vgasys писал(а):"/usr/local/libexec/squid/squid_ldap_auth -R -b "dc=mydomain,dc=ru" -f "(&(objectClass=person)(sAMAccountName=%s))" -u sAMAccountName -D ldap@mydomain.ru -W /usr/local/etc/squid/ldap.txt 192.168.0.1
username password
Ок"
но при этом же если username="Imya Familiya" то не работает
подскажите где копать
если можно примером покажите
, но да ладно, ща посмотрю 
Код: Выделить всё
//> /usr/local/libexec/squid/squid_ldap_auth \
-b "ou=dep,dc=domain,dc=local" -D ldap@domain.local -w password_ldap \
-f "(&(objectClass=person)(sAMAccountName=%s))" -u sAMAccountName \
-h 192.168.55.1 -p 389
# Далее вводим логин и пароль пользователя из AD (через пробел)
user password
OK (Значит все отлично)
ERR Success (Значит аутентификация не прошла)Код: Выделить всё
auth_param basic program /usr/local/libexec/squid/squid_ldap_auth -b "dc=domain,dc=ru" -D login@domain.ru -w password -f "(&(objectClass=person)(sAMAccountName=%s))" -u sAMAccountName -h ip_domain_serv -p 389
auth_param basic children 5
auth_param basic realm login \ password "bla bla bla" :)
auth_param basic credentialsttl 2 hoursКод: Выделить всё
Проверим
//> /usr/local/libexec/squid/squid_ldap_auth \
-b "ou=dep,dc=domain,dc=local" -D ldap@domain.local -w password_ldap \
-f "(&(objectClass=person)(sAMAccountName=%s))" -u sAMAccountName \
-h 192.168.55.1 -p 389Код: Выделить всё
[root@proxy /]# /usr/local/libexec/squid/squid_ldap_auth \ -b "ou=dep,dc=domain,dc=local" -D ldap@domain.local -w password_ldap \ -f "(&(objectClass=person)(sAMAccountName=%s))" -u sAMAccountName \ -h 192.168.55.1 -p 389
Usage: squid_ldap_auth -b basedn [options] [ldap_server_name[:port]]...
-b basedn (REQUIRED) base dn under which to search
-f filter search filter to locate user DN
-u userattr username DN attribute
-s base|one|sub search scope
-D binddn DN to bind as to perform searches
-w bindpasswd password for binddn
-W secretfile read password for binddn from file secretfile
-H URI LDAPURI (defaults to ldap://localhost)
-h server LDAP server (defaults to localhost)
-p port LDAP server port
-P persistent LDAP connection
-c timeout connect timeout
-t timelimit search time limit
-R do not follow referrals
-a never|always|search|find
when to dereference aliases
-v 2|3 LDAP version
-Z TLS encrypt the LDAP connection, requires LDAP version 3
-d enable debug mode
If no search filter is specified, then the dn <userattr>=user,basedn
will be used (same as specifying a search filter of '<userattr>=',
but quicker as as there is no need to search for the user DN)
If you need to bind as a user to perform searches then use the
-D binddn -w bindpasswd or -D binddn -W secretfile optionsКод: Выделить всё
auth_param basic program /usr/local/libexec/squid/squid_ldap_auth \
-b "ou=dep,dc=ad,dc=valaam,dc=local" -D ldap@ad.valaam.local -w password_ldap \
-f "(&(objectClass=person)(sAMAccountName=%s))" -u sAMAccountName \
-h 192.168.0.106 -p 389Код: Выделить всё
[root@proxy ~]# /usr/local/libexec/squid/squid_ldap_auth \
> -b "ou=dep,dc=ad,dc=valaam,dc=local" -D ldap@ad.valaam.local -w password_ldap \
> -f "(&(objectClass=person)(sAMAccountName=%s))" -u sAMAccountName \
> -h 192.168.0.106 -p 389
ldap password_ldap
squid_ldap_auth: WARNING, LDAP search error 'No such object'
ERR SuccessЕще есть kerberosCancer писал(а):Я знаю только 4 способа авторизации
1. NCSA (авторизация с запросом логина и пароля, пользователи и пароли хранятся на проксе)
2. LDAP (авторизация по логину и паролю, но пользователи и пароли хранятся в AD)
3. NTLM (авторизация без запроса логина и пароля, пользователи и пароли берутся из AD, авторизуется по сеансу доменного пользователя)
4. IP (тут думаю понятно!, авторизация по IP адресу, без запроса логина и пароля)
