<font size=2 face="sans-serif">Hi Amos;</font>
<br><font size=2 face="sans-serif">Ok, we can discussed the issue in Two
part 1. For Windows AD Authentication & SSO and 2. Linux server
unable to access via squid proxy.</font>
<br>
<br><font size=2 face="sans-serif">For First point-</font>
<br><font size=2 face="sans-serif">Requirement to have SSO for accessing
internet via squid proxy and based on user's AD group membership allow
access to specific sites only. I believe current configuration of squid
is working as expected.</font>
<br>
<br><font size=2 face="sans-serif">For Second point -</font>
<br><font size=2 face="sans-serif">Point I would like to highlight here
is, the Linux server </font><tt><font size=2>IWCCP01</font></tt><font size=2 face="sans-serif">
is not part of domain at all. Hence the below error as squid configured
for AD_auth. So how can we allow Linux server or non domain machine to
access specific sites?</font>
<br>
<br><tt><font size=2>> Error 407 is "proxy auth required",
so the proxy is expecting authentication <br>
> for some reason.</font></tt>
<br><font size=2 face="sans-serif">====================================</font>
<br><font size=2 face="sans-serif"> </font><tt><font size=2>> Can
you confirm that the hostname vseries-test.bottomline.com is contained
in <br>
> your site file /etc/squid/sitelist/dbs_allowed_site ?</font></tt>
<br><tt><font size=2><br>
YES, we have entry as .bottomline.com , which work fine when access via
windows machine having proxy enabled for that user.</font></tt>
<br><tt><font size=2>==============================<br>
> Can you temporarily change the line "http_access allow IWCCP01
allowedsite" to <br>
> "http_access allow IWCCP01" and see whether the machine
then gets access?<br>
</font></tt>
<br><tt><font size=2> I will test this, and update the results.<br>
========================================<br>
If that works, please list the output of the command:<br>
grep "bottomline.com" /etc/squid/sitelist/dbs_allowed_site</font></tt>
<br>
<br><tt><font size=2>o/p of above command as below -</font></tt>
<br>
<br><tt><font size=2>[root@Proxy02 ~]# grep "bottomline.com"
/etc/squid/sitelist/dbs_allowed_site</font></tt>
<br><tt><font size=2>.bottomline.com</font></tt>
<br><tt><font size=2>[root@Proxy02 ~]#</font></tt>
<br>
<br><tt><font size=2>=======================================</font></tt>
<br>
<br><font size=2 face="sans-serif">Thanks & Regards<br>
Nilesh Suresh Gavali<br>
</font>
<br>
<br>
<br>
<br><tt><font size=2> <br>
Message: 2<br>
Date: Wed, 5 Oct 2016 00:11:08 +1300<br>
From: Amos Jeffries <squid3@treenet.co.nz><br>
To: squid-users@lists.squid-cache.org<br>
Subject: Re: [squid-users] Squid - AD kerberos auth and Linux Server<br>
proxy access not working<br>
Message-ID: <d35ad0ca-761d-60e3-c594-04697110afdc@treenet.co.nz><br>
Content-Type: text/plain; charset=utf-8<br>
<br>
On 4/10/2016 11:36 p.m., Antony Stone wrote:<br>
> On Tuesday 04 October 2016 at 12:28:44, Nilesh Gavali wrote:<br>
> <br>
>> Hello Antony;<br>
>> I have double checked the current working configuration of my
squid.conf<br>
>> and it has same settings which I posted earlier. somehow it is
working for<br>
>> us.<br>
> <br>
> I'm not saying the whole thing won't work; I'm saying there is no
point in <br>
> having a line "http_access allow ad_auth" following the
line "http_access deny <br>
> all". The ad_auth line can never be invoked.<br>
<br>
Not knowing why authentication works is dangerous. You might have been<br>
allowing non-authenticated traffic and invalid user accounts through.<br>
<br>
The only reason it does "work" is that the ACL called "USERS"
is _not_<br>
actually checking user logins. It is a group checking ACL which requires<br>
authentication to happen before it can be checked.<br>
<br>
In this specific case invalid logins cannot be a member of the group. So<br>
they will not get through the proxy.<br>
<br>
However, people who accidentally type the user/password wrong, or whose<br>
machines automatically login with an account not a member of the group<br>
will not be allowed any way to try again short of shutting down their<br>
browser or maybe even logging out of the machine and trying from another<br>
one.<br>
<br>
That may or may not be a problem for you.<br>
<br>
> <br>
>> below is the error from access.log file.<br>
>><br>
>> 1475518342.279 0 10.xx.15.103 TCP_DENIED/407
3589 CONNECT<br>
>> vseries-test.bottomline.com:443 - NONE/- text/html<br>
> <br>
> Error 407 is "proxy auth required", so the proxy is expecting
authentication <br>
> for some reason.<br>
> <br>
> Can you confirm that the hostname vseries-test.bottomline.com is contained
in <br>
> your site file /etc/squid/sitelist/dbs_allowed_site ?<br>
> <br>
> Can you temporarily change the line "http_access allow IWCCP01
allowedsite" to <br>
> "http_access allow IWCCP01" and see whether the machine
then gets access?<br>
> <br>
<br>
If that works, please list the output of the command:<br>
grep "bottomline.com" /etc/squid/sitelist/dbs_allowed_site<br>
<br>
Amos<br>
<br>
*******************************************<br>
</font></tt>
<br><p>=====-----=====-----=====<br>
Notice: The information contained in this e-mail<br>
message and/or attachments to it may contain <br>
confidential or privileged information. If you are <br>
not the intended recipient, any dissemination, use, <br>
review, distribution, printing or copying of the <br>
information contained in this e-mail message <br>
and/or attachments to it are strictly prohibited. If <br>
you have received this communication in error, <br>
please notify us by reply e-mail or telephone and <br>
immediately and permanently delete the message <br>
and any attachments. Thank you</p>
<p></p>