Thank you Rolf. I did the same thing. Reverse lookup for the hostname.
This setup needs a working samba package (already working if using NTLM Auth)
>> You appear not to understand the real concepts behind authentication and
>> authorization....
Amos, I think you didn't get what I mean, because i managed to make it work
I attached the perl script. Actually it's very fast. I also included a
timeout alarm of 1 sec for nmblookup.
My relevant squid.conf part:
-------------------------------------------------
external_acl_type host_ad_group children=3 ttl=60 %SRC
/usr/lib/squid/hostname.pl
acl internet_users external ad_group o-ro-cod-internet
acl internet_hosts external host_ad_group o-ro-cod-internet
http_access deny !authenticated all
http_access deny !internet_users !internet_hosts all
http_access allow authenticated
-------------------------------------------------
This way, i only allow authenticated users, but to access the internet
they need either to be member of the internet group, or their
workstation to be included in the internet group. This was needed
because we have a computer / office dedicated for internet access, and
everybody can use it.
Hope it helps somebody, and maybe it will be included in future relases.
On Fri, Dec 5, 2008 at 3:56 AM, Rolf Loudon <rolf@xxxxxxxxxxxxxx> wrote:
> Hello
>
> We do authentication by user and by workstation. Our business rules dictate
> a scenario like yours, where certain users gets access excepting certain
> workstations where any user is able to gain access, and several variations.
>
> In Active Directory we have user groups and workstation groups. We keep them
> in separate groups as mixing types of objects in the one group is apparently
> not recommended.
>
> For user auth its the usual helper setup querying AD via an LDAP look up
> supplying user/pass and group membership.
>
> For workstation auth we wrote a simple short shell script that takes %SRC as
> an input and then uses dig to work out the name via a reverse lookup (the
> script actually does a bit more checking in case multiple answers are
> returned and having to determine - by a forward lookup - which name is the
> correct one for the address supplied).
>
> The output of that script produces a computer name which we use as the input
> to squid_ldap_group along with the name of the relevant workstation group.
> The output of that helper query then tells us whether the computer is in a
> certain group and thus we can accept/deny or combine with other values such
> as a user's membership of some other group and so on.
>
> Works fine with the notable requirement that dns lookups must be current and
> in-addr.arpa zones are setup and consistent.
>
> regards
>
> r.
>
>
>
>
>
>
>> Razvan Grigore wrote:
>>>>
>>>> What you are looking for is winbind helper. It runs as an external ACL.
>>>> Any other approach will also need to run an external ACL, so the answer
>>>> to
>>>> your seconds question is yes and the example is winbind.
>>>>
>>>>
>>> The winbind helper is declared like this:
>>> external_acl_type ad_group children=3 ttl=120 %LOGIN
>>> /usr/lib/squid/wbinfo_group.pl
>>> I pass to it only the username. What I want is allow ANY username
>>> (even if it's not member of Internet AD group) who is logged on a
>>> computer member of this Internet group. I guess i have to pass the
>>> %SRC variable to a external helper and user nmblookup to get the
>>> computer name and then i'm stuck.
>>> Any ideas?
>>> Razvan
>>
>> You appear not to understand the real concepts behind authentication and
>> authorization....
>>
>> You can authenticate a username/password pair, regardless of location.
>> (standard login)
>>
>> THEN you can use the username/password to retrieve and verify a particular
>> group for the username/password (winbind group external ACL).
>>
>> THEN you can also verify a location with one of the username/password or
>> username/password/group tuplets.
>>
>> You cannot use AD _user_ groups to assign a group membership to a
>> _location_ while ignoring username.
>>
>>
>> For the setup you are now describing the secure way to do it is to ignore
>> username completely and use the location (source IP) in an ACL. As has been
>> mentioned several times already.
>>
>> You can _additional_ to that, to force users to login correctly (anyone
>> with valid username/password pair) before the external ACL gets run. But
>> even then the external ACL MUST ignore the login details it gets.
>>
>> Amos
>> --
>> Please be using
>> Current Stable Squid 2.7.STABLE5 or 3.0.STABLE10
>> Current Beta Squid 3.1.0.2 or 3.0.STABLE11-RC1
>
>
#!/usr/bin/perl
#
# external_acl helper for Squid to verify NT Domain group
# membership of a computername using his IP address
#
# Author:
# Razvan Grigore <esteticu@xxxxxxxxx>
#
# Version history:
# 2008-12-05 Razvan Grigore <esteticu@xxxxxxxxx>
# Initial release
# Disable output buffering
$|=1;
#
# Find out IP's hostname
#
sub getname {
local($ip) = @_;
$SIG{ALRM} = sub { die(); };
eval {
$hostname = "";
alarm 1;
$hostname = `/usr/bin/nmblookup -A $ip | awk '\$2 == "<20>" { print \$1 ; exit }'`;
alarm 0;
};
chop $hostname;
return $hostname;
}
#
# Check if computername belongs to a group
#
sub check {
local($computername, $group) = @_;
$cn = `/usr/bin/ldapsearch -LLL -h __ldap server__ -D '__ldap user__' -w '__ldap password__' -x -b "OU=your,DC=internal,DC=domain,DC=com" "(&(objectclass=computer)(sAMAccountName=$computername\$)(memberof=CN=$group,OU=Administrative Groups,OU=your,OU=Groups,DC=internal,DC=domain,DC=com))" cn |grep "cn:"`;
return 'ERR' if $cn eq "";
return 'OK';
}
#
# Main loop
#
while (<STDIN>) {
chop;
($ip, $group) = split(/\s+/);
$computername = &getname($ip);
if ($computername eq "") {
print "ERR\n";
}
else {
$ans = &check($computername, $group);
print "$ans\n";
}
}
