SquidGuard and Active Directory groups

Question

I'm configuring a Linux proxy with Squid and SquidGuard to filter Internet traffic.

I know how to authenticate users against Active Directory in Squid, and then how to filter access for users using SquidGuard.

The question: how to use Active Directory groups in SquidGuard instead of plain user names?

My goal is to be able to configure rules like "members of this group can go anywhere" or "members of this group can only visit certain sites".

I know SquidGuard can't manage group membership directly, but it can do LDAP searches on its own; but the syntax to look up wheter a user is member of a given group seems to be quite cryptic, and I couldn't find any good documentation around.

Answer 1

Solved.

Assuming the following:

- Domain name: "domain.com"
- Group name: "Internet Users"
- User name: "UserName"
- Path to group: "domain.com\OU1\OU2\Internet Users"

The query for checking if the user is member of that group would be:

(&(memberOf=CN=Group Name,OU=OU2,OU=OU1,DC=domain,DC=com)(SAMAccountName=UserName))

So you would have to add the following to squidGuard.conf to identify the members of that group ("%s" is squidGuard.conf's placeholder for "the client's user name"):

src Internet_Users {
    ldapusersearch  ldap://dc.domain.com/DC=domain,DC=com?sAMAccountName?sub?(&(sAMAccountName=%s)(memberOf=CN=Internet Users,OU=OU2,OU=OU1,DC=domain,DC=com))
}

Caveat: it will not work if written as above, giving you a laconic "syntax error" message; this is because (part of) the statement is treated like a URL, so you have to escape special characters such as commas and whitespaces; the correct form would thus be this one:

src Internet_Users {
    ldapusersearch  ldap://dc.domain.com/DC=domain,DC=com?sAMAccountName?sub?(&(sAMAccountName=%s)(memberOf=CN=Internet%20Users%2cOU=OU2%2cOU=OU1%2cDC=domain%2cDC=com))
}

Also, in order to avoid problems with Active Directory referrals (sometimes a DC will just redirect you to another one, even if you are on the same domain it manages), it might be useful to query a global catalog:

src Internet_Users {
    ldapusersearch  ldap://gc.domain.com:3268/DC=domain,DC=com?sAMAccountName?sub?(&(sAMAccountName=%s)(memberOf=CN=Internet%20Users%2cOU=OU2%2cOU=OU1%2cDC=domain%2cDC=com))
}

Answer 2

Disclaimer: I've not done this, and I am not familiar with SquidGuard. Having said that here are some possible approaches.

1) If you add your squid machine to the domain you will be able to resolve AD groups and look up AD group membership via nss so you should be able to use the squid_unix_group helper. According to it's man page it even has a switch for stripping off the domain portion of AD groups.

2) Given that AD is an LDAP server of sorts, I suspect you would be able to use squid_ldap_group which according to the man page:

"As expected by the external_acl construct of Squid, after specifying a username and group followed by a new line, this helper will produce either OK or ERR on the following line to show if the user is a member of the specified group."

3) Even if that does not work, you should probably be able to gen up a functional equivalent using the squid external_acl_type.

4) Check out http://etutorials.org/Server+Administration/Squid.+The+definitive+guide/Chapter+12.+Authentication+Helpers/12.5+External+ACLs/ this mentions some helpers (wbinfo_group, winbindd_group) which do not appear to have been built/installed in the version of squid I am running.

As for a query to see whether a user is a member of an LDAP group or not, it depends on what sort of LDAP group as different groups, use different attributes to define membership.

Some example query filters are: To see if a person is a member of a groupOfUniqueNames:

(&(cn=<GROUP_CN>)(objectClass=groupOfUniqueNames)(uniqueMember=<MEMBER_DN>))

To see if a uid is a member of a posixGroup:

(&(cn=<GROUPCN>)(objeCtclass=posixGroup)(memberUid=<UID>))

If these match they will return the group entry or the attributes of the group you specify, if you specify any.

Hope it helps.