<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr">Hi everybody!<br>I am just writing to thank you all for the excellent comments, you have been very helpful.<br><br>I also take this opportunity to mention which operating model I decided to use, which is working well so far.<br><br>DNS A and PTR record "balancer.mydomain.local" pointing to keepalived virtual IP of HAProxy. This is my HA frontend.<br>Haproxy server in TCP mode.<br>The SQUID nodes joined to the domain and authenticated by Kerberos and LDAP.<br>In each SQUID node I added the credentials of the AD user account in the keytab. I configured the AD user account 'without expiring the password' and 'not requiring pre-authentication kerberos'.<br>If anyone wants or needs more information just let me know.<br><br>Best regards<br></div><div dir="ltr"><br></div><div>Gabriel</div><div><br></div><div><br></div><div dir="ltr"><div>squid.conf</div>visible_hostname debian-proxy.mydomain.local<br>http_port 3128 require-proxy-header<br>acl haproxy src 10.10.8.213<br>proxy_protocol_access allow haproxy<br>debug_options ALL, 1 33, 2 28, 9<br>maximum_object_size 8192 KB<br>error_directory /opt/squid411/share/errors/es-ar<br>shutdown_lifetime 0 seconds <br>forwarded_for transparent<br>auth_param negotiate program /usr/local/bin/squid_kerb_auth -i -r -s GSS_C_NO_NAME<br>auth_param negotiate children 300 startup=150 idle=10<br>auth_param negotiate keep_alive on<br>auth_param basic program /opt/squid411/libexec/basic_ldap_auth -P -R -b "dc=mydomain,dc=local" -D "cn=ldap,cn=Users,dc=mydomain,dc=local" -W /opt/squid411/etc/ldappass.txt -f sAMAccountName=%s -h dc1.mydomain.local<br>auth_param basic children 30<br>auth_param basic realm Proxy Authentication<br>auth_param basic credentialsttl 4 hour<br>acl auth proxy_auth REQUIRED<br>http_access allow auth<br>acl SSL_ports port 443<br>acl Safe_ports port 80<br>acl CONNECT method CONNECT<br>http_access deny !Safe_ports<br>http_access deny CONNECT !SSL_ports<br><br>http_access deny all</div><div dir="ltr"><br></div><div dir="ltr"><br></div><div>haproxy.cfg</div><div>global<br> log /dev/log local0<br> log /dev/log local1 notice<br> chroot /var/lib/haproxy<br> stats socket /run/haproxy/admin.sock mode 660 level admin<br> stats timeout 30s<br> user haproxy<br> group haproxy<br> daemon<br><br>defaults<br> log global<br> mode tcp<br> option tcplog<br> option dontlognull<br> timeout connect 5000<br> timeout client 50000<br> timeout server 50000<br><br>frontend squid<br> bind <a href="http://10.10.8.213:3128" target="_blank">10.10.8.213:3128</a><br> default_backend squid_pool<br><br>backend squid_pool<br> balance source<br> mode tcp<br> option tcp-check<br> tcp-check connect port 3128<br> server squid1 <a href="http://10.10.8.205:3128" target="_blank">10.10.8.205:3128</a> check inter 2000 rise 2 fall 3 send-proxy<br> server squid2 <a href="http://10.10.8.214:3128" target="_blank">10.10.8.214:3128</a> check inter 2000 rise 2 fall 3 send-proxy<br></div><div><br></div><div dir="ltr">ktutil<br>read_kt /opt/squid411/etc/PROXY.keytab</div><div>list<br></div><div dir="ltr"> 1 1 DEBIAN-PROXY$@MYDOMAIN.LOCAL<br> 2 1 DEBIAN-PROXY$@MYDOMAIN.LOCAL<br> 3 1 DEBIAN-PROXY$@MYDOMAIN.LOCAL<br> 4 1 HTTP/debian-proxy.mydomain.local@MYDOMAIN.LOCAL<br> 5 1 HTTP/debian-proxy.mydomain.local@MYDOMAIN.LOCAL<br> 6 1 HTTP/debian-proxy.mydomain.local@MYDOMAIN.LOCAL<br> 7 1 host/DEBIAN-PROXY@MYDOMAIN.LOCAL<br> 8 1 host/DEBIAN-PROXY@MYDOMAIN.LOCAL<br> 9 1 host/DEBIAN-PROXY@MYDOMAIN.LOCAL<br> 10 1 host/debian-proxy.mydomain.local@MYDOMAIN.LOCAL<br> 11 1 host/debian-proxy.mydomain.local@MYDOMAIN.LOCAL<br> 12 1 host/debian-proxy.mydomain.local@MYDOMAIN.LOCAL<br> 13 2 HTTP/inet.mydomain.local@MYDOMAIN.LOCAL<br> 14 2 HTTP/inet@MYDOMAIN.LOCAL</div><div dir="ltr"><br></div><div dir="ltr">global_defs {<br> notification_email {<br> some.user@mydomain.local<br> }<br> notification_email_from pxbalancer01@mydomain.local<br> smtp_server smtp.mydomain.local<br> smtp_connect_timeout 60<br> router_id pxbalancer01<br> }<br><br> vrrp_instance VI_1 {<br> state MASTER<br> interface eth0<br> virtual_router_id 114<br> priority 110<br> advert_int 1<br> authentication {<br> auth_type PASS<br> auth_pass SomePASS123<br> }<br> virtual_ipaddress {<br> 10.10.8.213<br> }<br> virtual_routes {<br> <a href="http://10.10.8.0/22">10.10.8.0/22</a> via 10.10.8.207 src 10.10.8.213<br> }<br>}<br><br></div></div></div></div></div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">El vie., 24 de jul. de 2020 a la(s) 06:44, Rafael Akchurin (<a href="mailto:rafael.akchurin@diladele.com" target="_blank">rafael.akchurin@diladele.com</a>) escribió:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Sorry forgot to add to Amos'es answer - use haproxy to handle *tcp* connections and let the sslbump/authentication run on the cluster of squids - thus you would get working auth on squid side and use keepalived/haproxy on the client side.<br>
<br>
I do not see any reason why it cannot work unless you specifically desire to use some haproxy's features for l7 loadbalancing.<br>
<br>
Best regards,<br>
Rafael Akchurin<br>
Diladele B.V.<br>
<br>
-----Original Message-----<br>
From: squid-users <<a href="mailto:squid-users-bounces@lists.squid-cache.org" target="_blank">squid-users-bounces@lists.squid-cache.org</a>> On Behalf Of Klaus Brandl<br>
Sent: Friday, July 24, 2020 10:45 AM<br>
To: <a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
Subject: Re: [squid-users] Problem with HAProxy + Squid 4.11 + Kerberos authentication<br>
<br>
Hi Brett,<br>
<br>
but then you have a single point of failure, if your loadbalancer is down, <br>
nothing will work. We need a solution, that each system can work by itself. So <br>
at the moment we merge the keytabs of each system together, and we are able to <br>
takeover the addresses of the other systems. Then we have no loadbalancing, <br>
but a fallback solution, what is more important on our systems.<br>
<br>
On Friday 24 July 2020 09:53:03 Brett Lymn wrote:<br>
> On Thu, Jul 23, 2020 at 06:07:39PM +0200, Klaus Brandl wrote:<br>
> > But if anyone knows a solution, i will spread my ears :)<br>
> <br>
> What we do is:<br>
> <br>
> 1) create a user account in AD that will be used for the HA front end,<br>
> set a password and export the keytab for this user<br>
> 2) Use ktadmin to import the keytab entries for the user created in step<br>
> 1 into the keytab for squid on the squid servers.<br>
> 3) Set a SPN (setspn) in AD that maps <a href="HTTP://ha.fqdn.address" rel="noreferrer" target="_blank">HTTP://ha.fqdn.address</a> to the user<br>
> created in 1<br>
> <br>
> The SPN (service principal name) tells kerberos to use the user details<br>
> set up in step 1 to authenticate http requests. This works for us, has<br>
> been for years.<br>
> <br>
> One thing, if you want to know the IP addresses of your clients in the<br>
> squid logs you will need to do some extra stuff because all accesses<br>
> will appear to come from the HA loadbalancer. We have configured our<br>
> load balancers to insert the X-Forwarded-For header into the http<br>
> traffic and then modified the logging to log both the loadblancer and<br>
> client IP.<br>
<br>
Klaus<br>
<br>
---<br>
<br>
genua GmbH<br>
Domagkstrasse 7, 85551 Kirchheim bei Muenchen<br>
tel +49 89 991950-0, fax -999, <a href="http://www.genua.de" rel="noreferrer" target="_blank">www.genua.de</a><br>
<br>
Geschaeftsfuehrer: Matthias Ochs, Marc Tesch<br>
Amtsgericht Muenchen HRB 98238<br>
genua ist ein Unternehmen der Bundesdruckerei-Gruppe.<br>
_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
</blockquote></div>