forum.lissyara.su

Код: Выделить всё

2014/03/31 19:23:09| squid_kerb_auth: WARNING: received type 1 NTLM token
2014/03/31 19:23:09| authenticateNegotiateHandleReply: Error validating user via Negotiate. Error returned 'BH received type 1 NTLM token'
2014/03/31 19:24:06| squid_kerb_auth: DEBUG: Got 'YR TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAFASgKAAAADw==' from squid (length: 59).
2014/03/31 19:24:06| squid_kerb_auth: DEBUG: Decode 'TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAFASgKAAAADw==' (decoded length: 40).
2014/03/31 19:24:06| squid_kerb_auth: WARNING: received type 1 NTLM token
2014/03/31 19:24:06| authenticateNegotiateHandleReply: Error validating user via Negotiate. Error returned 'BH received type 1 NTLM token'
2014/03/31 19:24:40| squid_kerb_auth: DEBUG: Got 'YR TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAFASgKAAAADw==' from squid (length: 59).
2014/03/31 19:24:40| squid_kerb_auth: DEBUG: Decode 'TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAFASgKAAAADw==' (decoded length: 40).
2014/03/31 19:24:40| squid_kerb_auth: WARNING: received type 1 NTLM token
2014/03/31 19:24:40| authenticateNegotiateHandleReply: Error validating user via Negotiate. Error returned 'BH received type 1 NTLM token'

Код: Выделить всё

visible_hostname localhost
http_port 3128
access_log /var/log/squid/access.log squid

auth_param negotiate program /usr/lib64/squid/negotiate_kerb_auth -d -s HTTP/proxy.mydomain.local@MYDOMAIN.LOCAL
auth_param negotiate children 10
auth_param negotiate keep_alive on

external_acl_type ldap_search %LOGIN \
/usr/lib64/squid/squid_ldap_group \
-R -b "dc=mydomain,dc=local" \
-f "(&(sAMAccountName=%v)(memberof=cn=%a,OU=proxy,DC=mydomain,DC=local))" \
-D pr0xy@mydomain.local -W /etc/squid/squid.pass \
-K -h sgbs.mydomain.local
acl i_allowed external ldap_search internet

acl AUTHENTICATED proxy_auth REQUIRED

acl localnet dst 192.168.10.0/24
http_access allow AUTHENTICATED localnet
http_access allow i_allowed
http_access deny all

Код: Выделить всё

/usr/lib64/squid/squid_ldap_group \
> -R -b "dc=mydomain,dc=local" \
> -f "(&(sAMAccountName=%v)(memberof=cn=%a,OU=proxy,DC=mydomain,DC=local))" \
> -D pr0xy@mydomain.local -W /etc/squid/squid.pass \
> -K -h sgbs.mydomain.local
user internet
OK
user2 internet
ERR

Код: Выделить всё

[root@proxy init.d]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: HTTP/proxy.mydomain.local@MYDOMAIN.LOCAL

Valid starting     Expires            Service principal
03/27/14 23:10:07  03/28/14 09:10:08  krbtgt/MYDOMAIN.LOCAL@MYDOMAIN.LOCAL
        renew until 03/28/14 23:10:07