Вопросы Теги

Squid 3.5.20 не аутентифицируется через Active Directory и Kerberos

Я делаю прозрачный прокси через AD и Kerberos V5. CentOS присоединился к домену Windows с областью: 

[root@vs-otr-squid02 ~]# realm list
domain.ru
  type: kerberos
  realm-name: DOMAIN.RU
  domain-name: domain.ru
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common-tools
  login-formats: %U@domain.ru
  login-policy: allow-realm-logins

Информация о Squid: 

Squid Cache: Version 3.5.20
Service Name: squid
configure options:  '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--disable-strict-error-checking' '--exec_prefix=/usr' '--libexecdir=/usr/lib64/squid' '--localstatedir=/var' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--with-logdir=$(localstatedir)/log/squid' '--with-pidfile=$(localstatedir)/run/squid.pid' '--disable-dependency-tracking' '--enable-eui' '--enable-follow-x-forwarded-for' '--enable-auth' '--enable-auth-basic=DB,LDAP,MSNT-multi-domain,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB,SMB_LM,getpwnam' '--enable-auth-ntlm=smb_lm,fake' '--enable-auth-digest=file,LDAP,eDirectory' '--enable-auth-negotiate=kerberos' '--enable-external-acl-helpers=file_userip,LDAP_group,time_quota,session,unix_group,wbinfo_group,kerberos_ldap_group' '--enable-cache-digests' '--enable-cachemgr-hostname=localhost' '--enable-delay-pools' '--enable-epoll' '--enable-ident-lookups' '--enable-linux-netfilter' '--enable-removal-policies=heap,lru' '--enable-snmp' '--enable-ssl-crtd' '--enable-storeio=aufs,diskd,rock,ufs' '--enable-wccpv2' '--enable-esi' '--enable-ecap' '--with-aio' '--with-default-user=squid' '--with-dl' '--with-openssl' '--with-pthreads' '--disable-arch-native' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -fpie' 'LDFLAGS=-Wl,-z,relro  -pie -Wl,-z,relro -Wl,-z,now' 'CXXFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -fpie' 'PKG_CONFIG_PATH=:/usr/lib64/pkgconfig:/usr/share/pkgconfig'

Содержимое файла Keytab: 

slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    3               HTTP/vs-otr-squid02@DOMAIN.RU

Пользователь AD - squid2018, для него был создан этот файл keytab. Убедитесь, что: 

[root@vs-otr-squid02 ~]# kinit HTTP/vs-otr-squid02@DOMAIN.RU
Password for HTTP/vs-otr-squid02@DOMAIN.RU:

Пароль для squid2018 принят, билет получен: 

[root@vs-otr-squid02 ~]# klist
Ticket cache: KEYRING:persistent:0:0
Default principal: HTTP/vs-otr-squid02@DOMAIN.RU

Valid starting       Expires              Service principal
06/27/2018 12:05:09  06/27/2018 22:05:09  krbtgt/DOMAIN.RU@DOMAIN.RU
        renew until 07/04/2018 12:04:52

Удалить его.

Настройки /etc/squid/squid.conf

# Active Directory
auth_param negotiate program /usr/lib64/squid/negotiate_kerberos_auth -s HTTP/vs-otr-squid02@DOMAIN.RU
auth_param negotiate children 600
auth_param negotiate keep_alive off

external_acl_type ad_group_member_check ttl=120 %LOGIN /usr/lib64/squid/ext_ldap_group_acl -d -v3 -P -R -K -b "DC=domain,DC=ru" -D "vs-otr-squid02@domain.ru" -w VerySecretPassword -f "(&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru))" -h hs-dc-1.domain.ru

# Authenticate 
acl auth proxy_auth REQUIRED

acl ad_users external ad_group_member_check full_access

# Standart ports
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT

# Standart permisson
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localhost
http_access allow auth

# Permission for AD users
http_access allow ad_users

# Deny everything else
http_access deny all

# Proxy ports
http_port 172.31.4.64:3128
http_port 172.31.4.64:3127 transparent

# Cache settings
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

# DNS
dns_nameservers 172.31.2.113
dns_v4_first on

Статус работы Squid: 

[root@vs-otr-squid02 ~]# systemctl status squid
● squid.service - Squid caching proxy
   Loaded: loaded (/usr/lib/systemd/system/squid.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2018-06-27 11:31:08 MSK; 42min ago
  Process: 2753 ExecStop=/usr/sbin/squid -k shutdown -f $SQUID_CONF (code=exited, status=0/SUCCESS)
  Process: 2762 ExecStart=/usr/sbin/squid $SQUID_OPTS -f $SQUID_CONF (code=exited, status=0/SUCCESS)
  Process: 2756 ExecStartPre=/usr/libexec/squid/cache_swap.sh (code=exited, status=0/SUCCESS)
 Main PID: 2765 (squid)
   CGroup: /system.slice/squid.service
           ├─2765 /usr/sbin/squid -f /etc/squid/squid.conf
           ├─2767 (squid-1) -f /etc/squid/squid.conf
           ├─2768 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D vs-otr-squid02@domain.ru -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru
           ├─2769 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D vs-otr-squid02@domain.ru -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru
           ├─2770 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D vs-otr-squid02@domain.ru -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru
           ├─2771 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D vs-otr-squid02@domain.ru -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru
           ├─2772 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D vs-otr-squid02@domain.ru -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru
           └─2773 (logfile-daemon) /var/log/squid/access.log

