
Squidtaild readme 2.1 Alpha 6 (Perlized)

	1) What is squidtaild
	2) How does it work
	3) How to install
	4) Additional information
	5) License agreement



1 - What is Squidtaild

Squidtaild is a Squid proxy traffic monitoring
program that gives the people managing the proxy
server the ability to closely monitor the kind
of pages his/her users should not be visiting.

Squidtaild is a very fast, highly configurable Perl
program that will dynamicly create html pages that
display the violations that people made one or more
of the filters you have applied to the squid proxy
logging system.


What is this good for?

More and more companies and schools are implementing
internet access in the networks.
What does this do for productivity?
To keep an eye on the amount of i.e porn, mp3, 
warez, etc. sites visited squidtaild is an ideal program.
It can also track down possible company/school internet
policily violators, it can warn them when they have
violated a policy as well.


2 - How does it work

First you design a set a filters the way you see fit.
There are three filters, one being the green filter
one being the yellow filter and the last being the red
filter. A filter is nothing more than a file containing
wildcards you want to be monitored in the URL's visited
by the people using the proxyserver.

An example for the filters:

filter 'possilbe' (green)
--------------------------
gambeling
girls
sexy
etc
--------------------------


filter 'probable' (yellow)
--------------------------
porn
mp3
etc
--------------------------


filter 'definite' (red)
--------------------------
hackingtools
etc
--------------------------

With these filters (being really strange in the
example) squidtaild will filter out all new entry's
in the access.log file (generated by Squid) and
generate a nice html file as soon as a match is found.

Squidtaild will generate a main page displaying
the total amount of hits with each filter.
You can click on this number and view all hits.

It will display the last violation on each filter

And it will also generate a list of all violators,
these are all seperate pags that carry the name of
the ip address by the violator and it's violation.

Each violation is a hyperlink so you can easaly
verify if a violation is indeed a violation.

Requirements are:

        Squid proxy server with logging enabled
	http server of somekind to display pages

Optional is:
	
	Samba client for sending messages
	email address to send violations to
	Sending us gratitude for the software


3 - How to install

Installing Squidtaild can be done in two way's

	1 - Using the 'install' script
	2 - By hand

The install script is very simple but should do the trick.
We haven't heard any problems with it lately so it's
probably safe.

When installing by hand do the following
The first thing to do is install the Perl modules
needed for Squidtaild to work correctly.
It's highly unlikely you allready have these installed
on your system. so enter the 'perl-modules' directory
and from there entry each directory seperatly and install
the modules.

After you have installed the perl modules
it's time to install squidtaild, since it's a perl
program there is no compiling to be done.
Just enter the 'sbin' directory and copy the 'squidtaild'
file to '/usr/sbin' or wherever you like having your
executables.


The last thing to do is make a directory called 'squidtaild'
in your '/etc/' directory and copy the ENTIRE contense of the
'config' directory into '/etc/squidtaild/' (including the 
subdirectory 'config/squdtaild/filters')

After this is done the configuration file needs to be set.
open '/etc/squidtaild/squidtaild.conf' in your favorite
editor and adjust the settings to your liking.
   (happens automaticly when using the install script)


4 - Additional Information

Squidtaild has more options such as:

	- Mailing matches that occur
	- Sending sambaclient messages to the violator
	     (Samba req. and configured correctly)
	- Sending sambaclient message to the administrator
	     (Samba req. and configured correctly)
	- A exclude filter for suppressing hits on
             certain sites
	- Incremental check is optional

Configuration file options:

            * HTML of plain ACSI mail reporting
                mailstyle text   (this will send mail in asci mode)
                mailstyle html   (this will send mail in HTML mode)
            * truncate_url & urllenght
                 These options are used to specify the lenght of the url
                 shown
            * status_refresh
                 allows the user to specify the time (in secondes) between
                 page refresh
            * dns_lookups
                 makes squidtaild display hostname (if found by dns
                 lookup) instead of ip adress 

The init.d scripts are writen for Redhat/Mandrake type systems, it may
result in minor problems shutting down the program on other systems.

For questions, comments or bug reports send an email to

	squidtaild@usa.net
