<font size=2 face="sans-serif">All;</font>
<br>
<br><font size=2 face="sans-serif">we have Squid proxy configured with
Windows SSO with Kerberos which work fine for WIndows AD users.</font>
<br><font size=2 face="sans-serif">we have new requirement where one Linux
application server need to access Internet via squid proxy, we allowed
Linux host access via ACL but getting denied access error.</font>
<br><font size=2 face="sans-serif">below is the configuration done to allow
Linux Server host IWCCP02.</font>
<br>
<br><font size=2 face="sans-serif">###################################</font>
<br><font size=2 face="sans-serif">auth_param negotiate program /usr/lib64/squid/squid_kerb_auth
-s HTTP/proxy02.cust.in@CUST.IN</font>
<br><font size=2 face="sans-serif">auth_param negotiate children 20</font>
<br><font size=2 face="sans-serif">auth_param negotiate keep_alive on</font>
<br>
<br><font size=2 face="sans-serif">acl ad_auth proxy_auth REQUIRED</font>
<br>
<br><font size=2 face="sans-serif">#### AD Group membership ####</font>
<br>
<br><font size=2 face="sans-serif">external_acl_type AD_Group ttl=300 negative_ttl=0
%LOGIN /usr/lib64/squid/squid_ldap_group -P -R -b "DC=CUST, DC=IN"
-D svcproxy -W /etc/squid/pswd/pswd -f "(&(objectclass=person)(userPrincipalName=%v)(memberof=cn=%a,ou=InternetAccess,ou=Groups,DC=CUST,
DC=IN))" -h Cust.in -s sub -v 3</font>
<br><font size=2 face="sans-serif">#</font>
<br><font size=2 face="sans-serif">#</font>
<br><font size=2 face="sans-serif">acl USER external AD_Group lgInternetAccess_Users</font>
<br><font size=2 face="sans-serif">acl allowedsite dstdomain "/etc/squid/sitelist/dbs_allowed_site"</font>
<br>
<br><font size=2 face="sans-serif">acl manager proto cache_object</font>
<br><font size=2 face="sans-serif">acl localhost src 127.0.0.1/32 ::1</font>
<br><font size=2 face="sans-serif">acl to_localhost dst 127.0.0.0/8 0.0.0.0/32
::1</font>
<br>
<br><font size=2 face="sans-serif"># Example rule allowing access from
your local networks.</font>
<br><font size=2 face="sans-serif"># Adapt to list your (internal) IP networks
from where browsing</font>
<br><font size=2 face="sans-serif"># should be allowed</font>
<br>
<br><font size=2 face="sans-serif">acl IWCCP01 src 10.xx.15.103
# Linux Application server</font>
<br><font size=2 face="sans-serif">acl localnet src 10.0.0.0/8
# RFC1918 possible internal network</font>
<br><font size=2 face="sans-serif">acl localnet src 172.16.0.0/12
# RFC1918 possible internal network</font>
<br><font size=2 face="sans-serif">acl localnet src 192.168.0.0/16
# RFC1918 possible internal network</font>
<br><font size=2 face="sans-serif">acl localnet src fc00::/7
# RFC 4193 local private network range</font>
<br><font size=2 face="sans-serif">acl localnet src fe80::/10
# RFC 4291 link-local (directly plugged) machines</font>
<br><font size=2 face="sans-serif">#</font>
<br><font size=2 face="sans-serif">acl SSL_ports port 443</font>
<br><font size=2 face="sans-serif">acl Safe_ports port 80
# http</font>
<br><font size=2 face="sans-serif">acl Safe_ports port 21
# ftp</font>
<br><font size=2 face="sans-serif">acl Safe_ports port 443
# https</font>
<br><font size=2 face="sans-serif">acl Safe_ports port 70
# gopher</font>
<br><font size=2 face="sans-serif">acl Safe_ports port 210
# wais</font>
<br><font size=2 face="sans-serif">acl Safe_ports port 1025-65535
# unregistered ports</font>
<br><font size=2 face="sans-serif">acl Safe_ports port 280
# http-mgmt</font>
<br><font size=2 face="sans-serif">acl Safe_ports port 488
# gss-http</font>
<br><font size=2 face="sans-serif">acl Safe_ports port 591
# filemaker</font>
<br><font size=2 face="sans-serif">acl Safe_ports port 777
# multiling http</font>
<br><font size=2 face="sans-serif">acl CONNECT method CONNECT</font>
<br>
<br><font size=2 face="sans-serif"># Recommended minimum Access Permission
configuration:</font>
<br><font size=2 face="sans-serif">#</font>
<br><font size=2 face="sans-serif"># Only allow cachemgr access from localhost</font>
<br><font size=2 face="sans-serif">http_access allow manager localhost</font>
<br><font size=2 face="sans-serif">http_access deny manager</font>
<br>
<br><font size=2 face="sans-serif"># Deny requests to certain unsafe ports</font>
<br><font size=2 face="sans-serif">http_access deny !Safe_ports</font>
<br>
<br><font size=2 face="sans-serif"># Deny CONNECT to other than secure
SSL ports</font>
<br><font size=2 face="sans-serif">http_access deny CONNECT !SSL_ports</font>
<br>
<br><font size=2 face="sans-serif"># We strongly recommend the following
be uncommented to protect innocent</font>
<br><font size=2 face="sans-serif"># web applications running on the proxy
server who think the only</font>
<br><font size=2 face="sans-serif"># one who can access services on "localhost"
is a local user</font>
<br><font size=2 face="sans-serif">#http_access deny to_localhost</font>
<br>
<br><font size=2 face="sans-serif"># INSERT YOUR OWN RULE(S) HERE TO ALLOW
ACCESS FROM YOUR CLIENTS</font>
<br><font size=2 face="sans-serif">#</font>
<br><font size=2 face="sans-serif"># Example rule allowing access from
your local networks.</font>
<br><font size=2 face="sans-serif"># Adapt localnet in the ACL section
to list your (internal) IP networks</font>
<br><font size=2 face="sans-serif"># from where browsing should be allowed</font>
<br>
<br>
<br><font size=2 face="sans-serif">http_access allow IWCCP01 allowedsite</font>
<br><font size=2 face="sans-serif">http_access allow USER allowedsite</font>
<br><font size=2 face="sans-serif">http_access deny all</font>
<br><font size=2 face="sans-serif">http_access allow ad_auth</font>
<br>
<br><font size=2 face="sans-serif"># And finally deny all other access
to this proxy</font>
<br><font size=2 face="sans-serif">http_access deny all</font>
<br>
<br><font size=2 face="sans-serif"># Squid normally listens to port 3128</font>
<br><font size=2 face="sans-serif">http_port 8080</font>
<br><font size=2 face="sans-serif">never_direct allow all</font>
<br>
<br><font size=2 face="sans-serif">cache_peer 10.xx.xx.108 parent 8080
0 default</font>
<br><font size=2 face="sans-serif">#######################################################################</font>
<br>
<br>
<br><font size=2 face="sans-serif">Thanks & Regards<br>
Nilesh Suresh Gavali<br>
</font><p>=====-----=====-----=====<br>
Notice: The information contained in this e-mail<br>
message and/or attachments to it may contain <br>
confidential or privileged information. If you are <br>
not the intended recipient, any dissemination, use, <br>
review, distribution, printing or copying of the <br>
information contained in this e-mail message <br>
and/or attachments to it are strictly prohibited. If <br>
you have received this communication in error, <br>
please notify us by reply e-mail or telephone and <br>
immediately and permanently delete the message <br>
and any attachments. Thank you</p>
<p></p>