Solved

How to use group membership to control internet users with SQUID LDAP authentication.

Posted on 2010-08-18
2
542 Views
Last Modified: 2013-12-16
Hey Team,
We have a working SQUID server.   It does authentication against Active Directory via LDAP.  Currently there is a group that is allowed to surf the internet unrestricted:  Group0 if you will..  Anyone not in the group is white listed to only a few business sites.  This all works fine.  My question is this:  Now I need to make several new active directory groups and based on their membership white list them to the required business web sites only.  So for example:  Group1 needs to only be able to go to www.google.com.  Group2 members should be able to only go to www.yahoo.com.  The Group0 we discussed earlier can go anywhere on the internet.  How do I do this?"
Thanks!!!!
0
Comment
Question by:tedayoungii
2 Comments
 

Author Comment

by:tedayoungii
Comment Utility
I went ahead and posted the pertenent current ldap settings that work.  Below:


auth_param basic program /usr/lib/squid/squid_ldap_auth -R -b "dc=xxxxx,dc=xxxxxxxx,dc=com" -D "CN=LDAP USERNAME,OU=IT,OU=SUI,DC=xxxxxxx,DC=xxxxxxxxxx,DC=com" -w "password" -f sAMAccountName=%s -h dc01
auth_param basic children 5
auth_param basic realm xxxxxxxx
auth_param basic credentialsttl 480 minute
auth_param basic casesensitive off

##group auth
external_acl_type internetusergroup %LOGIN /usr/lib/squid/squid_ldap_group -R -b "dc=xxxxxxx,dc=xxxxxxx,dc=com" -D "CN=LDAP USERNAME,OU=IT,OU=SUI,DC=xxxxxx,DC=xxxxxx,DC=com" -w "password" -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=CN=Firebox Users,OU=Security Groups,OU=SUI,DC=xxxxxx,DC=xxxxxx,DC=com))" -h DC01



acl internetusergroup proxy_auth REQUIRED
acl internetgroup external internetusergroup internetusers
acl Allowed_Sites url_regex "/etc/squid/allowed-sites.acl"
http_access allow internetgroup
http_access allow internetusergroup Allowed_Sites
#http_access deny internetusergroup
#http_access deny bad
http_access deny all
0
 
LVL 3

Accepted Solution

by:
pitt7 earned 500 total points
Comment Utility
Use the auth_param parameter as is.

Change ##group auth to (the %a at memberof=CN= is the relevant change)
external_acl_type internetusergroup %LOGIN /usr/lib/squid/squid_ldap_group -R -b "dc=xxxxxxx,dc=xxxxxxx,dc=com" -D "CN=LDAP USERNAME,OU=IT,OU=SUI,DC=xxxxxx,DC=xxxxxx,DC=com" -w "password" -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=CN=%a,OU=Security Groups,OU=SUI,DC=xxxxxx,DC=xxxxxx,DC=com))" -h DC01

acl internetusergroup proxy_auth REQUIRED
acl internetgroup external internetusergroup internetusers
acl InternetGroup1 external internetusergroup Group1
acl Group1_Sites url_regex "/etc/squid/allowed-sites_Group1.acl"
acl Allowed_Sites url_regex "/etc/squid/allowed-sites.acl"

http_access allow internetgroup
http_access allow InternetGroup1 Group1_Sites
http_access allow internetusergroup Allowed_Sites
http_access deny all
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

I am a long time windows user and for me it is normal to have spaces in directory and file names. Changing to Linux I found myself frustrated when I moved my windows data over to my new Linux computer. The problem occurs when at the command line.…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now