Active-Directory
Squid 3.5.20 不通過 Active Directory 和 Kerberos 進行身份驗證
我通過 AD 和 Kerberos V5 製作透明代理。CentOS 以領域加入 Windows 域：
[root@vs-otr-squid02 ~]# realm list domain.ru type: kerberos realm-name: DOMAIN.RU domain-name: domain.ru configured: kerberos-member server-software: active-directory client-software: sssd required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd required-package: adcli required-package: samba-common-tools login-formats: %U@domain.ru login-policy: allow-realm-logins魷魚資料：
Squid Cache: Version 3.5.20 Service Name: squid configure options: '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--disable-strict-error-checking' '--exec_prefix=/usr' '--libexecdir=/usr/lib64/squid' '--localstatedir=/var' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--with-logdir=$(localstatedir)/log/squid' '--with-pidfile=$(localstatedir)/run/squid.pid' '--disable-dependency-tracking' '--enable-eui' '--enable-follow-x-forwarded-for' '--enable-auth' '--enable-auth-basic=DB,LDAP,MSNT-multi-domain,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB,SMB_LM,getpwnam' '--enable-auth-ntlm=smb_lm,fake' '--enable-auth-digest=file,LDAP,eDirectory' '--enable-auth-negotiate=kerberos' '--enable-external-acl-helpers=file_userip,LDAP_group,time_quota,session,unix_group,wbinfo_group,kerberos_ldap_group' '--enable-cache-digests' '--enable-cachemgr-hostname=localhost' '--enable-delay-pools' '--enable-epoll' '--enable-ident-lookups' '--enable-linux-netfilter' '--enable-removal-policies=heap,lru' '--enable-snmp' '--enable-ssl-crtd' '--enable-storeio=aufs,diskd,rock,ufs' '--enable-wccpv2' '--enable-esi' '--enable-ecap' '--with-aio' '--with-default-user=squid' '--with-dl' '--with-openssl' '--with-pthreads' '--disable-arch-native' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fpie' 'LDFLAGS=-Wl,-z,relro -pie -Wl,-z,relro -Wl,-z,now' 'CXXFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fpie' 'PKG_CONFIG_PATH=:/usr/lib64/pkgconfig:/usr/share/pkgconfig'密鑰表文件內容：
slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 3 HTTP/vs-otr-squid02@DOMAIN.RUAD 使用者 - squid2018，為它製作了這個 keytab 文件。確保：
[root@vs-otr-squid02 ~]# kinit HTTP/vs-otr-squid02@DOMAIN.RU Password for HTTP/vs-otr-squid02@DOMAIN.RU:squid2018 的密碼接受，收到票：
[root@vs-otr-squid02 ~]# klist Ticket cache: KEYRING:persistent:0:0 Default principal: HTTP/vs-otr-squid02@DOMAIN.RU Valid starting Expires Service principal 06/27/2018 12:05:09 06/27/2018 22:05:09 krbtgt/DOMAIN.RU@DOMAIN.RU renew until 07/04/2018 12:04:52刪除它。
設置 /etc/squid/squid.conf
# Active Directory auth_param negotiate program /usr/lib64/squid/negotiate_kerberos_auth -s HTTP/vs-otr-squid02@DOMAIN.RU auth_param negotiate children 600 auth_param negotiate keep_alive off external_acl_type ad_group_member_check ttl=120 %LOGIN /usr/lib64/squid/ext_ldap_group_acl -d -v3 -P -R -K -b "DC=domain,DC=ru" -D "vs-otr-squid02@domain.ru" -w VerySecretPassword -f "(&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru))" -h hs-dc-1.domain.ru # Authenticate acl auth proxy_auth REQUIRED acl ad_users external ad_group_member_check full_access # Standart ports acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT # Standart permisson http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager http_access allow localhost http_access allow auth # Permission for AD users http_access allow ad_users # Deny everything else http_access deny all # Proxy ports http_port 172.31.4.64:3128 http_port 172.31.4.64:3127 transparent # Cache settings refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 # DNS dns_nameservers 172.31.2.113 dns_v4_first on魷魚工作狀態：
[root@vs-otr-squid02 ~]# systemctl status squid ● squid.service - Squid caching proxy Loaded: loaded (/usr/lib/systemd/system/squid.service; enabled; vendor preset: disabled) Active: active (running) since Wed 2018-06-27 11:31:08 MSK; 42min ago Process: 2753 ExecStop=/usr/sbin/squid -k shutdown -f $SQUID_CONF (code=exited, status=0/SUCCESS) Process: 2762 ExecStart=/usr/sbin/squid $SQUID_OPTS -f $SQUID_CONF (code=exited, status=0/SUCCESS) Process: 2756 ExecStartPre=/usr/libexec/squid/cache_swap.sh (code=exited, status=0/SUCCESS) Main PID: 2765 (squid) CGroup: /system.slice/squid.service ├─2765 /usr/sbin/squid -f /etc/squid/squid.conf ├─2767 (squid-1) -f /etc/squid/squid.conf ├─2768 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D