On 25/05/11 18:39, Julian Zoellner wrote:
hello all,
in the last days i tried to setup the Squid for windows 2.7.STABLE7 with authentication against a Active Directory Group "Internet". For this is used the folloing HowTo:
http://www.papercut.com/kb/Main/InstallingAndConfiguringSquidNTProxy
Please use 2.7.STABLE9 at the very least. 2.7 as a whole is aging and
deprecated, we support 2.7.STABLE9 only until all its useful features
are ported to 3.x series.
So my squid.conf looks like this:
http_port 3128
external_acl_type win_domain_group ttl=120 %LOGIN c:/squid/libexec/mswin_check_ad_group.exe -d -G
acl Inet external win_domain_group MY-DOMAIN/Groups/Internet
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localnet src 10.0.0.0/13
acl SSL_ports port 443 563 10000
acl Safe_ports port 80 21 443 563 70 210 1025-65535
acl CONNECT method CONNECT
http_access allow manager localnet
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow Inet
http_access deny all
never_direct allow all
icp_access allow all
After starting up the squid service i get the following reply from my helper:
/mswin_check_ad_group.exe[3692]: Member of Domain MY-DOMAIN
/mswin_check_ad_group.exe[3692]: Into forest MY.DOMAIN
/mswin_check_ad_group.exe[3692]: External ACL win32 group helper build Mar 13 2010, 14:16:45 starting up...
/mswin_check_ad_group.exe[3692]: Domain Global group mode enabled using 'MY-DOMAIN' as default domain.
the last entry in my cache.log is:
2011/05/25 08:03:13| storeLateRelease: released 0 objects
when i try to connect i always get "Cache Access Denied" errorpage.
can please someone help me setting this up?
Firstly, remove the never_direct line.
Then follow the instructions in that tutorial about how to setup
authentication...
auth_param ntlm program c:/squid/libexec/mswin_ntlm_auth.exe
auth_param ntlm children 5
acl loggedIn proxy_auth REQUIRED
http_access deny !loggedIn
The part you followed begins "The next step is "... which is a clear
indication that it depends on the earlier parts which were skipped.
NP: the bits they have in that config about "localnet" are broken and
have never worked as described.
Amos
--
Please be using
Current Stable Squid 2.7.STABLE9 or 3.1.12
Beta testers wanted for 3.2.0.7 and 3.1.12.1
