Cragzman Posted October 10, 2008 Posted October 10, 2008 Hi guys. I'm on a mission to set up a Squid box. Been told that it would be better than our rubbish Equiinet Cachepilot. But I'm not sure which Linux I should use. Any ideas? Also does Squid, when authenticating with Active Directory, create log files with the users username included? Trying to kill the user input of user credentials when using LDAP on the Cachepilot. Plus Cachepilot hates WSUS. Any help would be grand. Ta very much
Geoff Posted October 10, 2008 Posted October 10, 2008 I use Ubuntu LTS on all my Linux machines. 8.04.1 is the current release. You will need to configure Squid with NTLM authentication (Which will also require Samba and Winbind to function). This is a fairly common configuration. There's plenty of information on these forums and the rest of the net on how to do it 1
ChrisH Posted October 10, 2008 Posted October 10, 2008 I think your going soft on us using Ubuntu Geoff
DMcCoy Posted October 10, 2008 Posted October 10, 2008 I usually use it, but had to switch to something else for a upnp server as it's somewhat broken in ubuntu. I used gentoo instead. A tip, DON'T use gentoo. Compiling 260 packages and dependancies takes forever.
RabbieBurns Posted October 10, 2008 Posted October 10, 2008 Always used gentoo myself for servers, never really considered ubuntu, Seems wikipedia like ubuntu Wikipedia adopts Ubuntu for its server infrastructure
dhicks Posted October 10, 2008 Posted October 10, 2008 I'm on a mission to set up a Squid box. Been told that it would be better than our rubbish Equiinet Cachepilot. But I'm not sure which Linux I should use. Any ideas? We use Ubuntu. If you need to recompile Squid (which we needed to to make it support transparent proxying) don't forget that Ubuntu doesn't come with compilers and so on installed by default, but you just need to install the build-essential package and everything should be fine. -- David Hicks
ccs Posted October 10, 2008 Posted October 10, 2008 I have very very little experience using linux. I installed Edubuntu and followed the directions in this wiki for installing squid. It was a piece of cake. There are directions for using Dansguarding filter also, but I chose not to install that application. https://wiki.ubuntu.com/EdubuntuProxy Good luck with your decision. -Steve
Geoff Posted October 10, 2008 Posted October 10, 2008 I think your going soft on us using Ubuntu Geoff Soft? No. Lazy? Yes.
webman Posted October 10, 2008 Posted October 10, 2008 +1 for Ubuntu. All our linux servers are now standardised on Ubuntu with the exception of IPCop and soon OpenFiler.
linescanner Posted October 12, 2008 Posted October 12, 2008 Depends on what hardware you are looking at using. I would run it on Ubuntu if you are Linux happy. Personally I run it on Solaris. Goes like the proverbial brown stuff off a teflon stick. Solaris is a bit bit less hardware friendly though. Need to choose it carefully.
somabc Posted October 12, 2008 Posted October 12, 2008 (edited) Ubuntu / Debian There are binaries for Windows Fedora Debian FreeBSD NetBSD RHEL Solaris Just choose the one you have the most experience of, if you are not sure choose ubuntu, trust me Edited October 12, 2008 by somabc
Cragzman Posted October 13, 2008 Author Posted October 13, 2008 Thanks for the help guys. I decided to go for Ubuntu 8.04.1 Server as it seemed to be the popular choice. Also our intranet server uses it. Been solid as a rock. Think I have installed Squid, Samba, and Winbind. Just now to configure it. Eeeek!
ahuxham Posted October 16, 2008 Posted October 16, 2008 Thanks for the help guys. I decided to go for Ubuntu 8.04.1 Server as it seemed to be the popular choice. Also our intranet server uses it. Been solid as a rock. Think I have installed Squid, Samba, and Winbind. Just now to configure it. Eeeek! Don't forget the MIT Kerberos packages, recommended, krb5-config and krb5-user which adds the helper programs, (kinit, klist etc) 1
Cragzman Posted October 22, 2008 Author Posted October 22, 2008 I have managed to set up Squid with NTLM Authentication. WOOO! Just a few more bits and pieces that need sorting. 1. Is there a thing for squid that can log domain usernames in the access.log? 2. Is there a time converter thingy for the log so I can make sense of it? 3. Can I make multiple user groups (for example: staff, students) and have seperate URL blacklists for each? Thanks again peeps
torry_loon Posted October 22, 2008 Posted October 22, 2008 1. I use ident. I think there is a way to get the names from AD. 2. There are applications to produce human-readable reports from the squid logs. SARG & Calamaris are probably the most popular. There is also an application called Squidview (in the Ubuntu repositories) that displays the access log in real-time and formats it in a more readable way. 3. Yes. Which filter are you using? SquidGuard or Dan's Guardian? 1
Cragzman Posted October 23, 2008 Author Posted October 23, 2008 Ahhh evil. I forgot to mention that I managed to get the NTLM working on a mock domain I have set up at home with no problems. But when I try and set it up on the school domain, with a few tweaks on the .conf files, I get a login box to the squid box I just set up via IE7. Kinda defeats the object of NTLM authentication methinks. I'm probably clutching at staws but maybe it has something to do with the default domain policy in Active Directory? My domain kerberos policy: Account Policies/Kerberos Policy Policy Setting Enforce user logon restrictions Enabled Maximum lifetime for service ticket 600 minutes Maximum lifetime for user ticket 10 hours Maximum lifetime for user ticket renewal 7 days Maximum tolerance for computer clock synchronization 5 minutes NTP is set up correctly so it can't be the clock sync. I haven't got any Dansguardian or similar stuff installed yet. Just want to make sure that no login boxes come up. Thanks again guys
Cragzman Posted October 23, 2008 Author Posted October 23, 2008 Ahhh I found this in the cache.log Login for user [AYLSHAMHIGH]\[chillebrandt]@[iCT-003] failed due to [winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/run/samba/winbindd_privileged are set correctly.] [2008/10/23 12:36:22, 0] utils/ntlm_auth.c:manage_squid_ntlmssp_request(776) NTLMSSP BH: NT_STATUS_ACCESS_DENIED This could be reason why it's being a pain. Would I somehow need to add all the users to the squid group or something? Ta.
mpe Posted December 2, 2008 Posted December 2, 2008 1. I use ident. I think there is a way to get the names from AD. Do you know of a version of ident for Windows 2003 which works correctly with with terminal server. The version I have been using, since Windows 95, has a nasty habit of thinking everyone is the first user to log in.
ahuxham Posted December 2, 2008 Posted December 2, 2008 (edited) Ahhh I found this in the cache.log Login for user [AYLSHAMHIGH]\[chillebrandt]@[iCT-003] failed due to [winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/run/samba/winbindd_privileged are set correctly.] [2008/10/23 12:36:22, 0] utils/ntlm_auth.c:manage_squid_ntlmssp_request(776) NTLMSSP BH: NT_STATUS_ACCESS_DENIED This could be reason why it's being a pain. Would I somehow need to add all the users to the squid group or something? Ta. Easy. Check your squid.conf, find the cache effective user. Write the user down. Than run: ls -al /var/run/samba/winbindd_privileged it should list root root on the pipe. chown root:proxy /var/run/samba/winbindd_priveleged/ Would be easier to modify the winbind startup script, and force the change of user, otherwise every reboot, you need to re chown. Edited December 2, 2008 by ahuxham
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now