Squid3 autenticando no samba4

brunobds
(usa Ubuntu)

Enviado em 31/07/2015 - 16:49h

Ola

Estou configurando o squid3 e estou querendo que ele autentique usando a mesma base de autenticação que o Samba, estou pesquisando na internet porem todos os conteúdos que encontrei na web não me ajudaram.

Senário:

Servidor Ubuntu 14.04 64 bits

Squid 3.3.6

Samba 4.1.6

pacotes instalados

samba
samba-client
squid3

Arquivos

smb.conf



[global]

   workgroup = dominio

   server string = %h server (Samba, Ubuntu)

   dns proxy = no

   interfaces = eth0

   bind interfaces only = yes

   log file = /var/log/samba/log.%m

   max log size = 1000

   syslog = 0

   panic action = /usr/share/samba/panic-action %d

   os level=100

####### Authentication #######

   security = user

   encrypt passwords = true

   passdb backend = tdbsam

   obey pam restrictions = yes

   unix password sync = yes

   passwd program = /usr/bin/passwd %u

   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .

   pam password change = yes

   map to guest = bad user

   hosts allow=10.100.42. 192.168.0. 192.168.1. 192.168.2. 192.168.3

########## Domains ###########

   domain logons = yes

   logon path =

   logon script = %U.bat

   add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody %u



######## seguranca de acesso ##########



   admin users = bsantos



   username level = 3

   password level = 8



###### Melhorar Performace da Rede ########



   socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192





####### Padrao de Codificacao ########



   unix charset = iso8859-1

   display charset = cp850



   level2 oplocks = no

   ntlm auth = yes

   lanman auth = yes

   client ntlmv2 auth = yes



############ Misc ############

   veto files = /*.mp3/*.wmv/*.wma/*.ogg/*.avi/*.mpeg/*.mpg/*.mp4/*.scr/*.inf/*.vbs/

   domain master = auto

   usershare allow guests = yes



[homes]

   comment = Home Directories

   browseable = no

   writable = yes

   valid users = %S

   create mode = 0664

   directory mode = 0775



[netlogon]

    comment = Network Logon Service

    path = /home/netlogon

    guest ok = yes

    writable = no



 

**************************************************************************************************************************

squid.conf



http_port 3128

hierarchy_stoplist cgi-bin ?



acl QUERY urlpath_regex cgi-bin \?

no_cache deny QUERY



cache_mem 50 MB

cache_swap_high 90

cache_swap_low 70

maximum_object_size 4096 KB

maximum_object_size_in_memory 8 KB

cache_replacement_policy heap LFUDA

cache_mgr suporte@tome.com.br





cache_dir ufs /var/spool/squid3 100 16 256

cache_access_log /var/log/squid3/access.log

cache_log /var/log/squid3/cache.log

cache_store_log /var/log/squid3/store.log

cache_swap_log /var/log/squid3/cache_swap.log



# ---- Windows Update ----

acl microsoft url_regex "/etc/squid3/ms-update"

acl domain_watson dstdomain watson.microsoft.com

http_access allow microsoft

http_access allow domain_watson



auth_param basic program /usr/lib/squid3/basic_smb_auth -W empresa -U 127.0.01 -D

auth_param basic children 5

auth_param basic realm TI - EMPRESA empresa

auth_param basic credentialsttl 2 hours

auth_param basic casesensitive off



refresh_pattern ^ftp:           1440    20%     10080

refresh_pattern ^gopher:        1440    0%      1440

refresh_pattern .               0       20%     4320



acl password proxy_auth REQUIRED

acl liberado proxy_auth "/etc/squid3/usuarios-liberados"

acl deixados proxy_auth "/etc/squid3/usuarios-lentos"

acl all src

acl negados   url_regex "/etc/squid3/sites-proibidos"

acl bloqueados url_regex "/etc/squid3/malware.txt"

acl inocentes url_regex "/etc/squid3/sites-inocentes"

acl lentos    url_regex "/etc/squid3/sites-lentos"

acl slentos  url_regex "/etc/squid3/sites-slentos"

acl SSL_ports port 443 563

acl Safe_ports port 80          # http

acl Safe_ports port 21          # ftp

acl Safe_ports port 443 563     # https, snews

acl Safe_ports port 70          # gopher

acl Safe_ports port 210         # wais

acl Safe_ports port 1025-65535  # unregistered ports

acl Safe_ports port 280         # http-mgmt

acl Safe_ports port 488         # gss-http

acl Safe_ports port 591         # filemaker

acl Safe_ports port 777         # multiling http

acl Safe_ports port 81          # http-alternative

acl Safe_ports port 83          # MIT ML Device

acl Safe_ports port 8180        #

acl Safe_ports port 8081        #

acl CONNECT method CONNECT

acl CONNECT method CONNECT

acl tome src 10.100.42.0/24



http_access allow manager localhost

http_access allow liberado

http_access deny manager

http_access deny !Safe_ports



 

***********************************************************************************************

Testei, configurei no client Windows 7, browser IE9 configurei o proxy 10.100.42.1:3128

Me aparece a pela de login e senha porem não autentica pede novamente o usuário e senha e não abre as paginas.

Antes de tentar configurar para acessar autenticando com o Samba estava utilizando um arquivo de autenticação independente para o squid e funcionava.

Agradeço desde já pela ajuda de todos.