Squid + AD

[BEEn]

Прошу помощи, керб авторизация работает, группы вытыщить пока не получается... пользователей которым нужен инет не так много поэтому буду пускать в инет по списку... так же есть белые сайты к которым нужен доступ всем и авторизированным и неавторизированным... как отключить выскакивающее окно авторизации?

Код: Выделить всё

auth_param negotiate program /usr/local/libexec/squid/negotiate_kerberos_auth -d -s HTTP/gate.my.org.com
auth_param negotiate children 10
auth_param negotiate keep_alive on

acl localnet src 10.0.0.0/8	# RFC1918 possible internal network
acl localnet src 172.16.0.0/12	# RFC1918 possible internal network
acl localnet src 192.168.0.0/16	# RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 443
acl Safe_ports port 80		# http
acl Safe_ports port 21		# ftp
acl Safe_ports port 443		# https
acl Safe_ports port 70		# gopher
acl Safe_ports port 210		# wais
acl Safe_ports port 1025-65535	# unregistered ports
acl Safe_ports port 280		# http-mgmt
acl Safe_ports port 488		# gss-http
acl Safe_ports port 591		# filemaker
acl Safe_ports port 777		# multiling http
acl CONNECT method CONNECT
acl auth_users proxy_auth REQUIRED
acl inet-users proxy_auth "/usr/local/etc/squid/db/users.txt"

acl deny_url url_regex "/usr/local/etc/squid/db/deny_url.txt"
acl deny_domains dstdomain "/usr/local/etc/squid/db/deny_domains.txt"
#acl allow_ip "/usr/local/etc/squid/db/allow_ip.txt"
acl allow_all dstdomain "/usr/local/etc/squid/db/allow_all.txt"

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access deny deny_url
http_access deny deny_domains

deny_info       ERR_BAD_URL             bad_url
deny_info       ERR_BAD_NETWORKS        bad_networks
deny_info       ERR_DENY_DOMAINS        deny_domains
deny_info       ERR_SAFE_PORTS          safe_ports
deny_info       ERR_SSL_PORTS           SSL_ports

#external_acl_type inet-users  ttl=3600  negative_ttl=3600 %LOGIN /usr/local/libexec/squid/ext_kerberos_ldap_group_acl -g inet-users
#http_access deny to_localhost
http_access allow inet-users
#http_access allow localnet
http_access allow localhost
http_access allow allow_all
http_access deny allow_all
deny_info ERR_INET_NO_ALLOW all
http_access deny all
http_port 3128
#debug_options ALL,1 33,2 28,9
coredump_dir /var/squid/cache/squid

refresh_pattern ^ftp:		1440	20%	10080
refresh_pattern ^gopher:	1440	0%	1440
refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
refresh_pattern .		0	20%	4320

[Хостинг HostFood.ru]

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

[BEEn]

Пользователи на терминальном сервере...
оказывается список не цепляет, а проходит авторизация под одним и тем же пользователем... и если его нет в списке то access denied

[BEEn]

Заработало по группам... инструкцию брал не здесь... а зря ))

Код: Выделить всё

 cat /usr/local/etc/squid/squid.conf   auth_param negotiate program /usr/local/libexec/squid/negotiate_kerberos_auth -s HTTP/gate.my.company.com
auth_param negotiate children 10
auth_param negotiate keep_alive on

acl localnet src 10.0.0.0/8	# RFC1918 possible internal network
acl localnet src 172.16.0.0/12	# RFC1918 possible internal network
acl localnet src 192.168.0.0/16	# RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 443
acl Safe_ports port 80		# http
acl Safe_ports port 21		# ftp
acl Safe_ports port 443		# https
acl Safe_ports port 70		# gopher
acl Safe_ports port 210		# wais
acl Safe_ports port 1025-65535	# unregistered ports
acl Safe_ports port 280		# http-mgmt
acl Safe_ports port 488		# gss-http
acl Safe_ports port 591		# filemaker
acl Safe_ports port 777		# multiling http
acl CONNECT method CONNECT
external_acl_type ldap_search ttl=3600 negative_ttl=3600 %LOGIN /usr/local/libexec/squid/ext_kerberos_ldap_group_acl -R -b "dc=my,dc=company,dc=com" -f "(&(samaccountname=%v)(memberof=cn=%a,cn=users,DC=my,DC=company,DC=com))" -D squid@my.company.com -W /usr/local/etc/squid/authpw -K -h srv.my.company.com
acl auth_users proxy_auth REQUIRED
acl inet-users external ldap_search inet-users
acl in-users external ldap_search in-users

acl deny_url url_regex "/usr/local/etc/squid/db/deny_url.txt"
acl deny_domains dstdomain "/usr/local/etc/squid/db/deny_domains.txt"
#acl allow_ip "/usr/local/etc/squid/db/allow_ip.txt"
acl url-good dstdomain "/usr/local/etc/squid/db/url_good.txt"
#acl urls-good urlpath_regex -i "/usr/local/etc/squid/db/urls_good.txt"
acl media rep_mime_type -i ^audio/*
acl media rep_mime_type -i ^video/*
acl obed time SMTWHFA 12:30-13:30
#acl night time SMTWHFA 20:00-23:59
#acl night2 time SMTWHFA 00:01-06:59

http_access deny !Safe_ports
#http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager

deny_info       ERR_BAD_URL             bad_url
deny_info       ERR_BAD_NETWORKS        bad_networks
deny_info       ERR_DENY_DOMAINS        deny_domains
deny_info       ERR_SAFE_PORTS          safe_ports
deny_info       ERR_SSL_PORTS           SSL_ports
#http_access deny to_localhost
#http_access allow localnet
http_access allow all obed
http_access allow localhost
http_reply_access deny media
http_access deny deny_url
http_access deny deny_domains
http_access allow !deny_url !deny_domains inet-users
http_access allow url-good in-users

deny_info ERR_INET_NO_ALLOW all
http_access deny all
http_port 3128
coredump_dir /var/squid/cache/squid

refresh_pattern ^ftp:		1440	20%	10080
refresh_pattern ^gopher:	1440	0%	1440
refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
refresh_pattern .		0	20%	4320