<font size=2 face="sans-serif">Thanks Amos, for reply;</font>
<br><font size=2 face="sans-serif">My squid and AD kerberos authentication
working as expected. users are getting authenticated and able to access
internet via proxy. access logs also capturing user account details.</font>
<br>
<br><font size=2 face="sans-serif">now I need to restrict user access based
on AD group membership. </font>
<br>
<br>
<br><font size=2 face="sans-serif">Thanks & Regards<br>
Nilesh Suresh Gavali<br>
</font>
<br>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">squid-users-request@lists.squid-cache.org</font>
<br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">squid-users@lists.squid-cache.org</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">15/06/2016 18:27</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">squid-users
Digest, Vol 22, Issue 70</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Sent by:
</font><font size=1 face="sans-serif">"squid-users"
<squid-users-bounces@lists.squid-cache.org></font>
<br>
<hr noshade>
<br>
<br>
<br><tt><font size=2>Send squid-users mailing list submissions to<br>
squid-users@lists.squid-cache.org<br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
</font></tt><a href="http://lists.squid-cache.org/listinfo/squid-users"><tt><font size=2>http://lists.squid-cache.org/listinfo/squid-users</font></tt></a><tt><font size=2><br>
or, via email, send a message with subject or body 'help' to<br>
squid-users-request@lists.squid-cache.org<br>
<br>
You can reach the person managing the list at<br>
squid-users-owner@lists.squid-cache.org<br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of squid-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: HTTPS issues with squidguard after upgrading from squid<br>
2.7 to 3.5 (Marcus Kool)<br>
2. URL access based on AD group membership (nilesh.gavali@tcs.com)<br>
3. Re: URL access based on AD group membership (Amos Jeffries)<br>
4. Re: Queue incoming requests when fetching from origin<br>
(Alex Rousskov)<br>
5. Re: URL access based on AD group membership<br>
(Bruno de Paula Larini)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Wed, 15 Jun 2016 09:37:40 -0300<br>
From: Marcus Kool <marcus.kool@urlfilterdb.com><br>
To: reqman <reqman@freemail.gr><br>
Cc: squid-users@lists.squid-cache.org<br>
Subject: Re: [squid-users] HTTPS issues with squidguard after<br>
upgrading from squid 2.7 to 3.5<br>
Message-ID: <57614C14.4010002@urlfilterdb.com><br>
Content-Type: text/plain; charset=utf-8; format=flowed<br>
<br>
<br>
<br>
On 06/15/2016 08:24 AM, reqman wrote:<br>
<br>
> I have been using squidGuard for 10+ years. Not the best one could<br>
> have, but I am accustomed to its use and idiosyncrasies. Furthermore,<br>
> it is package well supported on FreeBSD.<br>
><br>
> You are mentioning ufdbGuard. Are its lists free for government use?<br>
> If not, then I can not use it, since we have very strict purchasing<br>
> requirements, even if it costs $1. And of course, I would have to
go<br>
> through evaluation, the usual learning curve etc.<br>
<br>
ufdbGard is free software.<br>
You can use it with any database you desire... the free ones, your
own or<br>
a commercial one.<br>
<br>
There is little learning curve since it is a fork of squidguard and there<br>
is a Reference Manual and email support from URLfilterDB, even for those<br>
who use a free database.<br>
<br>
Marcus<br>
<br>
<br>
> Don't get me wrong here, I'm not saying no. I'm just saying that even<br>
> though it seems to be easy to say "yes", reality is much
different.<br>
><br>
> M.-<br>
<br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Wed, 15 Jun 2016 14:50:38 +0100<br>
From: nilesh.gavali@tcs.com<br>
To: squid-users@lists.squid-cache.org<br>
