Код: Выделить всё
auth_param basic program /usr/local/libexec/squid/squid_ldap_auth -b "dc=khab,dc
-D ldap@khab.drsk.rao-esv.ru -W /usr/local/etc/squid/adpw -f "(&(memberOf=inet)(sAMAccountName=s%))
-u sAMAccountName -h 172.21.1.2 -p 389
auth_param basic children 5
auth_param basic realm khab.drsk.rao-esv.ru
auth_param basic credentialsttl 2 hours
Код: Выделить всё
/usr/local/libexec/squid/squid_ldap_group -R -d -b "dc=khab,dc=drsk,dc=rao-esv,dc=ru" \
-f "(&(objectclass=user)(sAMAccountName=%v)(memberOf=cn=inet,ou=Users,dc=khab,dc=drsk,dc=rao-esv,dc=ru))"\
-D ldap@khab.drsk.rao-esv.ru -W /usr/local/etc/squid/adpw -h 172.21.1.2 \
test squid-listКод: Выделить всё
external_acl_type ldap_user_HTTP %LOGIN /usr/squid/libexec/squid_ldap_group -R -b "dc=domain,dc=ru" -D user@domain.ru -W /etc/squid/authpass -K -h dc1.domain.ru -d -f "(&(memberof=CN=%g,OU=Служебные группы,OU=Тут еще группа,DC=domain,DC=ru))"
acl ldap_HTTP external ldap_user_HTTP "/etc/squid/internet_group.conf"
http_access allow ldap_HTTPКод: Выделить всё
/etc/squid$ pkg info openldap
........
Version: 2.4.25
Код: Выделить всё
The ldap_user_HTTP helpers are crashing too rapidly. need help!Код: Выделить всё
auth_param negotiate program /usr/local/libexec/squid/squid_kerb_auth
auth_param negotiate children 15
auth_param negotiate keep_alive on
external_acl_type ldap_user_HTTP %LOGIN /usr/squid/libexec/squid_ldap_group -R -
acl ldap_HTTP external ldap_user_HTTP "/usr/local/etc/squid/internet_group.conf"
# acl
немного обманул с конфигом)Sorryxs писал(а):Mikl можешь весь конф дать?)))
Код: Выделить всё
# cat squid_acl.conf
auth_param negotiate program /usr/squid/libexec/squid_kerb_auth -s host/hostname.domain.ru@DOMAIN.RU
auth_param negotiate children 5
auth_param negotiate keep_alive on
#acl auth proxy_auth REQUIRED
external_acl_type ldap_user_HTTP ttl=100 %LOGIN /usr/squid/libexec/squid_ldap_group -R -b "dc=domain,dc=ru" -D user@domain.ru -W /etc/squid/authpass -K -h dc.domain.ru -d -f "(&(memberof=CN=%g,OU=Служебные группы,OU=Управление ИС,DC=domain,DC=ru)(sAMAccountName=%u))"
acl ldap_HTTP external ldap_user_HTTP "/etc/squid/internet_group.conf"
http_access allow ldap_HTTP
http_access deny all
debug_options ALL,1 33,2 29,4 82,4 28,4Код: Выделить всё
# cat internet_group.conf
Internet HTTPКод: Выделить всё
2012/07/16 05:47:09.876| externalAclLookup: lookup in 'ldap_user_HTTP' for 'username@domain.RU Internet%20HTTP'
2012/07/16 05:47:09.876| externalAclLookup: looking up for 'username@domain.RU Internet%20HTTP' in 'ldap_user_HTTP'.
2012/07/16 05:47:09.876| externalAclLookup: will wait for the result of 'username@domain.RU Internet%20HTTP' in 'ldap_user_HTTP' (ch=0x861fda8).
2012/07/16 05:47:09.876| aclmatchAclList: async=1 nodeMatched=0 async_in_progress=1 lastACLResult() = 0 finished() = 0
Connected OK
group filter '(&(memberof=CN=Internet HTTP,OU=Служебные группы,OU=Управление ИС,DC=domain,DC=ru)(sAMAccountName=username))', searchbase 'dc=domain,dc=ru'
2012/07/16 05:47:09.884| externalAclHandleReply: reply="OK"
2012/07/16 05:47:09.884| external_acl_cache_add: Adding 'username@domain.RU Internet%20HTTP' = 1Код: Выделить всё
2012/09/17 13:44:42| Starting Squid Cache version 3.1.20 for amd64-portbld-freebsd9.0...
