<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000'><font face="arial, helvetica, sans-serif"><span style="font-size: 10pt;">Ugh, I am trying to get Squid to deny access to a particular AD group, but when I enable the rule, then it denys everyone.</span></font><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">This is what I have in squid.conf</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div><div><div><font face="arial, helvetica, sans-serif"><span style="font-size: 13.3333px;"># NTLM</span></font></div></div><div><div><font face="arial, helvetica, sans-serif"><span style="font-size: 13.3333px;">auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp</span></font></div></div><div><div><font face="arial, helvetica, sans-serif"><span style="font-size: 13.3333px;">auth_param ntlm children 15</span></font></div></div><div><div><font face="arial, helvetica, sans-serif"><span style="font-size: 13.3333px;">auth_param ntlm keep_alive on</span></font></div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div><div><div><font face="arial, helvetica, sans-serif"><span style="font-size: 13.3333px;"># Limit access for Factory users</span></font></div></div><div><div><font face="arial, helvetica, sans-serif"><span style="font-size: 13.3333px;">external_acl_type nt_group %LOGIN /usr/lib64/squid/ext_wbinfo_group_acl</span></font></div></div><div><div><font face="arial, helvetica, sans-serif"><span style="font-size: 13.3333px;">acl FactoryDeny external nt_group sec_deny_internet</span></font></div></div><div><div><font face="arial, helvetica, sans-serif"><span style="font-size: 13.3333px;">http_access deny FactoryDeny</span></font></div></div><div><div><br></div></div><div><div><font face="arial, helvetica, sans-serif"><span style="font-size: 13.3333px;">acl auth proxy_auth REQUIRED</span></font></div></div><div><div><font face="arial, helvetica, sans-serif"><span style="font-size: 13.3333px;">http_access deny !auth</span></font></div></div><div><div><font face="arial, helvetica, sans-serif"><span style="font-size: 13.3333px;">http_access allow auth</span></font></div></div></blockquote></div><div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">-=-</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">I have verified the ext_wbinfo_group_acl works:</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div style="font-size: 10pt;">[root@fac-proxy squid]# ./ext_wbinfo_group_acl -d</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div style="font-size: 10pt;">Debugging mode ON.</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div style="font-size: 10pt;">user sec_vpn_users</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div style="font-size: 10pt;">Got user sec_vpn_users from squid</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div style="font-size: 10pt;">User: -user-</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div style="font-size: 10pt;">Group: -sec_vpn_users-</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div style="font-size: 10pt;">SID: -S-1-5-21-1978138449-291607360-3720246513-19354-</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div style="font-size: 10pt;">GID: -1677721-</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div style="font-size: 10pt;">Sending OK to squid</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div style="font-size: 10pt;">OK</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div style="font-size: 10pt;">user sec_deny_internet</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div style="font-size: 10pt;">Got user sec_deny_internet from squid</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div style="font-size: 10pt;">User: -user-</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div style="font-size: 10pt;">Group: -sec_deny_internet-</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div style="font-size: 10pt;">SID: -S-1-5-21-1978138449-291607360-3720246513-18148-</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div style="font-size: 10pt;">GID: -1677721-</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div style="font-size: 10pt;">Sending ERR to squid</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><div style="font-size: 10pt;">ERR</div></div></blockquote><div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">Because this is a production server there's a bunch of traffic on it so I can't catch too much of the log, but this is what I can see with debugging turned on:</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div><div><font face="arial, helvetica, sans-serif"><span style="font-size: 13.3333px;">2016/09/13 23:22:32.552 kid1| Acl.cc(336) matches: ACLList::matches: checking FactoryDeny</span></font></div></div></div><div><div><div><font face="arial, helvetica, sans-serif"><span style="font-size: 13.3333px;">2016/09/13 23:22:32.552 kid1| Acl.cc(319) checklistMatches: ACL::checklistMatches: checking 'FactoryDeny'</span></font></div></div></div><div><div><div><font face="arial, helvetica, sans-serif"><span style="font-size: 13.3333px;">2016/09/13 23:22:32.552 kid1| Acl.cc(321) checklistMatches: ACL::ChecklistMatches: result for 'FactoryDeny' is -1</span></font></div></div></div><div><div><div><font face="arial, helvetica, sans-serif"><span style="font-size: 13.3333px;">2016/09/13 23:22:32.552 kid1| Acl.cc(343) matches: FactoryDeny failed.</span></font></div></div></div><div><div><div><font face="arial, helvetica, sans-serif"><span style="font-size: 13.3333px;">2016/09/13 23:22:32.552 kid1| Acl.cc(354) matches: FactoryDeny result is false</span></font></div></div></div></blockquote><div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">If the result is false then the deny should be false and it should continue to the next rule, right?</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;">Please help, I don't get it...</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 10pt;"><br></div></div></div></body></html>