<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40"
xmlns:ns0="http://schemas.microsoft.com/office/2004/12/omml">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<style>
<!--a:link
{mso-style-priority:99;}
span.MSOHYPERLINK
{mso-style-priority:99;}
a:visited
{mso-style-priority:99;}
span.MSOHYPERLINKFOLLOWED
{mso-style-priority:99;}
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:Calibri;}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:#954F72;
text-decoration:underline;}
span.E-mailStijl17
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=NL link=blue vlink="#954F72">
<div class=Section1>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>What Amos is saying and : <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Try. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Remove this line from krb5.conf<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> default_keytab_name =
/etc/squid3/PROXY.keytab<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>and add/create: <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>/etc/default/squid<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>KRB5_KTNAME=/etc/squid3/PROXY.keytab<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>export KRB5_KTNAME<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>chown root:proxy /etc/squid3/PROXY.keytab<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>chmod 440 /etc/squid3/PROXY.keytab<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Greetz, <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Louis<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt'>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt;font-family:"Times New Roman"'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>Van:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> squid-users
[mailto:squid-users-bounces@lists.squid-cache.org] <b><span style='font-weight:
bold'>Namens </span></b>Alessandro Sironi<br>
<b><span style='font-weight:bold'>Verzonden:</span></b> maandag 1 februari 2016
11:40<br>
<b><span style='font-weight:bold'>Aan:</span></b>
squid-users@lists.squid-cache.org<br>
<b><span style='font-weight:bold'>Onderwerp:</span></b> [squid-users]
ext_ldap_group_acl not working</span></font><font size=3 face="Times New Roman"><span
style='font-size:12.0pt;font-family:"Times New Roman"'><o:p></o:p></span></font></p>
</div>
<p class=MsoNormal><font size=2 face=Calibri><span style='font-size:11.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'>Hello everyone <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'>I'm a newbie regarding SQUID and in general on Linux. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'>I have an Active Directory environment (Windows Server 2012 R2) and a
Linux Debian 8 Jessie configured in the same network. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'>My goal is to install SQUID on Debian, integrate with Active Directory
using Kerberos and autohise users to use SQUID based on Active Directory
asecurity group membership lookup. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'>Long story short, I followed the instructions here <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'>http://wiki.bitbinary.com/index.php/Active_Directory_Integrated_Squid_Proxy#Configure_Squid<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><b><font size=2 face=Calibri><span lang=EN-US
style='font-size:11.0pt;font-weight:bold'>My test environment:<o:p></o:p></span></font></b></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'>Active Directory domain: KIDANEMEHRET.LOCAL <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'>test user: KIDANEMEHRET\test-full <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'>Security groups which is member of: "Internet Users Full",
"Internet Users Standard" <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><b><font size=2 face=Calibri><span lang=EN-US
style='font-size:11.0pt;font-weight:bold'>Test done<o:p></o:p></span></font></b></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'>After having properly configured my test client (Windows 7 joined
to the domain), logged on with the test user KIDANEMEHRET\test-full, configured
internet explorer to use the proxy, what I get everytime I try to browse the
internet is a SQUID page telling me Access Denied. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><b><font size=2 face=Calibri><span lang=EN-US
style='font-size:11.0pt;font-weight:bold'>Quick Analisys<o:p></o:p></span></font></b></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'>Having a look at access.log and cache.log (see attached), I understand
that user is properly authenticated (I see KIDANEMEHRET\test-full properly
written in each log). <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'>For this reason I suspect the problem is in the authorisation part. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'>I try then to run from terminal the program used in SQUID.CONF to check
authorisation (based on the wiki too); note that I'm running with sudo
otherwise with standard use I get no access to password file: <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'>sudo /usr/lib/squid3/ext_ldap_group_acl -R -K -S -b
"dc=kidanemehret,dc=local" -D squid@kidanemehret.local -W
/etc/squid3/ldappass.txt -f "(&(objectclass=person)(sAMAccountName=%v)
(memberof=cn=%g,ou=Service Accounts,ou=USR,dc=kidanemehret,dc=local))" -h
domcon.kidanemehret.local test-full Internet%20Users%20Full <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'>Do not get any result: waiting for minutes... <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'>Try to use KIDANEMEHRET\test-full instead of test-full without success.
<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'>Most likely the problem is here. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'>Do you have any suggestion on how to proceed next? <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=IT style='font-size:
11.0pt'>Here you can find ACCESS.LOG, CACHE.LOG, KRB5.CONF and SQUID.CONF<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=IT style='font-size:
11.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Calibri><span lang=EN-US style='font-size:
11.0pt'><a href="http://1drv.ms/1nHDRXH"><b><font color=red><span
style='color:red;font-weight:bold'>MailScanner has detected definite fraud in
the website at "1drv.ms". Do <i><span style='font-style:italic'>not</span></i>
trust this website:</span></font></b> <font size=3 face="Times New Roman"><span
style='font-size:12.0pt;font-family:"Times New Roman"'>http://1drv.ms/1nHDRXH</span></font></a></span></font><font
size=3 face="Times New Roman"><span lang=EN-US style='font-size:12.0pt;
font-family:"Times New Roman"'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt;font-family:"Times New Roman"'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=IT
style='font-size:12.0pt;font-family:"Times New Roman"'>Thanks in advance</span></font><font
size=3 face="Times New Roman"><span lang=EN-US style='font-size:12.0pt;
font-family:"Times New Roman"'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt;font-family:"Times New Roman"'><o:p> </o:p></span></font></p>
</div>
</div>
</body>
</html>