1

The NTLM auth helper only tags users as authorized if they are member of a AD group. The Kerberos auth helper tags a user as authorized, if he was able to log in, the group check can't be done by the Kerberos helper, so i need a external ACL programm, which checks over LDAP if this user is allowed to use squid.

I have to allow only users authorized via NTLM directly, Kerberos authorized users are allowed after the external LDAP check was successfull.

Kerberos users are displayed as sAMAccountName@REALM, e.g. "user@COMPANY.LOCAL"

NTLM users are displayed as sAMAccountName, e.g. "user"

I have this ACLs:

# External ACL helper returns OK (User is in given LDAP group)
acl ldap_group_check external squid_kerb_ldap
# Username contains character '@'
acl kerberos_without_ldap_auth proxy_auth_regex (@)

And this Rules:

# Default: Kerberos + LDAP group check
http_access allow ldap_group_check
# Fallback: NTLM
http_access allow !kerberos_without_ldap_auth

Here my question: what does the rule

http_access allow !kerberos_without_ldap_auth

mean? Do I have a security Problem in my configuration?

Does is mean "All users except users with '@' in their username" => bad thing, because then not authenticated users would be allowed too

or "All authenticated users except users with '@' in their username"? => goot thing, because then only NTLM users would be allowed (Successfull Kerberos AND LDAP users are allowed already from the first rule, because of squids "first match wins")

HighMilkyWay
  • 23
  • 1
  • 4

1 Answers1

0

Both NTLM and Kerberos authenticate users, after user is authenticated you would like to authorize access to the internet based on secure group membership right? If so why not to adjust the LDAP search filter to something like:

external_acl_type ldap_group %LOGIN /usr/lib64/squid/squid_ldap_group -R -b "DC=domain,DC=local" -D "CN=SQUID,OU=domain Service Accounts,DC=domain,DC=local" -w "*********" -f "(&(objectclass=person) (!(sAMAccountname=%v)(userPrincipalName=%s))(memberof=CN=%a,OU=PROXY,ou=ALL domain Groups,DC=domain,DC=local))" -h 10.0.0.,10.0.0.,10.0.0.***

Please note the or filter for (!(sAMAccountname=%v)(userPrincipalName=%s)) that will match either NTLM or Kerberos authenticated name.

Rafael
  • 524
  • 2
  • 3