Добрый день. на данный момент имею установленный squid3, winbind,sams,samba на debian 6.
AD c пользователями, которые входят в группу inet.
настройки squid.conf
visible_hostname proxy
auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp #--require-membership-of=S-1-5-21-139329950-3031665859-43222392-1267
auth_param ntlm children 15
auth_param ntlm keep_alive on
auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic #--require-membership-of=S-1-5-21-139329950-3031665859-43222392-1267
auth_param basic children 15
auth_param basic realm Proxy Server
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl inet src 172.24.26.0/25
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow inet
http_access deny all
http_port 3128
hierarchy_stoplist cgi-bin
cache_dir ufs /var/spool/squid3 100 16 256
maximum_object_size 61440 KB
cache_mem 64 MB
coredump_dir /var/spool/squid3
dns_nameservers 10.10.100.3
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
sams.conf
[client]
SQUID_DB=squidlog
SAMS_DB=squidctrl
MYSQLHOSTNAME=localhost
MYSQLUSER=root
MYSQLPASSWORD=Kissmein__
MYSQLVERSION=5.0
SQUIDCACHEFILE=access.log
SQUIDROOTDIR=/etc/squid
SQUIDLOGDIR=/var/log/squid
SQUIDCACHEDIR=/var/spool/squid
SAMSPATH=/usr
SQUIDPATH=/usr/sbin
SQUIDGUARDLOGPATH=/var/log
SQUIDGUARDDBPATH=/etc/squid
RECODECOMMAND=iconv -f KOI8-R -t 866 %finp > %fout
LDAPSERVER=172.24.26.4
LDAPBASEDN=nari.local
LDAPUSER=squid1
LDAPUSERPASSWD=1q2w3e4r5t
LDAPUSERSGROUP=Users
REJIKPATH=/usr/local/rejik
SHUTDOWNCOMMAND=shutdown -h now
CACHENUM=0
smb.conf
[global]
workgroup = nari
realm = nari.local
server string = ProxyServer
hosts allow = 172.24.26.0.0/25
hosts allow = 172.24.26.0/25
winbind separator = +
winbind use default domain = yes
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
syslog = 0
panic action = /usr/share/samba/panic-action %d
winbind uid = 10000-20000
winbind gid = 10000-20000
winbind enum users = yes
winbind enum groups = yes
template homedir = /home/winnt/%D/%U
template shell = /bin/bash
max log size = 50
security = domain
password server = nari.local
encrypt passwords = yes
encrypt passwords = true
security = ads
passdb backend = tdbsam
obey pam restrictions = yes
unix password sync = yes
winbind use default domain = yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
pam password change = yes
[homes]
comment = Home Directories
browseable = no
read only = yes
create mask = 0700
directory mask = 0700
valid users = %S
[printers]
comment = All Printers
browseable = no
path = /var/spool/samba
printable = yes
guest ok = no
read only = yes
create mask = 0700
[print$]
comment = Printer Drivers
path = /var/lib/samba/printers
browseable = yes
read only = yes
guest ok = no
на данный момент получил авторизацию в АД через
также собрал инфу разного рода о домене АД пользователе:
root@proxy:/# wbinfo -D nari.local
Name : NARI
Alt_Name : nari.local
SID : S-1-5-21-3540890976-2719858097-3482392928
Active Directory : Yes
Native : Yes
Primary : Yes
root@proxy:/# net ads info
LDAP server: 10.10.100.3
LDAP server name: WIN-HBNGSLHKVC5.nari.local
Realm: NARI.LOCAL
Bind Path: dc=NARI,dc=LOCAL
LDAP port: 389
Server time: Tue, 23 Oct 2012 04:33:15 EDT
KDC server: 10.10.100.3
Server time offset: -9
root@proxy:/# wbinfo --authenticate=nari.local\\squid1%1q2w3e4r5t
plaintext password authentication failed
Could not authenticate user nari.local\squid1%1q2w3e4r5t with plaintext password
challenge/response password authentication failed
error code was NT_STATUS_NO_SUCH_USER (0xc0000064)
error messsage was: No such user
Could not authenticate user nari.local\squid1 with challenge/response
root@proxy:/# id nari.local\\squid1
id: nari.local\squid1: No such user
root@proxy:/# id nari.local\\maxim
id: nari.local\maxim: No such user
root@proxy:/#тут есть ошибки, может они существенные и нужно подправить?
root@proxy:/# wbinfo -a squid1
Enter squid1's password:
plaintext password authentication succeeded
Enter squid1's password:
challenge/response password authentication succeededв таблицах mysql :
+--------------------+
| Database |
+--------------------+
| information_schema |
| mysql |
| phpmyadmin |
| squidctrl |
| squidlog |
+--------------------+
5 rows in set (0.00 sec)в SAMS отобразились все пользователи моей линуксовой машины и АД виндовой.
но sams не показывает статистики по каждому пользователю. ОН ее вообще НЕ показывает, хотелось бы, чтобы он ее показывал.
Также хотелось бы узнать, понять, каким образом сделать так, чтобы только пользователи АД могли выходить в инет? у меня сейчас получается, что либо никто, либо все, причем нет привязки по логинам в АД.
Помогите разобраться в данных проблемах.
