<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
-----BEGIN PGP SIGNED MESSAGE----- <br>
Hash: SHA256 <br>
<br>
Logs from AD, man.<br>
<br>
<br>
25.04.16 20:33, Hack Ensolo пишет:<br>
<span style="white-space: pre;">> Hi,<br>
> I try to authenticate a user in AD (windows server 2008 R2).<br>
> When he is in a group Webusers he must authenticated and when
I remove the user of this group, he must not authenticated.<br>
> And this process doesn't work because he is always
authticated.<br>
><br>
> Sorry for my english.<br>
><br>
> I post the squid configuration...<br>
> I don't post the logs because I 'm not errors.<br>
><br>
> cache_mgr service.informatique@
<a class="moz-txt-link-rfc2396E" href="mailto:service.informatique@ipl.be"><mailto:service.informatique@ipl.be></a>example.com
<a class="moz-txt-link-rfc2396E" href="http://example.com"><http://example.com></a><br>
><br>
> ### Negotiate kerberos authentification <br>
> auth_param negotiate program
/usr/lib/squid3/negotiate_kerberos_auth -s
<a class="moz-txt-link-abbreviated" href="mailto:HTTP/rex.example.com@EXAMPLE.COM">HTTP/rex.example.com@EXAMPLE.COM</a>
<a class="moz-txt-link-rfc2396E" href="mailto:rex.example.com@EXAMPLE.COM"><mailto:rex.example.com@EXAMPLE.COM></a><br>
> auth_param negotiate children 20 startup=0 idle=1<br>
> auth_param negotiate keep_alive off<br>
><br>
> ### ldap authorisation<br>
> external_acl_type kerbgroup ttl=60 children-max=15
children-startup=10 ipv4 %LOGIN /usr/lib/squid3/ext_ldap_group_acl
-R -K -b ou=students,dc=server,dc=example,dc=com -D
<a class="moz-txt-link-abbreviated" href="mailto:squid@example.com">squid@example.com</a> <a class="moz-txt-link-rfc2396E" href="mailto:squid@example.com"><mailto:squid@example.com></a> -W
/etc/squid3/ldappass.txt -f
"(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=%g,ou=students,dc=server,dc=example,dc=com))"
-h dc1.server.example.com <a class="moz-txt-link-rfc2396E" href="http://dc1.server.example.com"><http://dc1.server.example.com></a><br>
><br>
> ### acl for proxy auth and ldap authorizations<br>
> acl auth proxy_auth REQUIRED<br>
> acl kerbusers external kerbgroup webusers<br>
><br>
> ### squid defaults<br>
> acl localnet src 172.17.0.0/16 <a class="moz-txt-link-rfc2396E" href="http://172.17.0.0/16"><http://172.17.0.0/16></a><br>
> acl SSL_ports port 443<br>
> acl Safe_ports port 80 # http<br>
> acl Safe_ports port 21 # ftp<br>
> acl Safe_ports port 443 # https<br>
> acl Safe_ports port 70 # gopher<br>
> acl Safe_ports port 210 # wais<br>
> acl Safe_ports port 1025-65535 # unregistered ports<br>
> acl Safe_ports port 280 # http-mgmt<br>
> acl Safe_ports port 488 # gss-http<br>
> acl Safe_ports port 591 # filemaker<br>
> acl Safe_ports port 777 # multiling http<br>
> acl CONNECT method CONNECT<br>
> http_access deny !Safe_ports<br>
> http_access deny CONNECT !SSL_ports<br>
> http_access allow localhost<br>
><br>
> ### http_access rules<br>
> http_access allow manager localhost<br>
> http_access allow auth<br>
> http_access deny !auth<br>
> http_access allow kerbusers<br>
> http_access allow localnet<br>
> http_access deny manager<br>
> http_access deny all<br>
><br>
> ### logging<br>
> access_log stdio:/var/log/squid3/access.log<br>
> cache_store_log stdio:/var/log/squid3/store.log<br>
><br>
> ### squid Debian defaults<br>
> http_port 3128<br>
> cache_effective_user proxy<br>
> cache_effective_group proxy<br>
> cache_dir ufs /cache1 20000 16 256<br>
> cache_dir ufs /cache2 20000 16 256<br>
> coredump_dir /var/spool/squid3<br>
><br>
> ### default squid rules<br>
> refresh_pattern ^ftp: 1440 20% 10080<br>
> refresh_pattern ^gopher: 1440 0% 1440<br>
> refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>
> refresh_pattern . 0 20% 4320<br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></span><br>
<br>
-----BEGIN PGP SIGNATURE-----
<br>
Version: GnuPG v2
<br>
<br>
iQEcBAEBCAAGBQJXHiwmAAoJENNXIZxhPexGErgIAMHORuxEGPdj5UKhoKAa3dDK
<br>
jp9wcb0vrgH0F2YT+vM5AdlgPqG97/7UlB/jrfbmrMOwXcz0e1mdxDlRo9vJbeJA
<br>
eC9k9u7AxqTTBCeOTMdIW11CGF8Fh8gVr5lhO6ue7YIfAzr1CzrhlWhBNxqNKxD+
<br>
LvzkSGNXdn6JCaNRTLYcSJJGKYj7pGjS/RClEnoi2LADpO66N3k4dOFYgrASRKU2
<br>
J+kn1EOLM/FkKJOUQPrKeUo8fTZ/v04ysxdI5UWqqdFj7hE1ISBJT5XzKQmQ/U0P
<br>
qmI6Y8ypL8IClEvbevi6xIacVezVJols+Cj3tS35fAxJVjiY3q4VfhkMAHRopLo=
<br>
=kg1R
<br>
-----END PGP SIGNATURE-----
<br>
<br>
</body>
</html>