PFSense & Squid

[ReadTheNetwork]

Hi all,

 

Looking ahead to see if we can save costs, I'm looking at changing our system slightly to PFSense and Squid. I've heard good reviews on this so thought I'd give it a go.

 

Currently I'm getting Firefox and Chrome asking for authentication (IE seems to work fine). Is there a way around this?

 

Thanks

[MatthewL]

On Chrome are HTTPS sites ok but prompting for authentication on HTTP?

[ReadTheNetwork]

Both HTTP and HTTPS are prompting for authentication (on FF and Chrome). Seems to work fine after entering the credentials.

[Geoff]

Lazy way to fix this:

 

https://pf2ad.mundounix.com.br/en/index.html

[FN-GM]

Just as a side note. Make sure the CPU supports AES-NI or else you won't be able to use PFsense 2.5

[ReadTheNetwork]

I've been using the RADIUS method which has been working (with FF and Chrome prompting for authentication), but when I try to use the LDAP it keeps failing to connect for users.

The settings I have for LDAP are:

Authentication Server: 192.168.0.1 (IP address of the AD server)

Port: 389

LDAP Version: 3

LDAP Server User DN: cn=pfsenseuser,ou=account users,dc=mydomain,dc=sch,dc=uk

LDAP password: Password

LDAP Base Domain: dc=mydomain,dc=sch,dc=uk

ldap username DC Attribute: uid

ldap search filter: (samaccountname=%s)

[Geoff]

Windows AD DCs require you to connect via LDAPS rather than LDAP. Configure your SSL.

[ReadTheNetwork]

Testing with ldp.exe I seem to be able to connect using 389 :/

[Geoff]

I have 2016 DCs, I guess you don't?

[ReadTheNetwork]

Not yet, that'll be another holiday upgrade to do.

[diladele]

But I was talking not about LDAP authentication but Kerberos. The idea is to setup a designated user in the AD, map a special proxy name to it and enable negotiate authentication on Squid.

After that it all automatically and transparently handled by users's browser (or course the machine need to be AD joined). Might be a challenge to setup but after that it just works for years.

[ADMaster]

I've been using the RADIUS method which has been working (with FF and Chrome prompting for authentication), but when I try to use the LDAP it keeps failing to connect for users.

The settings I have for LDAP are:

Authentication Server: 192.168.0.1 (IP address of the AD server)

Port: 389

LDAP Version: 3

LDAP Server User DN: cn=pfsenseuser,ou=account users,dc=mydomain,dc=sch,dc=uk

LDAP password: Password

LDAP Base Domain: dc=mydomain,dc=sch,dc=uk

ldap username DC Attribute: uid

ldap search filter: (samaccountname=%s)

 

I don't use pfsense or squid, but the samaccountname is the username in AD.

 

Try changing this line.

ldap username DC Attribute: samaccountname

 

 

 

​It would also be good to move to ldaps but should function without it.