Hello
This is my first post. I've just setup Squid 2.7 STABLE on Ubuntu server
10.4 with NTLM authentication and Winbind. At present, any one who is a
member of the domain admins group are not able to access the proxy
server...they just get a normal "Page cannot be displayed" message in IE,
not even a squid error. When they access a blocked site (login.live.com),
same thing. A coworker previously setup 2.6STABLE on FreeBSD 7 and he had
the same problem. I have a few accounts with domain admin privlidges, but
they all have the same problem. Config is below.
I have tried commenting out the ACL "http_access deny
ad_group_domain_users", which points to a file that just says Domain Users,
but that makes no difference. When I do domain\administrator
domain\internet with wbinfo_group.pl OK is returned....same with my username
(non domain admin). There are no errors in the access.log or cache.log. I
HAVE changed the wbinfo_group.pl as the default one wasn't working...but if
it's returning OK when I run a check I don't understand the issue. If
there's a better way to accomplish this let me know...would like for
Kerberos authentication instead of NTLM to make life easier for my Linux and
MAC users :)
==================
#Setup authentication as NTLM, allowing 20 processes for authentication.
Increase if authentication is slow.
auth_param ntlm program /usr/lib/squid/ntlm_auth -f domain.com/dc1
auth_param ntlm program /usr/lib/squid/ntlm_auth -f domain.com/dc2
auth_param ntlm children 20
# ACLs to allow Server to access itself
acl all src all
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
# Force All ACLs to require NTLM authentication
acl ntlm proxy_auth REQUIRED
# ACLs for permitted ports for proxying
acl SSL_ports port 443
acl SSL_ports port 8383 # VMWare Server
acl SSL_ports port 8444 # Identity Guard
acl SSL_ports port 4444 # OWA
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 4444 # OWA https
acl Safe_ports port 8444 # Identity Guard https
acl Safe_prots port 8383 # VMWare Server https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
# Script for WinBid group checking. Must have
external_acl_type ntdom ttl=0 children=20 %LOGIN
/usr/lib/squid/wbinfo_group.pl
#########BE VERY CAREFUL OF RULE ORDER, WILL STOP WHEN SOMETHING MATCHES AND
NOT CONTINUE###########
# Denies access to blocked websites, ie. Hotmail.
acl blocked_websites url_regex "/etc/squid/blocked_websites"
http_access deny blocked_websites
# Allows users in "INTERNET" AD group to access internet through proxy
acl AD_group_internet external ntdom internet
http_access allow AD_group_internet
# Denies users in "DOMAIN USERS" AD group from using proxy. Must be a
member of "INTERNET" group to get online
acl AD_group_domain_users external ntdom
"/etc/squid/ad_group_domain_users"
http_access deny ad_group_domain_users
# Tell acl method to be CONNECT
acl CONNECT method CONNECT
# Allow requests to ports
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
# Allow server to access itself
http_access allow manager localhost
http_access deny manager
# Permitted networks for Proxy
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
http_access allow localnet
# Deny all other access
http_access deny all
#########END RULE ORDER CAREFULNESS###########
# Allow access to Internet Cache Proxy from localnet
icp_access allow localnet
icp_access deny all
--
View this message in context: http://squid-web-proxy-cache.1019090.n4.nabble.com/Domain-Admins-can-t-access-tp2306738p2306738.html
Sent from the Squid - Users mailing list archive at Nabble.com.