Код: Выделить всё
[client]
SQUID_DB=squidlog
SAMS_DB=squidctrl
MYSQLHOSTNAME=localhost
MYSQLUSER=sams
MYSQLPASSWORD=password
MYSQLVERSION=5.1
SQUIDCACHEFILE=access.log
SQUIDROOTDIR=/usr/local/etc/squid
SQUIDLOGDIR=/usr/local/squid/logs
SQUIDCACHEDIR=/usr/local/squid/cashe
SAMSPATH=/usr/local
SQUIDPATH=/usr/local/sbin
#SQUIDGUARDLOGPATH=/var/log
#SQUIDGUARDDBPATH=/var/db/squidGuard
RECODECOMMAND=/usr/local/bin/iconv -f KOI8-R -t 866 %finp > %fout
#RECODECOMMAND=/usr/local/bin/iconv -f KOI8-R -t CP1251 %finp > %fout
LDAPSERVER=192.158.135.2
LDAPBASEDN=domain.local
LDAPUSER=squidreader
LDAPUSERPASSWD=squidreader
LDAPUSERSGROUP=admin
REJIKPATH=/usr/local/rejik
SHUTDOWNCOMMAND=/sbin/shutdown -h now
CACHENUM=0
Код: Выделить всё
# created by SAMS _sams_ 2012-2-20 12:16:14
#
# Recommended minimum configuration:
#
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
#acl inetusers external ldap_users InternetUsers
#acl Privilegy_users external ldap_users InternetPrivilegyUsers
#acl ad64 external ldap_users inet_64k
#acl ad128 external ldap_users inet_128k
#acl ad1024 external ldap_users inet_1024k
#
# Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost
# And finally deny all other access to this proxy
http_access deny all
# Squid normally listens to port 3128
http_port 3128
# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /var/squid/cache 100 16 256
# Leave coredumps in the first cache dir
coredump_dir /var/squid/cache
access_log /usr/local/squid/logs/access.log squid
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
#Recommended minimum configuration per scheme:
/usr/local/libexec/squid/squid_ldap_auth -R -D squidreader@domain.local -W /usr/local/etc/squid/adpw.txt -b "dc=rkbsemashko,dc=local" -f "sAMAccountName=%s" 192.168.135.2
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
#http_access allow ad128
#delay_class 3 1
#delay_access 3 allow ad128
#delay_access 3 deny all
Код: Выделить всё
GW# /usr/local/libexec/squid/squid_ldap_auth -R -D squidreader@domain.local -W /usr/local/etc/squid/adpw.txt -b "dc=domain,dc=local" -f "sAMAccountName=%s" 192.168.135.2
squidreader squidreader
OK
freebsd2 123
OK
Код: Выделить всё
In file included from /usr/local/included/apache2/httpd.h:44
from /user/ports/lang/php52/work/php-5.2.17/sapi/apache2hedliner/php_apache.h:24
php_apache.h:24,
from /user/ports/lang/php52/work/php-5.2.17/sapi/apache2hedliner/mod_php5.c:26:
/usr/local/include/apache2/ap_regex.h:90: error: conflicting type for 'regoff_t'
/usr/ports/lang/php52/work/php-5.2.17/regex.h:17: error: previous declaration of 'regoff_t' was here
*** Error code 1
1 error
*** Error code 1
Stop in /usr/ports/lang/php52.
*** Ereror code 1
Stop in /usr/ports/lang/php52.
vi /usr/local/include/apache2/ap_regex.hzhna писал(а):проблемма заключается в следующем делаю в сё по статье но вот при установке php52(кретична версия или можно ставить любую?)
возникают следующие ошибкинарод помогите в чём я ошибся !?Код: Выделить всё
In file included from /usr/local/included/apache2/httpd.h:44 from /user/ports/lang/php52/work/php-5.2.17/sapi/apache2hedliner/php_apache.h:24 php_apache.h:24, from /user/ports/lang/php52/work/php-5.2.17/sapi/apache2hedliner/mod_php5.c:26: /usr/local/include/apache2/ap_regex.h:90: error: conflicting type for 'regoff_t' /usr/ports/lang/php52/work/php-5.2.17/regex.h:17: error: previous declaration of 'regoff_t' was here *** Error code 1 1 error *** Error code 1 Stop in /usr/ports/lang/php52. *** Ereror code 1 Stop in /usr/ports/lang/php52.
Код: Выделить всё
AIvanov
BPetrov
CSidorov
Код: Выделить всё
aivanov
bpetrov
csidorov
Код: Выделить всё
RECODECOMMAND=tr "[:upper:]" "[:lower:]" < %finp > %fout