projectz

Tech, Gadgets, Photography, Social Media and Poor Spelling

Getting Squid3 on Debian 6.x to work with Active Directory, Security Groups and Websense

I’ve had a need to get a local squid proxy to perform local filtering based on AD Security groups because it’s not something websense can do. I found this wonderful howtofoge guide online and Used it to setup the base system. This howto is a work in progress as the next stage is to get it working with DansGuardian or SquidGuard.

Source: http://www.howtoforge.com/debian-squeeze-squid-kerberos-ldap-authentication-active-directory-integration-and-cyfin-reporter

Prerequisites

Client Internet Explorer Browsers need to have “Enable Integrated Windows Authentication” ticked in Internet Options :: Advanced settings as well as Proxy Auto detection enabled – google these if not sure. All modern web browsers will support proxy auto detection. Firefox and Chrome also support Windows Authentication.

DNS Configuration

Install dnsutils:

apt-get install dnsutils

On the Windows DNS server add a new A record entry for the proxy server’s hostname and ensure a corresponding PTR (reverse DNS) entry is also created and works. Check that the proxy is using the Windows DNS Server for name resolution and update /etc/resolv.conf accordingly.

vi /etc/resolv.conf

search example.local
nameserver 192.168.0.1
nameserver 192.168.0.10

Ping an internal and external hostname to ensure DNS is operating.

ping domaincontroller1.example.local -c 4 && ping google.com -c 4

Check you can reverse look up the Windows Server and the local proxy ip from the Windows DNS.

dig -x 192.168.0.1
dig -x 192.168.0.26

Warning: If either DNS lookup fails do not proceed until fixed or proxy authentication will fail.

NTP Configuration

It’s tempting to skip this part, do so at your peril, Kerberos has a +/-5 minute window if your squid server is outside of that with the AD server you won’t authenticate. I’ve seen issue with Servers running slightly fast over several months. So you may have forgotton about this howto and this stops working.

Install the ntp package:

apt-get install ntp

Because Kerberos needs to have the time synchronized with Windows Domain Controllers for authentication we configure the proxy to obtain time from the them.

vi /etc/ntp.conf

Locate the following section and update the ntp servers as required. If you have more than one Domain Controller or NTP Server you may add multiple lines.

# You do need to talk to an NTP server or two (or three).
#server ntp.your-provider.example
server domaincontroller1.example.local
server server2.example.local

Then restart and test NTP.

invoke-rc.d ntp restart
ntpq -p

You should see output that refers to the Domain Controllers and other NTP Servers which are processed in the order that they appear in the conf file.

Configure Kerberos

Install Kerberos packages:

apt-get install krb5-user libkrb53

Just accept the defaults presented to any debconf dialog’s presented as we are overwriting them.

Set up Kerberos.

cp /etc/krb5.conf /etc/krb5.conf.default
cat /dev/null > /etc/krb5.conf
vi /etc/krb5.conf

Edit the file replacing the variables (highlighted) with the client’s domain and server.

Warning: Depending on your Windows Domain Controllers OS Version un-comment the relevant Windows 200X section and comment out the opposing section.

If you only have 1 Domain Controller remove the additional “kdc” entry from the “[realms]” section.

[libdefaults]
        default_realm = EXAMPLE.LOCAL
        dns_lookup_kdc = no
        dns_lookup_realm = no
        ticket_lifetime = 24h
        default_keytab_name = /etc/squid3/PROXY.keytab
; for Windows 2003
        default_tgs_enctypes = rc4-hmac des-cbc-crc des-cbc-md5
        default_tkt_enctypes = rc4-hmac des-cbc-crc des-cbc-md5
        permitted_enctypes = rc4-hmac des-cbc-crc des-cbc-md5
; for Windows 2008 with AES
;        default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
;        default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
;        permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
[realms]
        EXAMPLE.LOCAL = {
                kdc = domaincontroller1.example.local
                kdc = server2.example.local
                admin_server = domaincontroller1.example.local
                default_domain = example.local
        }
[domain_realm]
        .example.local = EXAMPLE.LOCAL
        example.local = EXAMPLE.LOCAL

Install Squid 3

apt-get install squid3 ldap-utils

Note: Squid configuration takes places after msktutil is configured.

Install and run msktutil

Obtain the msktutil package and install it.

cd /var/cache/apt/archives/ wget http://fuhm.net/software/msktutil/releases/msktutil_0.4-2_i386.deb
apt-get install libsasl2-modules-gssapi-mit libsasl2-modules
dpkg -i msktutil_0.4-2_i386.deb
cd

Initiate a kerberos session to the server so msktutil can use it to create our Proxy object in Active directory that will be used for access.

kinit administrator

Enter the domain administrator password.