Jun 27 11:31:08 vs-otr-squid02 systemd[1]: Starting Squid caching proxy...
Jun 27 11:31:08 vs-otr-squid02 squid[2765]: Squid Parent: will start 1 kids
Jun 27 11:31:08 vs-otr-squid02 squid[2765]: Squid Parent: (squid-1) process 2767 started
Jun 27 11:31:08 vs-otr-squid02 systemd[1]: Started Squid caching proxy.

Но браузер показывает окно для вводим имя и пароль, которых быть не должно. Хорошо, я ввел, но это не принято, и в /var/log/squid/cache.log:

2018/06/27 12:19:16 kid1| Accepting NAT intercepted HTTP Socket connections at local=172.31.4.64:3127 remote=[::] FD 24 flags=41
2018/06/27 12:19:29| Current Directory is /
2018/06/27 12:19:29 kid1| Preparing for shutdown after 0 requests
2018/06/27 12:19:29 kid1| Waiting 30 seconds for active connections to finish
2018/06/27 12:19:29 kid1| Closing HTTP port 172.31.4.64:3128
2018/06/27 12:19:29 kid1| Closing HTTP port 172.31.4.64:3127
2018/06/27 12:19:29 kid1| Current Directory is /
2018/06/27 12:19:29 kid1| Starting Squid Cache version 3.5.20 for x86_64-redhat-linux-gnu...
2018/06/27 12:19:29 kid1| Service Name: squid
2018/06/27 12:19:29 kid1| Process ID 2858
2018/06/27 12:19:29 kid1| Process Roles: worker
2018/06/27 12:19:29 kid1| With 16384 file descriptors available
2018/06/27 12:19:29 kid1| Initializing IP Cache...
2018/06/27 12:19:29 kid1| DNS Socket created at [::], FD 8
2018/06/27 12:19:29 kid1| DNS Socket created at 0.0.0.0, FD 10
2018/06/27 12:19:29 kid1| Adding nameserver 172.31.2.113 from squid.conf
2018/06/27 12:19:29 kid1| helperOpenServers: Starting 0/600 'negotiate_kerberos_auth' processes
2018/06/27 12:19:29 kid1| helperStatefulOpenServers: No 'negotiate_kerberos_auth' processes needed.
2018/06/27 12:19:29 kid1| helperOpenServers: Starting 5/5 'ext_ldap_group_acl' processes
2018/06/27 12:19:29 kid1| Logfile: opening log daemon:/var/log/squid/access.log
2018/06/27 12:19:29 kid1| Logfile Daemon: opening log /var/log/squid/access.log
2018/06/27 12:19:29 kid1| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec
2018/06/27 12:19:29 kid1| Store logging disabled
2018/06/27 12:19:29 kid1| Swap maxSize 0 + 262144 KB, estimated 20164 objects
2018/06/27 12:19:29 kid1| Target number of buckets: 1008
2018/06/27 12:19:29 kid1| Using 8192 Store buckets
2018/06/27 12:19:29 kid1| Max Mem  size: 262144 KB
2018/06/27 12:19:29 kid1| Max Swap size: 0 KB
2018/06/27 12:19:29 kid1| Using Least Load store dir selection
2018/06/27 12:19:29 kid1| Current Directory is /
2018/06/27 12:19:29 kid1| Finished loading MIME types and icons.
2018/06/27 12:19:29 kid1| HTCP Disabled.
2018/06/27 12:19:29 kid1| Squid plugin modules loaded: 0
2018/06/27 12:19:29 kid1| Adaptation support is off.
2018/06/27 12:19:29 kid1| Accepting HTTP Socket connections at local=172.31.4.64:3128 remote=[::] FD 23 flags=9
2018/06/27 12:19:29 kid1| Accepting NAT intercepted HTTP Socket connections at local=172.31.4.64:3127 remote=[::] FD 24 flags=41
2018/06/27 12:19:30 kid1| storeLateRelease: released 0 objects
2018/06/27 12:19:46 kid1| Starting new negotiateauthenticator helpers...
2018/06/27 12:19:46 kid1| helperOpenServers: Starting 1/600 'negotiate_kerberos_auth' processes
2018/06/27 12:19:46 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:50 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:51 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:51 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:55 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:55 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:57 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:59 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:20:00 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:20:03 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:20:06 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}