2012/09/17 13:44:42| Process ID 57023
2012/09/17 13:44:42| With 7120 file descriptors available
2012/09/17 13:44:42| Initializing IP Cache...
2012/09/17 13:44:42| DNS Socket created at 0.0.0.0, FD 7
2012/09/17 13:44:42| Adding domain khab.drsk.ru from /etc/resolv.conf
2012/09/17 13:44:42| Adding nameserver 8.8.8.8 from /etc/resolv.conf
2012/09/17 13:44:42| Adding nameserver 172.21.1.2 from /etc/resolv.conf
2012/09/17 13:44:42| Adding nameserver 172.21.1.17 from /etc/resolv.conf
2012/09/17 13:44:42| helperOpenServers: Starting 5/5 'squid_kerb_auth' processes
2012/09/17 13:44:42| helperOpenServers: Starting 5/5 'squid_ldap_group' processes
2012/09/17 13:44:43| Unlinkd pipe opened on FD 32
2012/09/17 13:44:43| Store logging disabled
2012/09/17 13:44:43| Swap maxSize 0 + 262144 KB, estimated 20164 objects
2012/09/17 13:44:43| Target number of buckets: 1008
2012/09/17 13:44:43| Using 8192 Store buckets
2012/09/17 13:44:43| Max Mem size: 262144 KB
2012/09/17 13:44:43| Max Swap size: 0 KB
2012/09/17 13:44:43| Using Least Load store dir selection
2012/09/17 13:44:43| Set Current Directory to /var/squid/cache
2012/09/17 13:44:43| Loaded Icons.
2012/09/17 13:44:43| Accepting HTTP connections at 172.21.1.210:8080, FD 33.
2012/09/17 13:44:43| HTCP Disabled.
2012/09/17 13:44:43| Ready to serve requests.
2012/09/17 13:44:44| storeLateRelease: released 0 objects
Код: Выделить всё
# Recommended minimum configuration:
# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
auth_param negotiate program /usr/local/libexec/squid/squid_kerb_auth -s 172.21.1.2/rsk50srv002@khab.drsk.rao-esv.ru
auth_param negotiate children 5
auth_param negotiate keep_alive on
#acl ldap_HTTP proxy_auth REQUIRED
external_acl_type ldap_user_HTTP ttl=100 %LOGIN /usr/local/libexec/squid/squid_ldap_group -R -b "OU=Users,DC=KHAB,DC=DRSK,DC=RAO-ESV,DC=RU" -D ldap@khab.drsk.rao-esv.ru -w пароль -K -h 172.21.1.2 -d -f "(&(memberof=CN=%g,OU=Users,DC=KHAB,DC=DRSK,DC=RAO-ESV,DC=ru)(sAMAccountName=%u))"
acl ldap_HTTP external ldap_user_HTTP "/usr/local/etc/squid/internet_group.conf"
http_access allow ldap_HTTP
http_access deny all
debug_options ALL,1 33,2 29,4 82,4 28,4
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
acl allow_hosts src "/usr/local/etc/squid/allow_hosts"
#
# Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow allow_hosts
http_access deny all
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
# And finally deny all other access to this proxy
http_access deny all
# Squid normally listens to port 3128
http_port 172.21.1.210:8080
# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /var/squid/cache 100 16 256
# Leave coredumps in the first cache dir
coredump_dir /var/squid/cache
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
# Squid public name
visible_hostname rsk50srv003
#url_rewrite_program /usr/local/rejik/redirector /usr/local/rejik/redirector.conf
Код: Выделить всё
RSK50SRV003# /usr/local/libexec/squid/squid_ldap_group -R -b "OU=Users,DC=KHAB,D
C=DRSK,DC=RAO-ESV,DC=RU" -D ldap@khab.drsk.rao-esv.ru -w atlonxp -K -h 172.21.1.
2 -d -f "(&(memberOf=CN=%g,OU=Users,DC=khab,DC=drsk,DC=rao-esv,DC=ru)(sAMAccount
Name=%u))"
(&(memberOf=CN=%g,OU=Users,DC=khab,DC=drsk,DC=rao-esv,DC=ru)(sAMAccountName=%u))
: Invalid request
ERR
Код: Выделить всё
2012/09/18 15:28:08.763| authenticateAuthenticate: broken auth or no proxy_auth header. Requesting auth header.
2012/09/18 15:28:08.763| Acl.cc(70) AuthenticateAcl: returning 0 sending authentication challenge.