Subject: [squid-users] URL access based on AD group membership<br>
Message-ID:<br>
<OF29EE7DFD.2BD1A317-ON80257FD3.004390E8-80257FD3.004C0BDD@tcs.com><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Hi Team;<br>
I have setup as below-<br>
Squid Kerberos authentication with windows AD 2012r2. - works fine.<br>
Now need to restrict access based on AD Group membership.<br>
<br>
Below configuration done but no luck. when try to access with user who
is <br>
not part of the group mention, still he is able to browse Internet.<br>
<br>
================================<br>
#<br>
# Recommended minimum configuration:<br>
#<br>
<br>
#auth_param negotiate program /usr/lib64/squid/squid_kerb_auth -d -s <br>
GSS_C_NO_NAME<br>
auth_param negotiate program /usr/lib64/squid/squid_kerb_auth -s <br>
HTTP/proxy02.abcd.co.uk@abcd.co.uk -d<br>
auth_param negotiate children 10<br>
auth_param negotiate keep_alive on<br>
auth_param basic credentialsttl 2 hours<br>
acl ad_auth proxy_auth REQUIRED<br>
<br>
external_acl_type Domain_Admin %LOGIN /usr/lib64/squid/squid_ldap_group
-b <br>
"dc=abcd,dc=co,dc=uk" -D "cn=Nilesh Gavali,ou=Admin User,ou=TCS
<br>
Users,ou=Staff,dc=abcd,dc=co,dc=uk" -w "123456" -f <br>
"(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=lgInternetAccess,ou=Internet
<br>
Access,ou=Groups,dc=abcd,dc=co,dc=uk))" -h xx.xx.2.101<br>
acl AllowDomainAdmin external Domain_Admin lgInternetAccess<br>
<br>
acl manager proto cache_object<br>
acl localhost src 127.0.0.1/32 ::1<br>
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1<br>
<br>
# Example rule allowing access from your local networks.<br>
# Adapt to list your (internal) IP networks from where browsing<br>
# should be allowed<br>
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network<br>
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network<br>
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network<br>
acl localnet src fc00::/7 # RFC 4193 local private
network range<br>
acl localnet src fe80::/10 # RFC 4291 link-local (directly
plugged) <br>
machines<br>
<br>
acl SSL_ports port 443<br>
acl Safe_ports port 80 # http<br>
acl Safe_ports port 21 # ftp<br>
acl Safe_ports port 443 # https<br>
acl Safe_ports port 70 # gopher<br>
acl Safe_ports port 210 # wais<br>
acl Safe_ports port 1025-65535 # unregistered ports<br>
acl Safe_ports port 280 # http-mgmt<br>
acl Safe_ports port 488 # gss-http<br>
acl Safe_ports port 591 # filemaker<br>
acl Safe_ports port 777 # multiling http<br>
acl CONNECT method CONNECT<br>
<br>
#<br>
# Recommended minimum Access Permission configuration:<br>
#<br>
# Only allow cachemgr access from localhost<br>
http_access allow manager localhost<br>
http_access deny manager<br>
<br>
# Deny requests to certain unsafe ports<br>
http_access deny !Safe_ports<br>
<br>
# Deny CONNECT to other than secure SSL ports<br>
http_access deny CONNECT !SSL_ports<br>
<br>
<br>
# We strongly recommend the following be uncommented to protect innocent<br>
# web applications running on the proxy server who think the only<br>
# one who can access services on "localhost" is a local user<br>
#http_access deny to_localhost<br>
<br>
#<br>
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS<br>
#<br>
#<br>
# Example rule allowing access from your local networks.<br>
# Adapt localnet in the ACL section to list your (internal) IP networks<br>
# from where browsing should be allowed<br>
#http_access allow localnet<br>
#http_access allow localhost<br>
http_access deny !ad_auth<br>
http_access allow ad_auth<br>
http_access deny !AllowDomainAdmin<br>
http_access allow AllowDomainAdmin<br>
<br>
# And finally deny all other access to this proxy<br>
http_access deny all<br>
<br>
# Squid normally listens to port 3128<br>
http_port 8080<br>
never_direct allow all<br>
<br>