/var/log/squid/access.log

1530088115.039      4 172.31.10.71 TCP_DENIED/407 4164 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530088115.039      4 172.31.10.71 TCP_DENIED/407 4164 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530088115.039      4 172.31.10.71 TCP_DENIED/407 4176 CONNECT yastatic.net:443 - HIER_NONE/- text/html
1530088115.039      4 172.31.10.71 TCP_DENIED/407 4164 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530088115.039      4 172.31.10.71 TCP_DENIED/407 4164 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530088115.039      4 172.31.10.71 TCP_DENIED/407 4176 CONNECT yastatic.net:443 - HIER_NONE/- text/html
1530088115.039      4 172.31.10.71 TCP_DENIED/407 4176 CONNECT yastatic.net:443 - HIER_NONE/- text/html
1530088115.039      4 172.31.10.71 TCP_DENIED/407 4176 CONNECT yastatic.net:443 - HIER_NONE/- text/html
1530088115.039      4 172.31.10.71 TCP_DENIED/407 4176 CONNECT yastatic.net:443 - HIER_NONE/- text/html
1530088115.039      4 172.31.10.71 TCP_DENIED/407 4176 CONNECT yastatic.net:443 - HIER_NONE/- text/html
1530088115.047      0 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530088116.578      1 172.31.10.71 TCP_DENIED/407 4333 CONNECT cdn.syndication.twimg.com:443 - HIER_NONE/- text/html
1530088116.585      7 172.31.10.71 TCP_DENIED/407 4313 CONNECT gekko.spiceworks.com:443 - HIER_NONE/- text/html
1530088116.585      6 172.31.10.71 TCP_DENIED/407 4269 CONNECT 3dnews.ru:443 - HIER_NONE/- text/html
1530088116.585      1 172.31.10.71 TCP_DENIED/407 5648 POST http://top-fwz1.mail.ru/tracker? - HIER_NONE/- text/html
1530088116.596     18 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530088118.941      0 172.31.10.71 TCP_DENIED/407 4236 CONNECT googleads.g.doubleclick.net:443 - HIER_NONE/- text/html
1530088118.946      0 172.31.10.71 TCP_DENIED/407 4341 CONNECT googleads.g.doubleclick.net:443 - HIER_NONE/- text/html
1530088121.934      0 172.31.10.71 TCP_DENIED/407 4228 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html
1530088121.938      0 172.31.10.71 TCP_DENIED/407 4333 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html
1530088125.390      0 172.31.10.71 TCP_DENIED/407 4228 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html
1530088125.393      0 172.31.10.71 TCP_DENIED/407 4333 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html
1530091186.082      0 172.31.10.71 TCP_DENIED/407 4164 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530091186.103     17 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530091190.539      1 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530091191.307      1 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530091191.770      0 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530091195.390      0 172.31.10.71 TCP_DENIED/407 4164 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530091195.395      0 172.31.10.71 TCP_DENIED/407 4228 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html
1530091195.396      1 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530091195.398      0 172.31.10.71 TCP_DENIED/407 4333 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html
1530091197.499      0 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530091199.183      0 172.31.10.71 TCP_DENIED/407 4348 GET http://forundex.ru/unix%20linux/favicon.ico - HIER_NONE/- text/html
1530091199.185      0 172.31.10.71 TCP_DENIED/407 4453 GET http://forundex.ru/unix%20linux/favicon.ico - HIER_NONE/- text/html
1530091200.420      0 172.31.10.71 TCP_DENIED/407 4228 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html
1530091200.423      0 172.31.10.71 TCP_DENIED/407 4333 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html
1530091203.169      0 172.31.10.71 TCP_DENIED/407 4228 CONNECT cdn.syndication.twimg.com:443 - HIER_NONE/- text/html
1530091203.172      0 172.31.10.71 TCP_DENIED/407 4333 CONNECT cdn.syndication.twimg.com:443 - HIER_NONE/- text/html
1530091206.171      0 172.31.10.71 TCP_DENIED/407 4208 CONNECT gekko.spiceworks.com:443 - HIER_NONE/- text/html
1530091206.174      0 172.31.10.71 TCP_DENIED/407 4313 CONNECT gekko.spiceworks.com:443 - HIER_NONE/- text/html

мне нужна помощь. Спасибо за продвижение.

-1
задан 27 June 2018 в 15:57
1 ответ

Gelöst. Die Keytab-Datei muss den folgenden Eintrag enthalten: 

HTTP/vs-otr-squid02.domain.ru@DOMAIN.RU

Nicht 

HTTP/vs-otr-squid02@DOMAIN.RU
0
ответ дан 5 December 2019 в 20:20

Теги

Похожие вопросы