2012/09/18 15:28:08.763| aclMatchExternal: ldap_user_HTTP user not authenticated (0)
2012/09/18 15:28:08.763| ACL::ChecklistMatches: result for 'ldap_HTTP' is 0
2012/09/18 15:28:08.763| ACLList::matches: result is false
2012/09/18 15:28:08.763| aclmatchAclList: 0x802665a98 returning false (AND list entry failed to match)
2012/09/18 15:28:08.763| ACLChecklist::markFinished: 0x802665a98 checklist processing finished
2012/09/18 15:28:08.763| aclmatchAclList: async=1 nodeMatched=0 async_in_progress=0 lastACLResult() = 0 finished() = 1
2012/09/18 15:28:08.763| ACLChecklist::check: 0x802665a98 match found, calling back with 2
2012/09/18 15:28:08.763| ACLChecklist::checkCallback: 0x802665a98 answer=2
2012/09/18 15:28:08.764| FilledChecklist.cc(168) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0x802665a98
2012/09/18 15:28:08.764| ACLChecklist::~ACLChecklist: destroyed 0x802665a98
2012/09/18 15:28:08.764| FilledChecklist.cc(168) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0x802665a98
2012/09/18 15:28:08.764| ACLChecklist::~ACLChecklist: destroyed 0x802665a98
2012/09/18 15:28:08.778| ACLChecklist::preCheck: 0x802665a98 checking 'http_access allow ldap_HTTP'
2012/09/18 15:28:08.778| ACLList::matches: checking ldap_HTTP
2012/09/18 15:28:08.778| ACL::checklistMatches: checking 'ldap_HTTP'
2012/09/18 15:28:08.778| authenticateValidateUser: Auth_user_request was NULL!
2012/09/18 15:28:08.778| authenticateAuthenticate: broken auth or no proxy_auth header. Requesting auth header.
2012/09/18 15:28:08.778| Acl.cc(70) AuthenticateAcl: returning 0 sending authentication challenge.
2012/09/18 15:28:08.778| aclMatchExternal: ldap_user_HTTP user not authenticated (0)
2012/09/18 15:28:08.778| ACL::ChecklistMatches: result for 'ldap_HTTP' is 0
2012/09/18 15:28:08.778| ACLList::matches: result is false
2012/09/18 15:28:08.778| aclmatchAclList: 0x802665a98 returning false (AND list entry failed to match)
2012/09/18 15:28:08.778| ACLChecklist::markFinished: 0x802665a98 checklist processing finished
2012/09/18 15:28:08.778| aclmatchAclList: async=1 nodeMatched=0 async_in_progress=0 lastACLResult() = 0 finished() = 1
2012/09/18 15:28:08.778| ACLChecklist::check: 0x802665a98 match found, calling back with 2
2012/09/18 15:28:08.778| ACLChecklist::checkCallback: 0x802665a98 answer=2
2012/09/18 15:28:08.778| FilledChecklist.cc(168) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0x802665a98
2012/09/18 15:28:08.778| ACLChecklist::~ACLChecklist: destroyed 0x802665a98
2012/09/18 15:28:08.778| FilledChecklist.cc(168) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0x802665a98
2012/09/18 15:28:08.778| ACLChecklist::~ACLChecklist: destroyed 0x802665a98
2012/09/18 15:28:08.787| ConnStateData::swanSong: FD 55
2012/09/18 15:28:20.522| ConnStateData::swanSong: FD 54
2012/09/18 15:28:22.416| ConnStateData::swanSong: FD 43
2012/09/18 15:28:22.416| ConnStateData::swanSong: FD 40
2012/09/18 15:28:22.416| ConnStateData::swanSong: FD 53
2012/09/18 15:28:22.416| ConnStateData::swanSong: FD 38
Код: Выделить всё
RSK50SRV003# /usr/local/libexec/squid/squid_ldap_group -R -b "CN=Users,DC=khab,DC=drsk,DC=rao-esv,DC=ru" -D ldap@khab.drsk.rao-esv.ru -w atlonxp -K -h 172.21.1.2 -d -f "(&(memberof=CN=%g,DC=khab,DC=drsk,DC=rao-esv,DC=ru)(sAMAccountName=%u))"
Yozi inet
Connected OK
group filter '(&(memberof=CN=inet,DC=khab,DC=drsk,DC=rao-esv,DC=ru)(sAMAccountName=Yozi))', searchbase 'CN=Users,DC=khab,DC=drsk,DC=rao-esv,DC=ru'
ERR