My squid and AD kerberos authentication working as expected. users are getting authenticated and able to access internet via proxy. access logs also capturing user account details.
now I need to restrict user access based on AD group membership.
Thanks & Regards
Nilesh Suresh Gavali
From: squid-users-request@xxxxxxxxxxxxxxxxxxxxx
To: squid-users@xxxxxxxxxxxxxxxxxxxxx
Date: 15/06/2016 18:27
Subject: squid-users Digest, Vol 22, Issue 70
Sent by: "squid-users" <squid-users-bounces@xxxxxxxxxxxxxxxxxxxxx>
Send squid-users mailing list submissions to
squid-users@xxxxxxxxxxxxxxxxxxxxx
To subscribe or unsubscribe via the World Wide Web, visit
http://lists.squid-cache.org/listinfo/squid-users
or, via email, send a message with subject or body 'help' to
squid-users-request@xxxxxxxxxxxxxxxxxxxxx
You can reach the person managing the list at
squid-users-owner@xxxxxxxxxxxxxxxxxxxxx
When replying, please edit your Subject line so it is more specific
than "Re: Contents of squid-users digest..."
Today's Topics:
1. Re: HTTPS issues with squidguard after upgrading from squid
2.7 to 3.5 (Marcus Kool)
2. URL access based on AD group membership (nilesh.gavali@xxxxxxx)
3. Re: URL access based on AD group membership (Amos Jeffries)
4. Re: Queue incoming requests when fetching from origin
(Alex Rousskov)
5. Re: URL access based on AD group membership
(Bruno de Paula Larini)
----------------------------------------------------------------------
Message: 1
Date: Wed, 15 Jun 2016 09:37:40 -0300
From: Marcus Kool <marcus.kool@xxxxxxxxxxxxxxx>
To: reqman <reqman@xxxxxxxxxxx>
Cc: squid-users@xxxxxxxxxxxxxxxxxxxxx
Subject: Re: HTTPS issues with squidguard after
upgrading from squid 2.7 to 3.5
Message-ID: <57614C14.4010002@xxxxxxxxxxxxxxx>
Content-Type: text/plain; charset=utf-8; format=flowed
On 06/15/2016 08:24 AM, reqman wrote:
> I have been using squidGuard for 10+ years. Not the best one could
> have, but I am accustomed to its use and idiosyncrasies. Furthermore,
> it is package well supported on FreeBSD.
>
> You are mentioning ufdbGuard. Are its lists free for government use?
> If not, then I can not use it, since we have very strict purchasing
> requirements, even if it costs $1. And of course, I would have to go
> through evaluation, the usual learning curve etc.
ufdbGard is free software.
You can use it with any database you desire... the free ones, your own or
a commercial one.
There is little learning curve since it is a fork of squidguard and there
is a Reference Manual and email support from URLfilterDB, even for those
who use a free database.
Marcus
> Don't get me wrong here, I'm not saying no. I'm just saying that even
> though it seems to be easy to say "yes", reality is much different.
>
> M.-
------------------------------
Message: 2
Date: Wed, 15 Jun 2016 14:50:38 +0100
From: nilesh.gavali@xxxxxxx
To: squid-users@xxxxxxxxxxxxxxxxxxxxx
Subject: URL access based on AD group membership
Message-ID:
<OF29EE7DFD.2BD1A317-ON80257FD3.004390E8-80257FD3.004C0BDD@xxxxxxx>
Content-Type: text/plain; charset="utf-8"
Hi Team;
I have setup as below-
Squid Kerberos authentication with windows AD 2012r2. - works fine.
Now need to restrict access based on AD Group membership.
Below configuration done but no luck. when try to access with user who is
not part of the group mention, still he is able to browse Internet.
================================
#
# Recommended minimum configuration:
#
#auth_param negotiate program /usr/lib64/squid/squid_kerb_auth -d -s
GSS_C_NO_NAME
auth_param negotiate program /usr/lib64/squid/squid_kerb_auth -s
HTTP/proxy02.abcd.co.uk@xxxxxxxxxx -d
auth_param negotiate children 10
auth_param negotiate keep_alive on
auth_param basic credentialsttl 2 hours
acl ad_auth proxy_auth REQUIRED
external_acl_type Domain_Admin %LOGIN /usr/lib64/squid/squid_ldap_group -b
"dc=abcd,dc=co,dc=uk" -D "cn=Nilesh Gavali,ou=Admin User,ou=TCS
Users,ou=Staff,dc=abcd,dc=co,dc=uk" -w "123456" -f
"(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=lgInternetAccess,ou=Internet
Access,ou=Groups,dc=abcd,dc=co,dc=uk))" -h xx.xx.2.101
acl AllowDomainAdmin external Domain_Admin lgInternetAccess
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged)
machines
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
#
# Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
#
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
#http_access allow localnet
#http_access allow localhost
http_access deny !ad_auth
http_access allow ad_auth
http_access deny !AllowDomainAdmin
http_access allow AllowDomainAdmin
# And finally deny all other access to this proxy
http_access deny all
# Squid normally listens to port 3128
http_port 8080
never_direct allow all
cache_peer xx.xx.2.108 parent 8080 0 default
dns_nameservers xx.xx.2.108
# We recommend you to use at least the following line.
#hierarchy_stoplist cgi-bin ?
