Proxy Squid com SquidGuard + Controle de Banda e Autenticação NTLM no Samba 4 (CentOS 6.5 - 64 bits Minimal)
Depois de cinco dias brigando na frente do PC e fuçando muito na Internet (lembrando que esse assunto, em especial, ainda tem pouca coisa a respeito), só hoje consegui por em funcionamento. Squid + SquidGuard + autenticação no Samba 4 ou AD (Microsoft). Espero que ajude aos amigos que buscam a mesma solução.
Parte 2: Configurando o Squid
Backup do arquivo de configuração:
# cp -Rfa /etc/squid/squid.conf{,.bkp}
# rm -rf /etc/squid/squid.conf
# vi /etc/squid/squid.conf
Criando a pasta de cache:
# mkdir /etc/squid/cache
# mkdir -p /etc/squid/cache/1
# chown squid:squid -R /etc/squid/cache/
# service squid start
Inicialização automática do Squid:
# chkconfig squid on
# cp -Rfa /etc/squid/squid.conf{,.bkp}
# rm -rf /etc/squid/squid.conf
# vi /etc/squid/squid.conf
http_port 3128
maximum_object_size 4096 KB
minimum_object_size 0 KB
maximum_object_size_in_memory 64 KB
cache_mem 60 MB
pipeline_prefetch on
fqdncache_size 1024
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
cache_swap_low 90
cache_swap_high 95
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log
cache_dir ufs /var/spool/squid 100 16 256
logfile_rotate 10
hosts_file /etc/hosts
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
acl localhost src 127.0.0.1/32
http_access allow localhost
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
acl NOCACHE url_regex "/etc/squid/regras/nocache.lst" \?
no_cache deny NOCACHE
auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 30
auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
auth_param basic children 5
auth_param basic realm Squid proxy server
auth_param basic credentialsttl 2 hours
acl autenticados proxy_auth REQUIRED
redirect_program /usr/bin/squidGuard -c /etc/squid/squidGuard.conf
redirect_children 10
http_access allow autenticados
http_access deny all
http_reply_access allow all
icp_access allow all
miss_access allow all
visible_hostname proxyauth.palacio.local
error_directory /usr/share/squid/errors/pt-br
cache_effective_user squid
coredump_dir /var/spool/squid
######## CONTROLE DE BANDA ############
acl Acesso_Rapido url_regex -i \.(aspx?|css|jsp?|[js]?html?|rss|php|xml|txt|gif|jpe?g|png)$
acl Banda_Livre arp "/etc/squid/acls/Banda_Livre.lst"
delay_pools 2
delay_class 1 2
delay_parameters 1 -1/-1 -1/-1 -1/-1
delay_access 1 allow Banda_Livre
delay_class 2 2
delay_parameters 2 614400/614400 61920/619200 # Navegar a 60k
delay_access 2 allow rede_local !Acesso_Rapido
maximum_object_size 4096 KB
minimum_object_size 0 KB
maximum_object_size_in_memory 64 KB
cache_mem 60 MB
pipeline_prefetch on
fqdncache_size 1024
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
cache_swap_low 90
cache_swap_high 95
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log
cache_dir ufs /var/spool/squid 100 16 256
logfile_rotate 10
hosts_file /etc/hosts
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
acl localhost src 127.0.0.1/32
http_access allow localhost
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
acl NOCACHE url_regex "/etc/squid/regras/nocache.lst" \?
no_cache deny NOCACHE
auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 30
auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
auth_param basic children 5
auth_param basic realm Squid proxy server
auth_param basic credentialsttl 2 hours
acl autenticados proxy_auth REQUIRED
redirect_program /usr/bin/squidGuard -c /etc/squid/squidGuard.conf
redirect_children 10
http_access allow autenticados
http_access deny all
http_reply_access allow all
icp_access allow all
miss_access allow all
visible_hostname proxyauth.palacio.local
error_directory /usr/share/squid/errors/pt-br
cache_effective_user squid
coredump_dir /var/spool/squid
######## CONTROLE DE BANDA ############
acl Acesso_Rapido url_regex -i \.(aspx?|css|jsp?|[js]?html?|rss|php|xml|txt|gif|jpe?g|png)$
acl Banda_Livre arp "/etc/squid/acls/Banda_Livre.lst"
delay_pools 2
delay_class 1 2
delay_parameters 1 -1/-1 -1/-1 -1/-1
delay_access 1 allow Banda_Livre
delay_class 2 2
delay_parameters 2 614400/614400 61920/619200 # Navegar a 60k
delay_access 2 allow rede_local !Acesso_Rapido
Criando a pasta de cache:
# mkdir /etc/squid/cache
# mkdir -p /etc/squid/cache/1
# chown squid:squid -R /etc/squid/cache/
# service squid start
Inicialização automática do Squid:
# chkconfig squid on
Amigo, tenho uma dúvida. Quando o Squid não está integrado com o AD, a troca de permissões, acessos é instantâneo, porém quando integrei com o AD, quando eu mudo o grupo do usuário no AD, leva alguns minutos para surtir efeito.
É correto isso?
Outra coisa... já peguei vários caso em tive que reiniciar o Wimbind porque o navegador não detectava o proxy e/ou não solicitava usuário e senha...
Isso acontece com você ou é alguma configuração que está faltando?
Valeuu