localzuk Posted January 29, 2007 Posted January 29, 2007 I now have a squid + dansguardian proxy/filter set up with active directory user authentication. Is it possible for the username and password to authenticate to be picked up automatically rather than them having to enter it into another box in the browser? Cheers, Tony
webman Posted January 29, 2007 Posted January 29, 2007 Have you joined the server to the domain and does samba auth work from the command line? How are you authenticating through squid?
localzuk Posted January 29, 2007 Author Posted January 29, 2007 The authentication is working fine. It is done via squid_ldap_group which is part of squid. It is set up as described at http://papercut.biz/kb/Main/ConfiguringSquidProxyToAuthenticateWithActiveDirectory (Except I only have a deny group and a default 'allow everyone else' acl) The machine isn't joined to the domain as the authentication is passed via http so it wouldn't be necessary I woudn't have thought?
webman Posted January 29, 2007 Posted January 29, 2007 Not sure on that score then; we have transparent authentication on our IPCop box (uses squid) and our auth_param uses ntlm rather than LDAP. auth_param ntlm program /usr/lib/squid/ntlm_auth BBARRINGTON/bbs-svr-001 BBARRINGTON/bbs-svr-002
tom_newton Posted January 29, 2007 Posted January 29, 2007 If you want it "done for you" in an out-of-the box solution with a nice UI, give us a call - SmoothWall - 0113 3874160. So yes, it is possible
localzuk Posted January 29, 2007 Author Posted January 29, 2007 Ah, I see... I'll give it a try that way instead. That makes sense as it would use the NTLM protocol rather than http basic... Cheers!
localzuk Posted January 29, 2007 Author Posted January 29, 2007 If you want it "done for you" in an out-of-the box solution with a nice UI, give us a call - SmoothWall - 0113 3874160. So yes, it is possible I think I can manage with my config file hacking at the moment I'm here for another 4 years at least so I won't be passing complex systems on to someone else for a while
webman Posted January 29, 2007 Posted January 29, 2007 If you want it "done for you" in an out-of-the box solution with a nice UI, give us a call - SmoothWall - 0113 3874160. So yes, it is possible ... or download IPCop
localzuk Posted January 29, 2007 Author Posted January 29, 2007 IPCop is no use to me without having to mess around loads - I have a single NIC firewall set-up which I am not able to change so IPCop would need some serious messing in order to get it to play nice.
localzuk Posted January 29, 2007 Author Posted January 29, 2007 Ah, that does the job fine. I worked through these 2: https://help.ubuntu.com/community/ActiveDirectoryWinbindHowto http://wiki.squid-cache.org/SquidFaq/ProxyAuthentication The only difference now is that I can't do a check to see if the user is in a group or not via the AD - which is a shame. Does anyone know how to block a single user from having access to the net through squid and ntlm? I'm guessing it will just be an ACL?
ChrisH Posted January 29, 2007 Posted January 29, 2007 Make a banned group and put the ACL up high in the order to say no access to that group.
localzuk Posted January 29, 2007 Author Posted January 29, 2007 What type of acl is that? What options do I give it?
localzuk Posted January 29, 2007 Author Posted January 29, 2007 Ah, I've managed it in 2 different ways now First way was by using the ldap group method on its own (and not the ldap auth part). The way I'm using now is by using /usr/lib/squid/wbinfo_group.pl as an external ACL program as shown in the example towards the middle of http://linux.ittoolbox.com/groups/technical-functional/linuxadmin-l/squid-with-ntlm-729052# Now just to rustle up a nice looking 'you can't get online because you've been banned' page.
Wildebeaste Posted February 12, 2007 Posted February 12, 2007 I've got Squid and Dansguardian working (Fedora Core 6), together with NTLM authentication (it was a very trying experience - designed to drive normal people into the dealth grip of Microsoft I think). Now I'd like to be able to block individuals/groups using something similar to 'wbinfo_group.pl'. I've run into some problems though. Whenever I try to use of the many, varied and conflicting articles, using wbinfo_group all I get is an authentication dialogue - I've tried localzuk's link. Does anyone have a link to an article which is guaranteed, absolutely copper-bottomed, 100% to work? I may have to hit something soon. P.S Fedora Core 6's bouncing window effects are great.
Geoff Posted February 12, 2007 Posted February 12, 2007 how was your version of squid compiled? which options? There are several compile time options relating to winbind auth that must be selected for it to work.
NetworkGeezer Posted February 12, 2007 Posted February 12, 2007 How would you find that if information the software came as precompiled RPMS (FC6).
Geoff Posted February 12, 2007 Posted February 12, 2007 Download the SRPM, pull it apart and see what it feeds to the configure script.
Wildebeaste Posted February 13, 2007 Posted February 13, 2007 These are the options for the default Squid configure on Fedora 6 using 'squid -v | grep configure'. Perhaps there's something missing? Your help is appreciated. configure options: '--build=i686-redhat-linux-gnu' '--host=i686-redhat-linux-gnu' '--target=i386-redhat-linux-gnu' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--includedir=/usr/include' '--libdir=/usr/lib' '--libexecdir=/usr/libexec' '--sharedstatedir=/usr/com' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--exec_prefix=/usr' '--bindir=/usr/sbin' '--libexecdir=/usr/lib/squid' '--localstatedir=/var' '--datadir=/usr/share' '--sysconfdir=/etc/squid' '--enable-epoll' '--enable-snmp' '--enable-removal-policies=heap,lru' '--enable-storeio=aufs,coss,diskd,null,ufs' '--enable-ssl' '--with-openssl=/usr/kerberos' '--enable-delay-pools' '--enable-linux-netfilter' '--with-pthreads' '--enable-ntlm-auth-helpers=SMB,fakeauth' '--enable-external-acl-helpers=ip_user,ldap_group,unix_group,wbinfo_group' '--enable-auth=basic,digest,ntlm' '--enable-digest-auth-helpers=password' '--with-winbind-auth-challenge' '--enable-useragent-log' '--enable-referer-log' '--disable-dependency-tracking' '--enable-cachemgr-hostname=localhost' '--enable-underscores' '--enable-basic-auth-helpers=LDAP,MSNT,NCSA,PAM,SMB,YP,getpwnam,multi-domain-NTLM,SASL' '--enable-cache-digests' '--enable-ident-lookups' '--with-large-files' '--enable-follow-x-forwarded-for' '--enable-wccpv2' '--enable-fd-config' '--with-maxfd=16384' 'CFLAGS=-fPIE -Os -g -pipe -fsigned-char' 'LDFLAGS=-pie' 'build_alias=i686-redhat-linux-gnu' 'host_alias=i686-redhat-linux-gnu' 'target_alias=i386-redhat-linux-gnu'
Wildebeaste Posted February 13, 2007 Posted February 13, 2007 If it won't work one way - then use another! As ntlm_auth works, I've got Dansguardian to filter out the little blighters instead. It does mean I have to edit a text file now and then - but at least it works. Client -> Dansguardian -> Squid. All is well.
Geoff Posted February 13, 2007 Posted February 13, 2007 yep, the fedora compiled version has a setting missing. --enable-ntlm-auth-helpers= winbind
Wildebeaste Posted February 14, 2007 Posted February 14, 2007 Thanks for the help Geoff. I'll keep that info for future reference. I think I'll leave it as is for the moment.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now