# Uncomment and adjust the following to add a disk cache directory.
cache_dir ufs /var/spool/squid 2048 16 256
# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid
# Log forwarding to SysLog
access_log syslog:local1.info
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
=================================================
Thanks & Regards
Nilesh Suresh Gavali
=====-----=====-----=====
Notice: The information contained in this e-mail
message and/or attachments to it may contain
confidential or privileged information. If you are
not the intended recipient, any dissemination, use,
review, distribution, printing or copying of the
information contained in this e-mail message
and/or attachments to it are strictly prohibited. If
you have received this communication in error,
please notify us by reply e-mail or telephone and
immediately and permanently delete the message
and any attachments. Thank you
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20160615/a91ac994/attachment-0001.html>
------------------------------
Message: 3
Date: Thu, 16 Jun 2016 02:21:54 +1200
From: Amos Jeffries <squid3@xxxxxxxxxxxxx>
To: squid-users@xxxxxxxxxxxxxxxxxxxxx
Subject: Re: URL access based on AD group membership
Message-ID: <f7557bf2-bae0-e661-8368-6f4497454c89@xxxxxxxxxxxxx>
Content-Type: text/plain; charset=utf-8
On 16/06/2016 1:50 a.m., nilesh.gavali wrote:
> Hi Team;
> I have setup as below-
> Squid Kerberos authentication with windows AD 2012r2. - works fine.
> Now need to restrict access based on AD Group membership.
>
> Below configuration done but no luck. when try to access with user who is
> not part of the group mention, still he is able to browse Internet.
>
This is because:
<snip>
Step 0) check the basic security rules that deny bad behaviour.
>
> http_access deny !ad_auth
Step 1) deny with a "require authentication" message if there are no
valid credentials sent.
> http_access allow ad_auth
Step 2) allow anyone who has valid credentials to use the proxy.
... Uh, Stop.
Users either sent valid credentials [2 happened] or they did not [1
happened]. There are no other possibilities.
> http_access deny !AllowDomainAdmin
> http_access allow AllowDomainAdmin
>
As explained in the FAQ
<http://wiki.squid-cache.org/SquidFaq/SquidAcl#Access_Lists>
Amos
------------------------------
Message: 4
Date: Wed, 15 Jun 2016 09:19:52 -0600
From: Alex Rousskov <rousskov@xxxxxxxxxxxxxxxxxxxxxxx>
To: Jaap Dam <jaap.dam@xxxxxxxxx>, Amos Jeffries
<squid3@xxxxxxxxxxxxx>
Cc: squid-users@xxxxxxxxxxxxxxxxxxxxx
Subject: Re: Queue incoming requests when fetching from
origin
Message-ID: <57617218.5050802@xxxxxxxxxxxxxxxxxxxxxxx>
Content-Type: text/plain; charset=utf-8
On 06/14/2016 02:51 AM, Jaap Dam wrote:
> I've part of the logging as an attachment. I'm requesting a single URL
> in this log. The log starts with a stale cache of the item.
Collapsed forwarding does not apply to cache revalidation requests yet.
Factory is working on implementing collapsed revalidations (in some
environments), but I cannot promise a specific delivery date or that
your particular environment will be covered.
Alex.
> 2016-06-13 15:34 GMT+02:00 Amos Jeffries:
>
> On 14/06/2016 12:29 a.m., Jaap Dam wrote:
> > Is the collapsed_forwarding directive the correct one to use for my
> > use-case or am i missing something?
>
> Yes it is correct so far as I am understanding your need.
>
> For further debugging about what is going on you will need the HTTP
> messages involved. Add the directive "debug_options 11,2 20,3" to your
> config to get them logged in cache.log.
------------------------------
Message: 5
Date: Wed, 15 Jun 2016 14:27:14 -0300
From: Bruno de Paula Larini <bruno.larini@xxxxxxxxxxxxxx>
To: squid-users@xxxxxxxxxxxxxxxxxxxxx
Subject: Re: URL access based on AD group membership
Message-ID: <eb67a218-c749-aa16-4b00-941bdac1d0a5@xxxxxxxxxxxxxx>
Content-Type: text/plain; charset="utf-8"; Format="flowed"
Em 15/06/2016 10:50, nilesh.gavali@xxxxxxx escreveu:
> Hi Team;
> I have setup as below-
>
> * Squid Kerberos authentication with windows AD 2012r2. - works fine.
> * Now need to restrict access based on AD Group membership.
>
>
> Below configuration done but no luck. when try to access with user who
> is not part of the group mention, still he is able to browse Internet.
The following works fine for me and in my opinion works better than
LDAP. The authentication is integrated, so it doesn't keep asking for
password (when the current user is a domain account). But you have to
add the Squid server to the domain using 'smb.conf', 'krb5.conf' and
then 'net ads join'. The service 'winbind' must be running too.
I'm using Squid 3.5.19.
auth_param ntlm program /usr/bin/ntlm_auth
--helper-protocol=squid-2.5-ntlmssp --domain=MYDOMAIN
--enable-external-acl-helpers="ext_wbinfo_group_acl"
auth_param ntlm children 10 startup=0 idle=2
external_acl_type NTGroup children-startup=10 children-idle=2
children-max=50 %LOGIN /usr/lib64/squid/ext_wbinfo_group_acl
acl authenticated proxy_auth REQUIRED
acl ad_group external NTGroup MYDOMAIN\AD_Group
acl denied_websites dstdom_regex -i "/etc/squid/denied-websites.txt"
http_access deny ad_group denied_websites
So all the members of MYDOMAIN\AD_Group won't have access to whatever
the file contains.
Bruno
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20160615/810a3d96/attachment.html>
------------------------------
Subject: Digest Footer
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
------------------------------
End of squid-users Digest, Vol 22, Issue 70
*******************************************
_______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
