file system

Squid on AD

First off we need to join our server to the Active Directory. The Red Hat Samba packages that come with CentOS provide all the features we need.

Step 1: Configure and Test Kerberos
Find out the Fully Qualified Domain Name (FQDN) of the Primary Domain Controller(PDC) for the Windows network.
Assuming the PDC is is bigserver.domain.net edit /etc/krb5.conf as follows:
PLEASE NOTE: The capitalization of the sections below is VERY important.

Code: Select all
[libdefaults]
default_realm = DOMAIN.NET
[realms] DOMAIN.NET = {
kdc = bigserver.domain.net
}
[domain_realms]
.kerberos.server = DOMAIN.NET

Test the Kerberos part of the authentication with the following command:

Code: Select all
# kinit Administrator@DOMAIN.NET
Password for Administrator@DOMAIN.NET

The following tool from Microsoft can help you get the right Kerberos details, by running it on a Windows workstation already joined to the domain:
Windows 2000 Resource Kit Tool: Kerbtray.exe

Step 2: Configure /etc/hosts
Edit /etc/hosts so you can rule out DNS issues for bigserver.domain.net

Code: Select all
192.168.10.5 bigserver.domain.net bigserver

Step 3: Configure Samba
Edit the Global section of /etc/samba/smb.conf to contain the following:

Code: Select all
# Global parameters
[global]
workgroup = BIGSERVER
realm = DOMAIN.NET
preferred master = no
server string = Samba file and print server
security = ADS
encrypt passwords = yes
log level = 3
log file = /var/log/samba/%m
max log size = 50
winbind separator = +
printcap name = cups
printing = cups
idmap uid = 10000-20000
idmap gid = 10000-20000

Run testparam to test your Samba configuration.
Now join your server to the AD Domain:

Code: Select all
# net ads join -U Administrator
Administrator’s password:
Joined ‘SAMBA1’ to realm ‘DOMAIN.NET.’

Step 4: Enable and Test Winbind
Edit /etc/nsswitch.conf and change the lines appropriate lines to look like the following:

Code: Select all
passwd: compat winbind
group: compat winbind
shadow: compat

Restart Samba with a /etc/init.d/samba restart
Test winbind with the following commands:

Code: Select all
# wbinfo -u
BIGSERVER+Administrator
BIGSERVER+Guest
BIGSERVER+cschroder
BIGSERVER+mhall
# wbinfo -g
BIGSERVER+Domain Computers
BIGSERVER+Domain Admins
BIGSERVER+Domain Guests
BIGSERVER+Domain Users
# getent passwd
BIGSERVER+cschroder:x:1000:1000:,,,:/home/BIGSERVER/cschroder:/bin/bash

If winbind is not working and local authentication is still active, they will not have the BIGSERVER+ prefix. Run

Code: Select all
net ads info

to display the AD server information.

Step 4: Test the Squid helpers
Test the Squid ntlm authentication helper before you break Squid

Code: Select all
# /usr/local/bin/ntlm_auth –helper-protocol=squid-2.5-basic
BIGSERVER+myuser mypasswd
OK

Step 5: Configure and Test Squid
Add the following to enable both the winbind basic and ntlm authenticators. IE will use ntlm and everything else basic:

Code: Select all
auth_param ntlm program /usr/local/bin/ntlm_auth –helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 30
auth_param ntlm max_challenge_reuses 0
auth_param ntlm max_challenge_lifetime 2 minutes
# ntlm_auth from Samba 3 supports NTLM NEGOTIATE packet
auth_param ntlm use_ntlm_negotiate on
auth_param basic program /usr/local/bin/ntlm_auth –helper-protocol=squid-2.5-basic
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours

Change auth_param basic realm to something nice for the client e.g. PCB Proxy server
Add the following acl entries to require authentication:

Code: Select all
acl AuthorizedUsers proxy_auth REQUIRED
..
http_access allow all AuthorizedUsers

Point your test machine to the proxy server and you should be authenticating against the server.
You can now go on and configure any further acl for the server.
AD group ACLs
Example
Say I had a domain group called “directors”

Code: Select all
[root@localhost ~]# getent group | grep directors
POSTMANPAT+directors:*:10012:POSTMANPAT+michael

Add to /etc/squid/squid.conf

Code: Select all
external_acl_type nt_group ttl=0 concurrency=5 %LOGIN /usr/lib/squid/wbinfo_group.pl protocol=2.5
# ACLs
acl directors external nt_group directors
http_access allow directors

Be sure to change permissions on /var/cache/samba/winbindd_privileged

Code: Select all
chgrp squid /var/cache/samba/winbindd_privileged
chmod g+rx /var/cache/samba/winbindd_privileged

Winbind
They use AD for authenticating with SQUID.
The wanted to know why this user could browse,
So we checked what groups the user belongs to,

Code: Select all
[root@nsaproxy etc]# wbinfo -r recpdca
10089
10091
10002
10452
10333
10222
10417
10449

(Which is useless)

Code: Select all
[root@nsaproxy etc]# for x in $(wbinfo -r recpdca) ; do SID=$(wbinfo -G $x) ; NAME=$(wbinfo -s $SID) ; echo $NAME ; done
ITPD+Internet User 2
ITPD+Virusfree 2
ITPD+Domain Users 2
ITPD+internetuser 2
ITPD+Protection Services Induction (R) 2
ITPD+Security Properties 2
ITPD+MAILUSER 4
BUILTIN+Users 4

Explanation

Code: Select all
for x in $(wbinfo -r recpdca)

………This gets all the group ID’s for that user

Code: Select all
do SID=$(wbinfo \-G $x)

……….Based on the GID we generate a SID

Code: Select all
NAME=$(wbinfo \-s $SID)

…………Based on the SID we generate a group name

Code: Select all
echo $NAME ; done

………..Echo what we just descovered

Read next