It should then return without errors. You can see if you successfully obtained a ticket with:

klist

Now we configure the proxy in AD with service principles by running msktutil (update the highlighted values with your network).

Warning: You should not move the object from the OU that you use msktutil to create it in.

msktutil -c -b “CN=COMPUTERS” -s HTTP -k /etc/squid3/PROXY.keytab –computer-name SQUIDPROXY \
–upn HTTP/squidproxy.example.local –server domaincontroller1.example.local –verbose

If you are using a Server 2008 domain then add “–enctypes 28” at the end of the command.

msktutil -c -b “CN=COMPUTERS” -s HTTP -k /etc/squid3/PROXY.keytab –computer-name SQUIDPROXY \
–upn HTTP/squidproxy.example.local –server domaincontroller1.example.local –verbose –enctypes 28

Set the permissions on the keytab so squid can read it.

chgrp proxy /etc/squid3/PROXY.keytab
chmod g+r /etc/squid3/PROXY.keytab

On the Windows Server reset the Computer Account in AD by right clicking on the SQUIDPROXY Computer and select “Reset Account”, then run msktutil as follows to ensure the keytab is updated as expected and that the keytab is being sourced by msktutil from /etc/krb5.conf correctly.

Reboot the proxy first to clear the kerberos tickets generated by kinit command then run the following:

msktutil –auto-update –verbose

If the keytab is not found try adding “-k /etc/squid3/PROXY.keytab” to the command to see if it works and then troubleshoot until resolved or users will not be able to authenticate with Squid.

Add the following to cron so it can automatically updates the computer account in active directory when it expires (typically around 30 days). I pipe it through logger so I can see any errors in syslog if necessary. As stated the msktutil uses the default /etc/krb5.conf file for its paramaters so be aware of that if you decide to make any changes in it.

The SHELL and PATH variables are there to ensure cron runs properly change this if you know what your doing.

crontab -e

SHELL=/bin/bash
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
# m h  dom mon dow   command
00 4  *   *   *     msktutil --auto-update --verbose | logger -t msktutil

Configure Squid

In order to use our redundant LDAP access and authorizations via Security Groups in Active Directory we need to create and account with permission to look up Active Directory attributes. Squid will then use this account to provide users with access.

In Active Directory create a user called “Squid Proxy” with the logon name squid@example.local and note the password down and substitute the word “squidpass” below with your password.

Ensure the following is true when creating the account.

  • User must change password at next logon Un-ticked
  • User cannot change password Ticked
  • Password never expires Ticked
  • Account is disabled Un-ticked

By default the squid account will not be able to query the “memberOf” attribute in AD. Select the top level of your active directory domain in Active Directory Users and Computers, Right click on it and choose properties, Security Tab, Add the squid user and give it read permissions (should happen by default) and allow it to read “This Object and all child objects” by going into Advanced options.

Create the following Security Groups with descriptions in Active Directory and add users to the relevant groups – if a user is not part of a group they will only be able to access sites in the whitelistsites ACL.

Members of Internet Users will not be able to access websites in the blocksites ACL.

  • Internet Users | Description: Members of this group can access the Internet. Access is logged with website restrictions
  • Internet Users Full Log | Description: Members of this group can access the Internet. Access is logged with full website access
  • Internet Users Full NoLog | Description: Members of this group can access the Internet. Access is not logged with full website access

We then set up squid and it’s associated config files.

Squid startup

Add the following configuration to /etc/default/squid3 (this file does not exist by default).

vi /etc/default/squid3

KRB5_KTNAME=/etc/squid3/PROXY.keytab
export KRB5_KTNAME

squid.conf

cp /etc/squid3/squid.conf /etc/squid3/squid.conf.default
cat /dev/null > /etc/squid3/squid.conf
vi /etc/squid3/squid.conf

Update the cache manager variable with the emails address of the person in charge of the proxy.

Study and update the following text carefully, replacing the example content (highlighted) with your networks configuration – if you get something wrong your proxy will not work.