vs-otr-squid02@domain.ru -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru ├─2769 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D vs-otr-squid02@domain.ru -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru ├─2770 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D vs-otr-squid02@domain.ru -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru ├─2771 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D vs-otr-squid02@domain.ru -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru ├─2772 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D vs-otr-squid02@domain.ru -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru └─2773 (logfile-daemon) /var/log/squid/access.log Jun 27 11:31:08 vs-otr-squid02 systemd[1]: Starting Squid caching proxy... Jun 27 11:31:08 vs-otr-squid02 squid[2765]: Squid Parent: will start 1 kids Jun 27 11:31:08 vs-otr-squid02 squid[2765]: Squid Parent: (squid-1) process 2767 started Jun 27 11:31:08 vs-otr-squid02 systemd[1]: Started Squid caching proxy.但是瀏覽器會顯示一個輸入名稱和密碼的視窗，這是不應該的。好的，我輸入了，但是不被接受，在/var/log/squid/cache.log中：
2018/06/27 12:19:16 kid1| Accepting NAT intercepted HTTP Socket connections at local=172.31.4.64:3127 remote=[::] FD 24 flags=41 2018/06/27 12:19:29| Current Directory is / 2018/06/27 12:19:29 kid1| Preparing for shutdown after 0 requests 2018/06/27 12:19:29 kid1| Waiting 30 seconds for active connections to finish 2018/06/27 12:19:29 kid1| Closing HTTP port 172.31.4.64:3128 2018/06/27 12:19:29 kid1| Closing HTTP port 172.31.4.64:3127 2018/06/27 12:19:29 kid1| Current Directory is / 2018/06/27 12:19:29 kid1| Starting Squid Cache version 3.5.20 for x86_64-redhat-linux-gnu... 2018/06/27 12:19:29 kid1| Service Name: squid 2018/06/27 12:19:29 kid1| Process ID 2858 2018/06/27 12:19:29 kid1| Process Roles: worker 2018/06/27 12:19:29 kid1| With 16384 file descriptors available 2018/06/27 12:19:29 kid1| Initializing IP Cache... 2018/06/27 12:19:29 kid1| DNS Socket created at [::], FD 8 2018/06/27 12:19:29 kid1| DNS Socket created at 0.0.0.0, FD 10 2018/06/27 12:19:29 kid1| Adding nameserver 172.31.2.113 from squid.conf 2018/06/27 12:19:29 kid1| helperOpenServers: Starting 0/600 'negotiate_kerberos_auth' processes 2018/06/27 12:19:29 kid1| helperStatefulOpenServers: No 'negotiate_kerberos_auth' processes needed. 2018/06/27 12:19:29 kid1| helperOpenServers: Starting 5/5 'ext_ldap_group_acl' processes 2018/06/27 12:19:29 kid1| Logfile: opening log daemon:/var/log/squid/access.log 2018/06/27 12:19:29 kid1| Logfile Daemon: opening log /var/log/squid/access.log 2018/06/27 12:19:29 kid1| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec 2018/06/27 12:19:29 kid1| Store logging disabled 2018/06/27 12:19:29 kid1| Swap maxSize 0 + 262144 KB, estimated 20164 objects 2018/06/27 12:19:29 kid1| Target number of buckets: 1008 2018/06/27 12:19:29 kid1| Using 8192 Store buckets 2018/06/27 12:19:29 kid1| Max Mem size: 262144 KB 2018/06/27 12:19:29 kid1| Max Swap size: 0 KB 2018/06/27 12:19:29 kid1| Using Least Load store dir selection 2018/06/27 12:19:29 kid1| Current Directory is / 2018/06/27 12:19:29 kid1| Finished loading MIME types and icons. 2018/06/27 12:19:29 kid1| HTCP Disabled. 2018/06/27 12:19:29 kid1| Squid plugin modules loaded: 0 2018/06/27 12:19:29 kid1| Adaptation support is off. 2018/06/27 12:19:29 kid1| Accepting HTTP Socket connections at local=172.31.4.64:3128 remote=[::] FD 23 flags=9 2018/06/27 12:19:29 kid1| Accepting NAT intercepted HTTP Socket connections at local=172.31.4.64:3127 remote=[::] FD 24 flags=41 2018/06/27 12:19:30 kid1| storeLateRelease: released 0 objects 2018/06/27 12:19:46 kid1| Starting new negotiateauthenticator helpers... 2018/06/27 12:19:46 kid1| helperOpenServers: Starting 1/600 'negotiate_kerberos_auth' processes 2018/06/27 12:19:46 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }} 2018/06/27 12:19:50 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }} 2018/06/27 12:19:51 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }} 2018/06/27 12:19:51 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }} 2018/06/27 12:19:55 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }} 2018/06/27 12:19:55 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }} 2018/06/27 12:19:57 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }} 2018/06/27 12:19:59 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }} 2018/06/27 12:20:00 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }} 2018/06/27 12:20:03 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }} 2018/06/27 12:20:06 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}/var/log/squid/access.log