cache_peer xx.xx.2.108 parent 8080 0 default<br>
dns_nameservers xx.xx.2.108<br>
<br>
# We recommend you to use at least the following line.<br>
#hierarchy_stoplist cgi-bin ?<br>
<br>
# Uncomment and adjust the following to add a disk cache directory.<br>
cache_dir ufs /var/spool/squid 2048 16 256<br>
<br>
# Leave coredumps in the first cache dir<br>
coredump_dir /var/spool/squid<br>
<br>
# Log forwarding to SysLog<br>
access_log syslog:local1.info<br>
<br>
# Add any of your own refresh_pattern entries above these.<br>
refresh_pattern ^ftp: 1440 20%
10080<br>
refresh_pattern ^gopher: 1440 0%
1440<br>
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>
refresh_pattern . 0
20% 4320<br>
=================================================<br>
<br>
<br>
<br>
Thanks & Regards<br>
Nilesh Suresh Gavali<br>
=====-----=====-----=====<br>
Notice: The information contained in this e-mail<br>
message and/or attachments to it may contain <br>
confidential or privileged information. If you are <br>
not the intended recipient, any dissemination, use, <br>
review, distribution, printing or copying of the <br>
information contained in this e-mail message <br>
and/or attachments to it are strictly prohibited. If <br>
you have received this communication in error, <br>
please notify us by reply e-mail or telephone and <br>
immediately and permanently delete the message <br>
and any attachments. Thank you<br>
<br>
<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <</font></tt><a href="http://lists.squid-cache.org/pipermail/squid-users/attachments/20160615/a91ac994/attachment-0001.html"><tt><font size=2>http://lists.squid-cache.org/pipermail/squid-users/attachments/20160615/a91ac994/attachment-0001.html</font></tt></a><tt><font size=2>><br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Thu, 16 Jun 2016 02:21:54 +1200<br>
From: Amos Jeffries <squid3@treenet.co.nz><br>
To: squid-users@lists.squid-cache.org<br>
Subject: Re: [squid-users] URL access based on AD group membership<br>
Message-ID: <f7557bf2-bae0-e661-8368-6f4497454c89@treenet.co.nz><br>
Content-Type: text/plain; charset=utf-8<br>
<br>
On 16/06/2016 1:50 a.m., nilesh.gavali wrote:<br>
> Hi Team;<br>
> I have setup as below-<br>
> Squid Kerberos authentication with windows AD 2012r2. - works fine.<br>
> Now need to restrict access based on AD Group membership.<br>
> <br>
> Below configuration done but no luck. when try to access with user
who is <br>
> not part of the group mention, still he is able to browse Internet.<br>
> <br>
<br>
This is because:<br>
<br>
<snip><br>
Step 0) check the basic security rules that deny bad behaviour.<br>
<br>
><br>
> http_access deny !ad_auth<br>
<br>
Step 1) deny with a "require authentication" message if there
are no<br>
valid credentials sent.<br>
<br>
> http_access allow ad_auth<br>
<br>
Step 2) allow anyone who has valid credentials to use the proxy.<br>
<br>
... Uh, Stop.<br>
<br>
Users either sent valid credentials [2 happened] or they did not [1<br>
happened]. There are no other possibilities.<br>
<br>
<br>
> http_access deny !AllowDomainAdmin<br>
> http_access allow AllowDomainAdmin<br>
> <br>
<br>
As explained in the FAQ<br>
<</font></tt><a href="http://wiki.squid-cache.org/SquidFaq/SquidAcl#Access_Lists"><tt><font size=2>http://wiki.squid-cache.org/SquidFaq/SquidAcl#Access_Lists</font></tt></a><tt><font size=2>><br>
<br>
Amos<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Wed, 15 Jun 2016 09:19:52 -0600<br>
From: Alex Rousskov <rousskov@measurement-factory.com><br>
To: Jaap Dam <jaap.dam@gmail.com>, Amos Jeffries<br>
<squid3@treenet.co.nz><br>
Cc: squid-users@lists.squid-cache.org<br>
Subject: Re: [squid-users] Queue incoming requests when fetching from<br>
origin<br>
Message-ID: <57617218.5050802@measurement-factory.com><br>
