Hello
Someone have a centos squid-2.5 + active directory auth ? like user@domain.com, the active directory not install in mixed mode.
thanks in advance
Cesar Lagarrigue clagarrigue@bee.cl wrote:
Someone have a centos squid-2.5 + active directory auth ? like user@domain.com, the active directory not install in mixed mode. thanks in advance
If you're not in mixed mode, I don't think you can use NTLM (not even NTLMv2) authentication, at least not directly. You can only use Kerberos, although the Samba team has exposed that some mixed mode services are still active in even native mode (because things on Windows itself would break if they didn't).
What I recommend is that you setup a one-way trust from ADS to a UNIX Kerberos realm, using ADS as the KDC. You can then authenticate against that UNIX Kerberos realm with whatever method the local NSSwitch/PAM authentication supports where you are running Squid.
"Bryan J. Smith" b.j.smith@ieee.org wrote:
What I recommend is that you setup a one-way trust from ADS to a UNIX Kerberos realm, using ADS as the KDC.
This does not require Samba at all BTW. You're merely setting up a UNIX Kerberos client to a Windows Domain Controller (DC) that is also the Kerberos Key Distribution Center (KDC) aka "key server."
Some basic intro on this is here (Non-Windows client authentication to Windows KDC): http://www.microsoft.com/technet/prodtechnol/windows2000serv/maintain/featus...
Kerberos clients in Linux now support MSKerberos extensions: http://web.mit.edu/pismere/kerberos/Pismere-kerberos-notes.htm
It's important to understand which system/platform is the Kerberos client and which system/platform is the KDC in this documentation. In your case, you clearly want to use a Windows DC as your KDC, and your UNIX system with Squid as a client.
You can then authenticate against that UNIX Kerberos realm with whatever method the local NSSwitch/PAM authentication supports where you are running Squid.
I guess what I'm saying is that you have 2 choices on the system running .
1. You can setup your UNIX system to authenticate against Kerberos for any user, assuming your Kerberos client services have been setup against for the entier system (as above).
2. You can setup a Kerberosized Squid (never tried this myself).
3. You can setup Squid with GSSAPI/SASL, which then authenticates against Kerberos (never tried this myself).
There are a lot of options to explore. I can't really give you a "cookbook" approach (I've used #1 myself), because it might not be appropriate for your system (#1 means you're always authorizing the entire system against Kerberos).
-
Bryan J. Smith -
Cesar Lagarrigue