[squid-users] Squid authentication issues
L.P.H. van Belle
belle at bazuin.nl
Fri Jul 31 07:01:23 UTC 2020
I use this :
You need this in smb.conf
# Added for freeradius or squid proxy support
# Obligated to set on both AD-DC and Member server.
ntlm auth = mschapv2-and-ntlmv2-only
And this or something like that, i have more working auth setups for squid,
But i use this primarly.
auth_param negotiate program /usr/lib/squid/negotiate_wrapper_auth \
--kerberos /usr/lib/squid/negotiate_kerberos_auth -k /etc/squid/HTTP.keytab \
-s HTTP/proxy1.internal.domain.tld at REALM \
--ntlm /usr/bin/ntlm_auth --helper-protocol=gss-spnego --domain=NTDOM
Still not working try/change above line to :
--ntlm /usr/bin/ntlm_auth --allow-mschapv2 --helper-protocol=gss-spnego --domain=NTDOM
But should not be needed.
And dont forget to add the HTTP spn on the member server.
net ads keytab add_update_ads HTTP/proxy1.internal.domain.tld -UAdministrator
Also, A+PTR records are a must for the proxy with kerberos auth,
And do remove from smb.conf :
> winbind enum users = yes
> winbind enum groups = yes
Or set these to no.
I use that on Debian 10 with now squid 4.12. (ssl enabled)
(since debian 8 and squid 3.x )
There are more options here, but start with above.
My setup does, in this order.
Negotiated Kerberos/NTLM auth with LDAP auth as fall back.
Beside these few small point, your setup looks great to me.
Greetz,
Louis
________________________________
Van: squid-users [mailto:squid-users-bounces at lists.squid-cache.org] Namens Marcio Demetrio Bacci
Verzonden: donderdag 30 juli 2020 19:37
Aan: Squid Users
Onderwerp: [squid-users] Squid authentication issues
Hi,
I set up Squid 4.6 on Debian 10 and I'm having problems with browser authentication on a Windows station.
I did the tests on the command line and apparently it's OK.
root at proxy:/etc/squid/acls# /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
Registered MSG_REQ_POOL_USAGE
Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[global]"
EMPRESA+mane XXXXX
NT_STATUS_OK: The operation completed successfully. (0x0)
OK
Here are my configuration files:
#/ETC/SAMBA/SMB.CONF
[global]
netbios name = PROXY
workgroup = EMPRESA
security = ADS
realm = EMPRESA.COM.BR
encrypt passwords = yes
username map = /etc/samba/user.map
log file = /var/log/samba/%m.log
log level = 3 passdb:5 auth:5
idmap config * : backend = tdb
idmap config * : range = 3000-7999
idmap config EMPRESA:backend = ad
idmap config EMPRESA:schema_mode = rfc2307
idmap config EMPRESA:range = 10000-999999
idmap config EMPRESA:unix_nss_info = yes
idmap config EMPRESA:unix_primary_group = yes
winbind refresh tickets = Yes
winbind use default domain = yes
winbind separator = +
winbind enum users = yes
winbind enum groups = yes
vfs objects = acl_xattr
map acl inherit = yes
store dos attributes = yes
template shell = /bin/bash
template homedir = /home/%U
dedicated keytab file = /etc/krb5.keytab
kerberos method = secrets and keytab
load printers = no
printing = bsd
printcap name = /dev/null
disable spoolss = yes
#ETC/NSSWITCH.CONF
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.
passwd: compat winbind
group: compat winbind
shadow: compat
gshadow: files
hosts: files dns
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis
#/ETC/KRB5.CONF
[libdefaults]
dns_lookup_realm = false
dns_lookup_kdc = true
default_realm = EMPRESA.COM.BR
#/ETC/SQUID/SQUID.CONF
http_port 3128
cache_mem 512 MB
cache_swap_low 80
cache_swap_high 90
maximum_object_size 512 MB
minimum_object_size 0 KB
maximum_object_size_in_memory 4096 KB
cache_replacement_policy heap LFUDA
memory_replacement_policy heap LFUDA
quick_abort_min -1 KB
detect_broken_pconn on
fqdncache_size 1024
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log
cache_dir aufs /var/spool/squid 600 16 256
auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
auth_param ntlm children 20 startup=0 idle=1
auth_param ntlm keep_alive on
visible_hostname "Monitoramento de Acesso à Internet"
### acls
#acl manager proto cache_object
acl localhost src MailScanner warning: numerical links are often malicious: 192.168.1.17/32 <http://192.168.1.17/32>
acl to_localhost dst MailScanner warning: numerical links are often malicious: 192.168.1.17/32 <http://192.168.1.17/32>
acl SSL_ports port 22 80 3456 443 563 587 993 2811 3001 3322 7071 8443 9191 10000 23000
acl Safe_ports port 21 # ftp
acl Safe_ports port 70 # gopher
acl Safe_ports port 80 # http
acl Safe_ports port 88 # kerberos
acl Safe_ports port 123 # ntp
acl Safe_ports port 210 # wais
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 3456 # Siafi
acl Safe_ports port 389 # ldap
acl Safe_ports port 443 # https
acl Safe_ports port 488 # gss-http
acl Safe_ports port 563 # snews
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 3001 # imprenssa nacional
acl Safe_ports port 8080 # http
acl Safe_ports port 8443 # http
acl Safe_ports port 1025-65535 # unregistered ports
acl purge method PURGE
acl CONNECT method CONNECT
# ---- Windows Update ----
acl microsoft url_regex "/etc/squid/acls/ms-update"
acl atualizacoes dstdomain microsoft.com
http_access allow microsoft
http_access allow atualizacoes
http_access allow localhost
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
acl autenticados proxy_auth REQUIRED
http_access deny !autenticados
acl sites_liberados url_regex -i "/etc/squid/acls/sites-permitidos"
http_access allow sites_liberados
acl extensoes_bloqueadas url_regex -i "/etc/squid/acls/extensoes-proibidas"
http_access deny extensoes_bloqueadas
### Bloqueia sites por URL
acl sites_bloqueados url_regex -i "/etc/squid/acls/sites-proibidos"
http_access deny sites_bloqueados
### Rede LAN #####
acl rede_usuarios src MailScanner warning: numerical links are often malicious: 192.168.0.0/24 <http://192.168.0.0/24>
### Nega acesso de quem nao esta na rede local
http_access allow rede_usuarios
acl extensoes_bloqueadas url_regex -i "/etc/squid/acls/extensoes-proibidas"
acl sites_liberados url_regex -i "/etc/squid/acls/sites-permitidos"
http_access allow sites_liberados
http_access deny extensoes_bloqueadas
http_access allow autenticados
http_access deny all
error_directory /usr/share/squid/errors/pt-br
coredump_dir /var/spool/squid
can anybody help me?
Regards,
Márcio Bacci
More information about the squid-users
mailing list