1530088115.039 4 172.31.10.71 TCP_DENIED/407 4164 CONNECT yandex.ru:443 - HIER_NONE/- text/html 1530088115.039 4 172.31.10.71 TCP_DENIED/407 4164 CONNECT yandex.ru:443 - HIER_NONE/- text/html 1530088115.039 4 172.31.10.71 TCP_DENIED/407 4176 CONNECT yastatic.net:443 - HIER_NONE/- text/html 1530088115.039 4 172.31.10.71 TCP_DENIED/407 4164 CONNECT yandex.ru:443 - HIER_NONE/- text/html 1530088115.039 4 172.31.10.71 TCP_DENIED/407 4164 CONNECT yandex.ru:443 - HIER_NONE/- text/html 1530088115.039 4 172.31.10.71 TCP_DENIED/407 4176 CONNECT yastatic.net:443 - HIER_NONE/- text/html 1530088115.039 4 172.31.10.71 TCP_DENIED/407 4176 CONNECT yastatic.net:443 - HIER_NONE/- text/html 1530088115.039 4 172.31.10.71 TCP_DENIED/407 4176 CONNECT yastatic.net:443 - HIER_NONE/- text/html 1530088115.039 4 172.31.10.71 TCP_DENIED/407 4176 CONNECT yastatic.net:443 - HIER_NONE/- text/html 1530088115.039 4 172.31.10.71 TCP_DENIED/407 4176 CONNECT yastatic.net:443 - HIER_NONE/- text/html 1530088115.047 0 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html 1530088116.578 1 172.31.10.71 TCP_DENIED/407 4333 CONNECT cdn.syndication.twimg.com:443 - HIER_NONE/- text/html 1530088116.585 7 172.31.10.71 TCP_DENIED/407 4313 CONNECT gekko.spiceworks.com:443 - HIER_NONE/- text/html 1530088116.585 6 172.31.10.71 TCP_DENIED/407 4269 CONNECT 3dnews.ru:443 - HIER_NONE/- text/html 1530088116.585 1 172.31.10.71 TCP_DENIED/407 5648 POST http://top-fwz1.mail.ru/tracker? - HIER_NONE/- text/html 1530088116.596 18 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html 1530088118.941 0 172.31.10.71 TCP_DENIED/407 4236 CONNECT googleads.g.doubleclick.net:443 - HIER_NONE/- text/html 1530088118.946 0 172.31.10.71 TCP_DENIED/407 4341 CONNECT googleads.g.doubleclick.net:443 - HIER_NONE/- text/html 1530088121.934 0 172.31.10.71 TCP_DENIED/407 4228 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html 1530088121.938 0 172.31.10.71 TCP_DENIED/407 4333 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html 1530088125.390 0 172.31.10.71 TCP_DENIED/407 4228 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html 1530088125.393 0 172.31.10.71 TCP_DENIED/407 4333 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html 1530091186.082 0 172.31.10.71 TCP_DENIED/407 4164 CONNECT yandex.ru:443 - HIER_NONE/- text/html 1530091186.103 17 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html 1530091190.539 1 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html 1530091191.307 1 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html 1530091191.770 0 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html 1530091195.390 0 172.31.10.71 TCP_DENIED/407 4164 CONNECT yandex.ru:443 - HIER_NONE/- text/html 1530091195.395 0 172.31.10.71 TCP_DENIED/407 4228 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html 1530091195.396 1 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html 1530091195.398 0 172.31.10.71 TCP_DENIED/407 4333 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html 1530091197.499 0 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html 1530091199.183 0 172.31.10.71 TCP_DENIED/407 4348 GET http://forundex.ru/unix%20linux/favicon.ico - HIER_NONE/- text/html 1530091199.185 0 172.31.10.71 TCP_DENIED/407 4453 GET http://forundex.ru/unix%20linux/favicon.ico - HIER_NONE/- text/html 1530091200.420 0 172.31.10.71 TCP_DENIED/407 4228 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html 1530091200.423 0 172.31.10.71 TCP_DENIED/407 4333 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html 1530091203.169 0 172.31.10.71 TCP_DENIED/407 4228 CONNECT cdn.syndication.twimg.com:443 - HIER_NONE/- text/html 1530091203.172 0 172.31.10.71 TCP_DENIED/407 4333 CONNECT cdn.syndication.twimg.com:443 - HIER_NONE/- text/html 1530091206.171 0 172.31.10.71 TCP_DENIED/407 4208 CONNECT gekko.spiceworks.com:443 - HIER_NONE/- text/html 1530091206.174 0 172.31.10.71 TCP_DENIED/407 4313 CONNECT gekko.spiceworks.com:443 - HIER_NONE/- text/html我需要幫助。感謝進階。
解決了。Keytab 文件必須包含以下條目：
HTTP/vs-otr-squid02.domain.ru@DOMAIN.RU不是
HTTP/vs-otr-squid02@DOMAIN.RU