|
Dear Squid Community/Support Team,
I am currently configuring Squid with Kerberos authentication and LDAP group-based access control. However, I am encountering persistent issues, and I would greatly appreciate your guidance. Below are the details of my configuration and the errors I am facing.
Error Logs
The following errors repeatedly appear in the Squid logs:
2025/01/03 19:35:40 kid1| Starting new helpers
2025/01/03 19:35:40 kid1| helperOpenServers: Starting 1/5 'ext_kerberos_ldap_group_acl' processes
support_sasl.cc(276): pid=70855 :2025/01/03 19:35:40| kerberos_ldap_group: ERROR: ldap_sasl_interactive_bind_s error: Local error
support_ldap.cc(1086): pid=70855 :2025/01/03 19:35:40| kerberos_ldap_group: ERROR: Error while binding to ldap server with SASL/GSSAPI: Local error
support_ldap.cc(1172): pid=70855 :2025/01/03 19:35:40| kerberos_ldap_group: ERROR: Error while binding to ldap server with Username/Password: Encoding error
(ext_kerberos_ldap_group_acl): ../../../../libraries/liblber/io.c:108: ber_write: Assertion `buf != NULL' failed.
2025/01/03 19:35:41 kid1| WARNING: external_acl_type #Hlpr7 exited
2025/01/03 19:35:41 kid1| Too few external_acl_type processes are running (need 1/5)
Current Configuration
Kerberos Authentication
auth_param negotiate program /usr/lib/squid/negotiate_kerberos_auth -s HTTP/ubuntuserver.demo.local
auth_param negotiate children 10
auth_param negotiate keep_alive on
External ACL for LDAP Groups
external_acl_type kerberos_ldap_group ttl=3600 negative_ttl=3600 %LOGIN /usr/lib/squid/ext_kerberos_ldap_group_acl \
-P HTTP/ubuntuserver.demo.local@DEMO.LOCAL \
-D demo.local \
-b DC=demo,DC=local \
-l ldap://dc.demo.local \
-g FullAccess@DEMO.LOCAL:Restricted@DEMO.LOCAL:Filtered@DEMO.LOCAL:Blocked@DEMO.LOCAL
ACL Definitions
acl FullAccess external kerberos_ldap_group FullAccess@DEMO.LOCAL
acl Restricted external kerberos_ldap_group Restricted@DEMO.LOCAL
acl Filtered external kerberos_ldap_group Filtered@DEMO.LOCAL
acl Blocked external kerberos_ldap_group Blocked@DEMO.LOCAL
acl allowed_sites dstdomain .benedictuspoort.be .smartschool.be .microsoft.com
acl bad_sites dstdomain .adult.com .gambling.com
Access Rules
http_access allow FullAccess
http_access allow Restricted allowed_sites
http_access deny Restricted
http_access deny Blocked
http_access deny Filtered bad_sites
http_access allow Filtered
http_access deny all
Proxy Settings
http_port 3128
cache_dir ufs /var/spool/squid 100 16 256
coredump_dir /var/spool/squid
What I Have Tried
-
Verified that the Kerberos keytab is up-to-date and matches the Key Version Number (
msDS-KeyVersionNumber) in Active Directory. -
Tested LDAP queries using
ldapsearch with both simple and GSSAPI bindings, which work intermittently. -
Checked Squid logs and confirmed that Kerberos tickets are being issued successfully using
kinit and klist.
Despite these efforts, the ext_kerberos_ldap_group_acl helper is unable to bind to the LDAP server, and the Squid service keeps restarting helpers.
Request for Assistance
Could you please provide guidance on:
-
Debugging the
ext_kerberos_ldap_group_acl helper? -
Ensuring compatibility between Kerberos and LDAP for group-based access control?
-
Any potential misconfigurations or missing steps in my setup?
Thank you in advance for your assistance. I look forward to your recommendations.
Kind regards,
Enfal gok
| 