ext_session_acl(8)

📦
version 7.7 · 7 versions
, in arch rolling, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, ubuntu resolute, ubuntu stonking

💖 ext_session_acl — bestie's guide to Squid session tracking 💖

okay so first of all, hi, welcome, this is ext_session_acl from the System Manager's Manual, and it's the Squid session tracking external acl helper. Version 1.2. she's little, she's mighty, she keeps track of your sessions. periodt.

✨ SYNOPSIS ✨

ext_session_acl [-t timeout ] [-b database ] [-a]

that's it. that's the whole vibe. four-ish little things and she's off. 🦋

🌸 DESCRIPTION 🌸

so what does she actually do. ext_session_acl maintains a concept of sessions by monitoring requests and timing out sessions. yes, she's literally the girl keeping the receipts on who's still logged in and who's ghosted. 💅

the timeout is based on either:

  • idle use — that's the -t flag
  • a fixed period of time — that's the -T flag

the former (idle) is suitable for displaying terms and conditions to a user. the latter (fixed) is suitable for the display of advertisements or other notices — both of them as a splash page, see the config examples in the wiki online. 👑

and like, she can also be used to force users to re-authenticate if %LOGIN and -a are both used. main character energy fr fr.

💅 OPTIONS 💅

  • -t timeout — idle timeout for any session. the default if not specified is set to 3600 seconds. so an hour, she's generous like that. ⭐
  • -T timeout — fixed timeout for any session. this will end the session after the timeout regardless of a user's activity — she does not care what you're doing, time is up bestie. 😭 if used with active mode, this will terminate the user's session after timeout, after which another LOGIN will be required. LOGOUT will reset the session and timeout. (so log out properly, ok?)
  • -b path — path to persistent database. here's the tea on how this works:
    • if a file is specified, then that single file is used as the database.
    • if a path is specified, a Berkeley DB database environment is created within the directory. the advantage of the latter is better database support between multiple instances of the session helper.
⚠️ using multiple instances of the session helper with a single database file will cause synchronization problems between processes. do not do this. it's giving chaos. 💀

if this option is not specified, the session details will be kept in memory only and all sessions will reset each time Squid restarts its helpers (Squid restart or rotation of logs). so, like, poof. gone. 🫶

  • -a — active mode. in this mode sessions are started by evaluating an acl with the argument LOGIN, or terminated by the argument LOGOUT. without this flag the helper automatically starts the session after the first request. she's proactive like that ✨

🎀 CONFIGURATION 🎀

the ext_session_acl helper is a concurrent helper — therefore the concurrency= option must be specified in the configuration. non-negotiable. no cap. 🚨

🌈 Passive session configuration example using the default automatic mode

external_acl_type session ttl=300 negative_ttl=0 children=1
concurrency=200 %LOGIN /usr/local/squid/libexec/ext_session_acl
acl session external session
http_access deny !session
deny_info http://your.server.example.com/bannerpage?url=%s
session

then set up http://your.server.example.com/bannerpage to display a session startup page and then redirect the user back to the requested URL given in the url query parameter. slay, that's the whole flow. 🧚

👑 AUTHOR 👑

this program and documentation was written by:

  • Henrik Nordstrom <henrik@henriknordstrom.net>
  • Andrew Beverley <andy@andybev.com>

icons, honestly. 💜

 * Copyright (C) 1996-2026 The Squid Software Foundation and
contributors
 *
 * Squid software is distributed under GPLv2+ license and includes
 * contributions from numerous individuals and organizations.
 * Please see the COPYING and CONTRIBUTORS files for details.

this program and documentation is copyright to the authors named above.

distributed under the GNU General Public License (GNU GPL) version 2 or later (GPLv2+).

💌 QUESTIONS 💌

questions on the usage of this program can be sent to the Squid Users mailing list <squid-users@lists.squid-cache.org> — they're nice, go ask. 🫶

🐛 REPORTING BUGS 🐛

bug reports need to be made in English. see https://wiki.squid-cache.org/SquidFaq/BugReporting for details of what you need to include with your bug report.

  • report bugs or bug fixes using https://bugs.squid-cache.org/
  • report serious security bugs to Squid Bugs <squid-bugs@lists.squid-cache.org>
  • report ideas for new improvements to the Squid Developers mailing list <squid-dev@lists.squid-cache.org>
💀 security bugs go to the security address, not the general one. don't mix those up bestie, that's important.

🌟 SEE ALSO 🌟

and that's the page!! this one is dated 9 October 2011, it comes out of the System Manager's Manual, and it lives at ext_session_acl(8). ok bye love u, go configure your splash pages responsibly 💖✨🎀🦋

📦 where this page comes from