.

<Frame caption="Processing flow — policy Deny, Allow list pass">
  <img src="https://mintcdn.com/safe-squid-labs-12a0916f/VRx-_vpMam8ezhZz/images/admin_guide/access_restrictions_flowchart.svg?fit=max&auto=format&n=VRx-_vpMam8ezhZz&q=85&s=17e6f2f969f00f28b055dc6db04d6b39" alt="Access check flow for policy Deny" width="480" height="380" data-path="images/admin_guide/access_restrictions_flowchart.svg" />
</Frame>

### Inner gate order

For each enabled row: **Profiles** → **Interface** → **IP** → **LDAP Profiles**. Any failure skips to the next row.

### Client IP and X-Forwarded-For

When `X-Forwarded-For` is present, it replaces the TCP client IP for `ip` matching.

<Warning>
  **Spoofing risk:** a client sending `X-Forwarded-For: 127.0.0.1` can match localhost IP rows and receive CONFIG (Web UI) access. Expose the proxy only on trusted networks.
</Warning>

### Two-pass authentication

* **First pass (no credentials)** — If gates pass and `pamauth=TRUE` or User name is set, the row matches and issues a 407/401 challenge. If `pamauth=FALSE` and User name is blank, the row matches immediately — unauthenticated access.
* **Second pass (credentials present)** — SafeSquid populates the connection's LDAP distinguished name with group strings (commas stored as spaces). LDAP Profiles rows can match; PAM validation runs during the access check.

### Kerberos / SSO (`ntlm_authentication`)

UI label **Kerberos / SSO**; internal field `ntlm_authentication`. When TRUE, SafeSquid offers **Negotiate** (GSSAPI/Kerberos). When FALSE, Negotiate is not advertised. Requires `HTTP.keytab` for SSO to succeed. See [Authentication](/admin_guide/start_here/authentication).

### DLP bypass

Requires both the **Allow bypassing** access right (`BYPASS`) and the **DLP** bypass checkbox. Either alone leaves DLP active.

## Recommended entry ordering

1. IP/interface no-auth rows (specific addresses first)
2. Profile-bypass rows (e.g. BYPASS AUTHENTICATION) — before auth rows
3. LDAP Profiles — before PAM regex (group beats username pattern)
4. PAM regex and entry-credential rows
5. Profile-gated showcase rows (each has a `profiles` constraint)
6. PAM catch-all — last Allow row
7. Deny exceptions — paired with an Allow range to demonstrate revoke

## Global fields

* **Default Access Policy** — Deny recommended. Controls default when no row matches and which list is walked first.
* **Kerberos / SSO** — Enables Negotiate when keytab is present.

## Rule fields

All configured criteria on a row must match. Blank means any.

* **IP Address** — Single IP, comma list, or hyphen range. CIDR not supported. Uses XFF when present.
* **Interface** — Listen socket IP:port of the accept.
* **System authentication** — Cache → PAM → LDAP bind; User name is a regex filter; Password ignored.
* **User name / Password** — With System auth off: exact case-sensitive match. Non-empty User name still triggers challenge on first pass.
* **LDAP Profiles** — Exact match against the connection's LDAP distinguished name; write DNs with spaces not commas.
* **Access** — CONFIG, PROXY, HTTP, TRANSPARENT, CONNECT, BYPASS — independent rights.
* **MAX Concurrent Connections** — Keyed `username@client-ip`; 0 = no cap.

## Examples

<Tip>
  ### Localhost Web UI and proxy

  **Config:** IP `127.0.0.1`, Access CONFIG,PROXY,HTTP,TRANSPARENT,CONNECT, pamauth off, no username.

  **Result:** Immediate match; User-Group LOCALHOST. Beware XFF spoofing on untrusted networks.
</Tip>

<Tip>
  ### Hyphen IP range without auth

  **Config:** IP `203.0.113.0-203.0.113.255` (TEST-NET-3), pamauth off.

  **Result:** Any address in range matches first pass; no challenge.
</Tip>

<Tip>
  ### LDAP group after login

  **Config:** ldap\_profiles with Sales group DN, pamauth off, above PAM catch-all.

  **Result:** First pass: ldap gate fails (empty dn), challenge from PAM row. Second pass: group match grants LDAP\_SALES; password not rechecked unless pamauth=TRUE.
</Tip>

<Tip>
  ### DLP bypass

  **Config:** Access BYPASS + bypass DLP checkbox + profiles constraint.

  **Result:** DLP skipped. Missing either condition — DLP still runs.
</Tip>

<Tip>
  ### Deny exception

  **Config:** Allow range 203.0.113.0–255 + Deny 203.0.113.50; policy Deny.

  **Result:** Allow matches, then Deny revokes. Deny row rights/groups not applied.
</Tip>

## How to verify

1. Test from a known client IP without spoofed XFF (unless testing that path).
2. **Reports → Detailed logs** — username, IP, access filter.
3. Enable **Trace Entry** on one row; check native logs.
4. SECURITY log family for authentication outcomes.


## Related topics

- [Access Restriction](/use_cases/access_restriction/access_restriction.md)
- [Working of Default Entries in Access Restrictions](/use_cases/access_restriction/working_of_default_entries_in_access_restrictions.md)
- [Access Profiles](/admin_guide/policies_and_profiles/access_profiles.md)
- [Access the Interface](/getting_started/access_the_interface.md)
- [Interface Access Denied](/troubleshooting/interface_access_denied.md)