Авторизация пользователей squid в домене 2008r2

16.09.2012 13:57 · отредактировано #275192

Добрый день! Opensuse 12.2, установлен squid 2.7tables9.
Домен win2008r2. Проблема в том, что пользователь домена при открытии браузера сообщение о логине и пароле, при вводе ничего не изменяется.
мои настройки:

Squid.conf

text

auth_param ntlm program /usr/bin/ntlm_auth  --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 50
auth_param ntlm keep_alive off
auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
auth_param basic children 50
auth_param basic realm Proxy Autentification Required
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off
external_acl_type nt_group %LOGIN /usr/sbin/wbinfo_group.pl
acl myusers proxy_auth REQUIRED
http_access allow myusers

smb.conf

text

[global]
    auth methods    = winbind
    workgroup    = DD
    netbios name    = rdp
    server string    = "rdp linux"
    winbind use default domain = yes
    winbind uid    = 10000-20000
    winbind gid    = 10000-20000
    winbind enum users    = yes
    winbind enum groups    = yes
    
    load printers     = no
    
    log file     = /var/log/samba/log.%m
    max log size     = 50
    
    hosts allow    = 192.168.
    security    = ads
    password server = 192.168.12.2
    realm         = DD.LOCAL
    
    encrypt passwords = yes
    smb passwd file   = /etc/samba/smbpasswd
    
    socket options = TCP_NODELAY
    local master   = no
    os level       = 33
    
    name resolve order = wins lmhosts bcast
    wins support        = yes
    dns proxy        = no
    dos charset     = CP866
    unix charset    = CP1251
    display charset = CP1251
    use sendfile = no
    time server  = yes
[homes]
    comment = Home directory for '%u'
    path = /home/%u
    browseable = no
    writable   = yes
[public]
    comment     = Public
    path         = /mnt/samba/public
    public         = yes
    writable     = yes
    printable     = no
    create mask     = 0666

krb5.conf

text

[libdefaults]
        default_realm = DD.LOCAL
[realms]
        DD.LOCAL = {
                kdc = 192.168.12.2
                admin_server = 192.168.12.2
        }
[logging]
        kdc = FILE:/var/log/krb5kdc.log
        admin_server = FILE:/var/log/kadmin.log
        default = FILE:/var/log/krb5lib.log

nsswitch.conf

text

group: files winbind
passwd: files winbind
group_compat: nis
passwd_compat: nis
hosts: files dns
networks: files
shells: files

команды wbinfo -u и wbinfo -g выводят пользователей и группы

Оформляйте посты тэгами форума, что бы читать было удобнее, так Вам быстрее помогут.

auth_param basic program /usr/lib64/squid/squid_ldap_auth -R -D sel_ldap@smb.mgkb1.local -w PASSWD -b "dc=smb,dc=mgkb1,dc=local" -f "sAMAccountName=%s" 192.168.2.82 -p 389 auth_param basic children 20 auth_param basic realm Internet Access MGKB1 auth_param basic credentialsttl 1 minutes auth_param basic casesensitive off external_acl_type ldap_users %LOGIN /usr/lib64/squid/squid_ldap_group -R -b "OU=UsersDom,DC=smb,DC=mgkb1,DC=local" -f "(&(sAMAccountName=%v)(memberOf=CN=%a,CN=Builtin,DC=smb,DC=mgkb1,DC=local))" -D sel_ldap@smb.mgkb1.local -w "PASSWD" 192.168.2.82 -v 3 -p 389