Content-Type: text/plain; charset=utf-8<br>
<br>
On 06/14/2016 02:51 AM, Jaap Dam wrote:<br>
<br>
> I've part of the logging as an attachment. I'm requesting a single
URL<br>
> in this log. The log starts with a stale cache of the item. <br>
<br>
Collapsed forwarding does not apply to cache revalidation requests yet.<br>
Factory is working on implementing collapsed revalidations (in some<br>
environments), but I cannot promise a specific delivery date or that<br>
your particular environment will be covered.<br>
<br>
Alex.<br>
<br>
<br>
<br>
<br>
> 2016-06-13 15:34 GMT+02:00 Amos Jeffries:<br>
> <br>
> On 14/06/2016 12:29 a.m., Jaap Dam wrote:<br>
> > Is the collapsed_forwarding directive the correct
one to use for my<br>
> > use-case or am i missing something?<br>
> <br>
> Yes it is correct so far as I am understanding your
need.<br>
> <br>
> For further debugging about what is going on you will
need the HTTP<br>
> messages involved. Add the directive "debug_options
11,2 20,3" to your<br>
> config to get them logged in cache.log.<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 5<br>
Date: Wed, 15 Jun 2016 14:27:14 -0300<br>
From: Bruno de Paula Larini <bruno.larini@riosoft.com.br><br>
To: squid-users@lists.squid-cache.org<br>
Subject: Re: [squid-users] URL access based on AD group membership<br>
Message-ID: <eb67a218-c749-aa16-4b00-941bdac1d0a5@riosoft.com.br><br>
Content-Type: text/plain; charset="utf-8"; Format="flowed"<br>
<br>
Em 15/06/2016 10:50, nilesh.gavali@tcs.com escreveu:<br>
> Hi Team;<br>
> I have setup as below-<br>
><br>
> * Squid Kerberos authentication with windows AD 2012r2. - works
fine.<br>
> * Now need to restrict access based on AD Group membership.<br>
><br>
><br>
> Below configuration done but no luck. when try to access with user
who <br>
> is not part of the group mention, still he is able to browse Internet.<br>
<br>
The following works fine for me and in my opinion works better than <br>
LDAP. The authentication is integrated, so it doesn't keep asking for <br>
password (when the current user is a domain account). But you have to <br>
add the Squid server to the domain using 'smb.conf', 'krb5.conf' and <br>
then 'net ads join'. The service 'winbind' must be running too.<br>
I'm using Squid 3.5.19.<br>
<br>
<br>
auth_param ntlm program /usr/bin/ntlm_auth <br>
--helper-protocol=squid-2.5-ntlmssp --domain=MYDOMAIN <br>
--enable-external-acl-helpers="ext_wbinfo_group_acl"<br>
auth_param ntlm children 10 startup=0 idle=2<br>
<br>
external_acl_type NTGroup children-startup=10 children-idle=2
<br>
children-max=50 %LOGIN /usr/lib64/squid/ext_wbinfo_group_acl<br>
<br>
acl authenticated proxy_auth REQUIRED<br>
<br>
acl ad_group external NTGroup MYDOMAIN\AD_Group<br>
acl denied_websites dstdom_regex -i "/etc/squid/denied-websites.txt"<br>
http_access deny ad_group denied_websites<br>
<br>
<br>
So all the members of MYDOMAIN\AD_Group won't have access to whatever <br>
the file contains.<br>
<br>
Bruno<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <</font></tt><a href="http://lists.squid-cache.org/pipermail/squid-users/attachments/20160615/810a3d96/attachment.html"><tt><font size=2>http://lists.squid-cache.org/pipermail/squid-users/attachments/20160615/810a3d96/attachment.html</font></tt></a><tt><font size=2>><br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
squid-users mailing list<br>
squid-users@lists.squid-cache.org<br>
</font></tt><a href="http://lists.squid-cache.org/listinfo/squid-users"><tt><font size=2>http://lists.squid-cache.org/listinfo/squid-users</font></tt></a><tt><font size=2><br>
<br>
<br>
------------------------------<br>
<br>
End of squid-users Digest, Vol 22, Issue 70<br>
*******************************************<br>
</font></tt>
<br>