####### /etc/squid3/squid.conf Configuration File #######
####### cache manager
cache_mgr administrator@example.com
####### kerberos authentication
auth_param negotiate program /usr/lib/squid3/squid_kerb_auth -d -s HTTP/squidproxy.example.local
auth_param negotiate children 10
auth_param negotiate keep_alive on
####### provide access via ldap for clients not authenticated via kerberos
auth_param basic program /usr/lib/squid3/squid_ldap_auth -R \
        -b "dc=example,dc=local" \
        -D squid@example.local \
        -w "squidpass" \
        -f sAMAccountName=%s \
        -h domaincontroller1.example.local
auth_param basic children 10
auth_param basic realm Internet Proxy
auth_param basic credentialsttl 1 minute
####### ldap authorizations
# restricted proxy access logged
external_acl_type internet_users %LOGIN /usr/lib/squid3/squid_ldap_group -R -K \
        -b "dc=example,dc=local" \
        -D squid@example.local \
        -w "squidpass" \
        -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=Internet Users,ou=Security Groups,ou=MyBusiness,dc=example,dc=local))" \
        -h domaincontroller1.example.local
# full proxy access no logging
external_acl_type internet_users_full_nolog %LOGIN /usr/lib/squid3/squid_ldap_group -R -K \
        -b "dc=example,dc=local" \
        -D squid@example.local \
        -w "squidpass" \
        -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=Internet Users Full NoLog,ou=Security Groups,ou=MyBusiness,dc=example,dc=local))" \
        -h domaincontroller1.example.local
# full proxy access logged
external_acl_type internet_users_full_log %LOGIN /usr/lib/squid3/squid_ldap_group -R -K \
        -b "dc=example,dc=local" \
        -D squid@example.local \
        -w "squidpass" \
        -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=Internet Users Full Log,ou=Security Groups,ou=MyBusiness,dc=example,dc=local))" \
        -h domaincontroller1.example.local
####### acl for proxy auth and ldap authorizations
acl auth proxy_auth REQUIRED
# format "acl, aclname, acltype, acltypename, activedirectorygroup"
acl RestrictedAccessLog external internet_users Internet\ Users
acl FullAccessNoLog external internet_users_full_nolog Internet\ Users\ Full\ NoLog
acl FullAccessLog external internet_users_full_log Internet\ Users\ Full\ Log
acl whitelistsites url_regex -i "/etc/squid3/whitelistsites.txt"
acl blockedsites url_regex -i "/etc/squid3/blockedsites.txt"
####### squid defaults
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
####### enforce auth: order of rules is important for authorization levels
no_cache deny whitelistsites
http_access allow whitelistsites
http_access allow FullAccessNoLog auth
http_access allow FullAccessLog auth
http_access deny blockedsites
http_access allow RestrictedAccessLog auth
####### logging
# don't log whitelistsites, FullAccessNoLog
access_log /var/log/squid3/access.log squid !whitelistsites !FullAccessNoLog
####### squid defaults
http_access deny all
http_port 3128
hierarchy_stoplist cgi-bin ?
coredump_dir /var/spool/squid3
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

touch /etc/squid3/whitelistsites.txt
touch /etc/squid3/blockedsites.txt
invoke-rc.d squid3 restart

Proxy Auto Configuration

Install Apache2:

apt-get install apache2

Add a configuration to Apache2 to identify the file format of the proxy configuration script.

vi /etc/apache2/conf.d/wpad.dat

AddType    application/x-ns-proxy-autoconfig .dat

Create our wpad.dat file used by web browsers for configuration:

vi /var/www/wpad.dat

Change the line starting with $proxy to your proxy’s FQDN (highlighted text).

function FindProxyForURL(url, host)
{
        $proxy = "PROXY squidproxy.example.local:3128";
        // URLs within this network are accessed direct
        if (isInNet(host, "192.168.0.0", "255.255.0.0"))        {return "DIRECT";}
        if (isInNet(host, "172.16.0.0", "255.240.0.0"))         {return "DIRECT";}
        if (isInNet(host, "10.0.0.0", "255.0.0.0"))             {return "DIRECT";}
        if (isInNet(host, "127.0.0.0", "255.0.0.0"))            {return "DIRECT";}
        //Return proxy for EVERYTHING else
        else return $proxy;
}

Restart Apache2:

invoke-rc.d apache2 restart

WPAD DNS entries

Warning: Once you add the following DNS entry the proxy will become live. Stop at this point and check.

  1. That client browsers are using Integrated Windows Authentication
  2. That you have added all users to the relevant Internet Users security groups in AD
  3. That all client browsers are set to use automatically detect proxy settings for internet access. Using group policy is a sensible option here or perhaps restrict outbound HTTP access on your firewall to weed out users without auto-detection configured.

Test access with Internet Explorer by Ticking “Use automatic configuration script” and insert http://squidproxy.example.local/wpad.dat (change the proxy FQDN to yours of course) in the address field and then access any websites. Good luck, I hope it works! Stop here and troubleshoot if it is not working or else you will end up with a lot of angry users!

Add a CNAME record in DNS to point wpad.example.local to squidproxy.example.local

Note: Server 2008 comes with a security measure that blocks wpad, I have also seen it on server 2003

To remove the wpad DNS restriction, but leave the Blocklist enabled, run Regedit and open the following location.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters\GlobalQueryBlockList

Server 2008 will likely have the entries of WPAD and ISATAP. Remove the WPAD entry and restart the DNS service for it to reload the Blocklist. You should then be able to resolve wpad.example.local

Then set your browser to use Proxy auto configuration. All modern web browsers follow the wpad standard and will attempt to lookuphttp://wpad.example.local/wpad.dat for their configuration information.

