Просмотр сообщений
В этом разделе можно просмотреть все сообщения, сделанные этим пользователем.
Цитата: dimm от 29 Апрель 2014, 17:57:20
"-D adsquid@tema.local" - на этого юзера в домене сделан тикет ?
В данном случае это значения не имеет, так как сочетание аргументов -D и -W при вызове squid_ldap_group подразумевает простую (simple) аутентификацию в каталоге, то есть без kerberos.
Поискав информации в интернете, пришёл к мысли: установить в качестве шлюза linux, со squid+openldap на борту.
squid -v
Squid Cache: Version 3.1.10
configure options: '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--target=x86_64-redhat-linux-gnu' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--enable-internal-dns' '--disable-strict-error-checking' '--exec_prefix=/usr' '--libexecdir=/usr/lib64/squid' '--localstatedir=/var' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--with-logdir=$(localstatedir)/log/squid' '--with-pidfile=$(localstatedir)/run/squid.pid' '--disable-dependency-tracking' '--enable-arp-acl' '--enable-follow-x-forwarded-for' '--enable-auth=basic,digest,ntlm,negotiate' '--enable-basic-auth-helpers=LDAP,MSNT,NCSA,PAM,SMB,YP,getpwnam,multi-domain-NTLM,SASL,DB,POP3,squid_radius_auth' '--enable-ntlm-auth-helpers=smb_lm,no_check,fakeauth' '--enable-digest-auth-helpers=password,ldap,eDirectory' '--enable-negotiate-auth-helpers=squid_kerb_auth' '--enable-external-acl-helpers=ip_user,ldap_group,session,unix_group,wbinfo_group' '--enable-cache-digests' '--enable-cachemgr-hostname=localhost' '--enable-delay-pools' '--enable-epoll' '--enable-icap-client' '--enable-ident-lookups' '--enable-linux-netfilter' '--enable-referer-log' '--enable-removal-policies=heap,lru' '--enable-snmp' '--enable-ssl' '--enable-storeio=aufs,diskd,ufs' '--enable-useragent-log' '--enable-wccpv2' '--enable-esi' '--with-aio' '--with-default-user=squid' '--with-filedescriptors=16384' '--with-dl' '--with-openssl' '--with-pthreads' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'target_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -fpie' 'LDFLAGS=-pie' 'CXXFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -fpie' --with-squid=/builddir/build/BUILD/squid-3.1.10[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = TEMA.LOCAL
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
[realms]
TEMA.LOCAL = {
kdc = int-dc01.tema.local
admin_server = int-dc01.tema.local
}
INT-DC01.TEMA.LOCAL = {
kdc = int-dc01.tema.local
kdc = int-dc02.tema.local
}
[domain_realm]
.tema.local = TEMA.LOCAL
tema.local = TEMA.LOCALcat /etc/squid/squid.conf
#
# Recommended minimum configuration:
#
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 888 # moscow.gks.ru
acl CONNECT method CONNECT
#
# Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
#http_access allow localnet
#http_access allow localhost
#http_access allow localnet
auth_param negotiate program /usr/lib64/squid/squid_kerb_auth -s HTTP/int-proxy02.tema.local
auth_param negotiate children 10
auth_param negotiate keep_alive on
external_acl_type ldap_verify ttl=60 %LOGIN \
/usr/lib64/squid/squid_ldap_group -R -b "dc=tema,dc=local" \
-f "(&(objectclass=user)(sAMAccountName=%v)(memberOf=cn=%a,ou=Access,ou=New,ou=Tema Groups,dc=tema,dc=local))" \
-D adsquid@tema.local -K -W /usr/lib64/squid/password.txt 172.21.0.10
acl OFFICE external ldap_verify Access_Proxy_ftl_OFFICE
acl VIP external ldap_verify Access_Proxy_ftl_VIP
acl allusers proxy_auth REQUIRED
acl swf rep_mime_type -i ^application/x-shockwave-flash$
acl mediapr urlpath_regex \.swf(\?.*)?$
acl media rep_mime_type video/flv video/x-flv
acl mediapr urlpath_regex \.flv(\?.*)?$
acl flash rep_mime_type Content-Type video
acl bsites dstdomain '/etc/squid/bsites.conf'
acl bfiles url_regex '/etc/squid/block.conf'
acl asites dstdomain '/etc/squid/asites.conf'
http_access allow VIP
http_access allow OFFICE
http_reply_access allow VIP bfiles
http_reply_access allow VIP flash
http_reply_access allow VIP swf
http_reply_access allow VIP bsites
http_reply_access allow VIP media
http_reply_access allow VIP mediapr
http_reply_access allow VIP asites
http_reply_access allow OFFICE asites
http_reply_access deny flash
http_reply_access deny swf
http_reply_access deny bsites
http_reply_access deny media
http_reply_access deny mediapr
http_reply_access deny bfiles
http_access deny all !allusers
# And finally deny all other access to this proxy
http_access deny all
# Squid normally listens to port 3128
http_port 3128
# We recommend you to use at least the following line.
hierarchy_stoplist cgi-bin ?
# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /var/spool/squid 100 16 256
# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
cache_effective_user squid
cache_effective_group squidexternal_acl_type ldap_verify ttl=60 %LOGIN \
/usr/lib64/squid/squid_ldap_group -R -b "dc=tema,dc=local" \
-f "(&(objectclass=user)(sAMAccountName=%v)(memberOf=cn=%a,ou=Access,ou=New,ou=Tema Groups,dc=tema,dc=local))" \
-D adsquid@tema.local -K -W /usr/lib64/squid/password.txt 172.21.0.10