edie209 Posted January 3, 2013 Posted January 3, 2013 Hello all I hope you all had a good Christmas and New year. Well back to work and I am faced with a problem. I have just setup a squid proxy server and everything is working really well in the sense of reporting stats on internet usage and I have got youtube for education working. The problem is when I try to access the LEA's staff proxy http://login.staffproxy I can't resolve the login page. Normally the browsers proxy would be the LEA but now I am using the internal proxy I have set the LEA's proxy as the parent proxy but that doesn't seem to work. Anyone have an idea what I need to do?
twin--turbo Posted January 3, 2013 Posted January 3, 2013 login.staffproxy is not a correct internet host/domain how is the IP of this normaly resolved? Rob
twin--turbo Posted January 3, 2013 Posted January 3, 2013 Thinking on it... Your old Proxy would have known about staffproxy so you need to tell your proxy where to pull the domain staffproxy from.. it's sort of "reverse proxy" , Tips for setting up Squid in Reverse Proxy (Web Accelerator ‘accel’) mode—Balint’s Blog May help When your client asks your proxy for login.staffproxy, it matches that and sends the request to the parent proxy. Rob
edie209 Posted January 3, 2013 Author Posted January 3, 2013 Maybe I am being stupid but I can't see anything that enables what I am trying to do
Geoff Posted January 3, 2013 Posted January 3, 2013 What is the purpose of the 'LEA staff proxy' and why do you want to access it via your internal squid proxy?
twin--turbo Posted January 3, 2013 Posted January 3, 2013 It's a couple of years since I did any squid RevP. it will be something allong the lines of #setup the parent proxy cache_peer LEAPROXYIP parent 8080 0 no-query originserver no-digest name=PROXYATTHELEA # create an acl for the site acl STAFFPROXY dstdomain LOGIN.STAFFPROXY # allow the site to use the peer cache_peer_access LEAPROXY allow STAFFPROXY cache_peer_access LEAPROXY deny all There may be another way to do it. Rob
edie209 Posted January 3, 2013 Author Posted January 3, 2013 What is the purpose of the 'LEA staff proxy' and why do you want to access it via your internal squid proxy? Geoff the LEA proxy handles the schools web filtering, and for teachers to get unfiltered access they need to log on to the LEA's proxy. I am putting in a proxy on site so I can track user website access. At present we have had no way of tracking users on the internet. The fact is I got asked by SLT for some information and was unable to supply it hence the onsite proxy. twin-turbo thanks for that funnily I had just read something about cache_peer soI will give your method a go in the morning. Thanks very much.
Geoff Posted January 3, 2013 Posted January 3, 2013 (edited) You can't chain proxy authentication like that. If you used the staff proxy as an upstream it would end up authenticating your proxy with whatever staff member happened to login first. Then all subsequent accesses via you proxy will be handled as if that staff member was accessing the websites. I imagine this isn't what you want to happen. Edited January 3, 2013 by Geoff
edie209 Posted January 3, 2013 Author Posted January 3, 2013 no you are right Geoff it must be unique for each user.
Geoff Posted January 3, 2013 Posted January 3, 2013 Your teachers will have to bypass your internal proxy then.
edie209 Posted January 3, 2013 Author Posted January 3, 2013 So you don't think there is a way of achieving it then?
Boredguy Posted January 3, 2013 Posted January 3, 2013 The login.staffproxy is only available on the SWGfL if you are pointing to the specific proxy server and not the general one for your school, otherwise the kids could gain access. Depending how you defined your upstream proxy in Squid will depend if it will work (such as maybe needing 2 local, 1 for students, 1 for staff) I think what I had to do was make sure the cache_peer line contained the login=PASS as below cache_peer proxyname.swgfl.org.uk parent 8080 0 proxy-only no-digest login=PASS
edie209 Posted January 3, 2013 Author Posted January 3, 2013 The login.staffproxy is only available on the SWGfL if you are pointing to the specific proxy server and not the general one for your school, otherwise the kids could gain access. Depending how you defined your upstream proxy in Squid will depend if it will work (such as maybe needing 2 local, 1 for students, 1 for staff) I think what I had to do was make sure the cache_peer line contained the login=PASS as below cache_peer proxyname.swgfl.org.uk parent 8080 0 proxy-only no-digest login=PASS I have got a proxy server for each for that reason, so you have it working thats great to hear I will give that a go in the morning.
edie209 Posted January 7, 2013 Author Posted January 7, 2013 I am still having problems getting this to work and I have just found this info, does this mean I have to have the swgfl usernames in the proxy settngs use 'login=PASS' if users must authenticate against the upstream proxy or in the case of a reverse configuration, the origin web server. This will pass the users credentials as they are to the pee Note: To combine this with local authentication the Basic authentication scheme must be used, and both servers must share the same user database as HTTP only allows for a single login (one for proxy, one for origin server Also be warned this will expose your users proxy password to the peer. USE WITH CAUTION
Geoff Posted January 7, 2013 Posted January 7, 2013 You probably want Login=PASSTHRU so that your proxy passes the request to the swgfl proxy with whatever credentials provided by your users.
Duke5A Posted January 7, 2013 Posted January 7, 2013 Is it necessary to have logging on both ends? If you've got your staff authenticating internally maybe use a generic account to authenticate to the upstream? I have the exact same setup here without the requirement for upstream authentication. Student and staff both have their own Squid 3.1 proxy with Kerberos setup and the ISD proxies as cache peers for filtering.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now