More information about WPAD can be found here: http://wiki.squid-cache.org/Technology/WPAD/DNS

Check your squid logs to see that the browsers are using the proxy.

Optional: Install Cyphin Reporter

With the proxies we operate we need decent reporting. Programs like sarg, mysar etc. were not cutting it as decent reporting options for monitoring user internet usage. Cyfin Reporter by Wavecrest has proven to be a very capable and intuitive reporting system with plenty of features.

This is how to setup and install Cyfin Reporter with squid on Debian Squeeze.

The latest Cyfin Reporter version at the time of writing is version 8.5. Check the following locations depending on your architecture before you download and update the following commands where necessary.

http://downloads.wavecrest.net/release/cyfin/linux32/
http://downloads.wavecrest.net/release/cyfin/linux64/

So your install might look something like this…

cd /usr/local/src/
wget “http://downloads.wavecrest.net/release/cyfin/linux32/v850/c850linux32.bin.gz”
gunzip c850linux32.bin.gz
chmod +x c850linux32.bin

N.B The Install Anywhere program screws around with PS1, so changing this for the current shell resolves the issue.

export PS1=”>”
./c850linux32.bin

When prompted about the install path enter it as

 ENTER AN ABSOLUTE PATH, OR PRESS  TO ACCEPT THE DEFAULT
      : /opt/wavecrest/cyfin

Accept everything else as default.

We need to create an initscript to start and stop cyfin the Debian way.

vi /etc/init.d/cyfin

#! /bin/sh
### BEGIN INIT INFO
# Provides:          cyfin
# Required-Start:    $network $remote_fs
# Required-Stop:     $network $remote_fs
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: cyfin reporter initscript
### END INIT INFO
NAME=cyfin
SCRIPTNAME=/etc/init.d/$NAME
# Load the VERBOSE setting and other rcS variables
. /lib/init/vars.sh
# Define LSB log_* functions.
# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
# and status_of_proc is working.
. /lib/lsb/init-functions
case "$1" in
        start)          sh /opt/wavecrest/cyfin/cyfin start
        ;;
        stop)           sh /opt/wavecrest/cyfin/cyfin stop
        ;;
        status)         sh /opt/wavecrest/cyfin/cyfin start
        ;;
        restart)        sh /opt/wavecrest/cyfin/cyfin restart
        ;;
        *)              echo "Usage: $SCRIPTNAME {start|stop|status|restart}" >&2
                        exit 3
        ;;
esac
:

chmod +x /etc/init.d/cyfin
update-rc.d cyfin defaults

Configuring Cyfin Reporter would require a brand new tutorial so here is the basics.

Access the configuration GUI via http://squidproxy.example.local:7999. The logon by default is “admin” for the username and password.

  • Use the help in the GUI as the documentation is very good.
  • Check the FAQs at http://www.wavecrest.net/support/cyfin/reporter/faqs.html
  • Use the Quick Start menu to setup the basics, which are fairly straight forward.
  • Enable the Data Manager to import log files and setup a log file import schedule.
  • use the integration into Active Directory, you can use the squid account created for LDAP auth to also extract information from Active Directory.
  • Configure a schedule to import User lists from Active Directory.
  • You should ensure your users are part of a security group or distribution group in Active Directory and add these groups to Cyfin Reporter.
  • Assign the departments Manager as the recipient of email reports.
  • Setup access accounts for staff with permission to view the logs.

If you use Cyfin Reporter you need to account for additional memory usage so be sure to allocate enough resources to run it.

What’s Next?

The next stage is to get the local filtering working as maintaining a local filter with todays nasties using whitelisting and blacklisting in a company lan is almost impossible. I’ve used DansGuardian before for this however would like to get it linked to the groups. I’ve got groups for different sets of users etc… I’ll update this guide when i’ve figured this out.

Advertisements

2 comments on “Getting Squid3 on Debian 6.x to work with Active Directory, Security Groups and Websense

  1. Sjorsvdp
    May 8, 2013

    For debian 7 (Wheezy) change the following:
    * libkrb53 is not available, use libkrb5-3
    * add “–ignore-depends=libkrb53” to the dpkg command when installing msktutil
    * don’t reboot the proxy, remove the cache file listed in klist
    * an entry in cron.daily for msktutil is already there, activate it by editing /etc/default/msktutil

    • projectzme
      May 8, 2013

      Thank you for the update, it’s appreciated

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: