Squid proxy automatic authentication

Question

So I have setup a squid proxy on a Ubuntu server and now want to setup user targeting with my domain.I would like to be able to set acl's for security groups within AD, is this possible and how can I do this?

The users also need to authenticate with the proxy as it is wide open at the moment, I have set the proxy with group policy. I want the proxy to be linked to AD so that users login and get specific acl's. All the tutorials I've seen are pop-up messages asking for the username and password. I would like this to happen automatically so when the user logs in they automatically authenticate. How would I achieve this? I thought NTLM would play a part in this? And then the security groups that the user is part of will have a set of blocked websites that squid enforces

Thanks in advance

Answer 1

Here is an example configuration that does what you want:

## Active Directory Authentication
auth_param basic program /usr/lib/squid/basic_ldap_auth -R -b "dc=example,dc=com" -D [email protected] -W /etc/squid/conf.d/ldap.pass -f sAMAccountName=%s -h example.com
auth_param basic children 100 startup=5 idle=5
auth_param basic realm Windows Logon
auth_param basic credentialsttl 2 hours

## Group Membership Lookup
external_acl_type ldap_group children-max=1000 children-startup=100 children-idle=50 %LOGIN /usr/lib/squid/ext_ldap_group_acl -d -R -b "dc=example,dc=com" -D [email protected] -W /etc/squid/conf.d/ldap.pass -K -f "(&(objectclass=person)(sAMAccountName=%u)(memberof=CN=%g,OU=Squid_Users,DC=example,DC=com))" -h example.com

# Defines the networks which are allowed to use the proxy
acl allowed-networks src 192.168.1.0/24

# Defines the Active Directory Groups as Squid ACLs (i.e. `InternetGeneralUsers` is a group in AD)
acl users-general external ldap_group InternetGeneralUsers

# Defines the filter ACLs
acl domains-allowed dstdomain "/etc/squid/conf.d/domains/domains-allowed"

# Actual Allow/Deny rules
http_access allow allowed-networks users-general domains-allowed

# And finally deny all other access to this proxy
http_access deny all

This is a bit more than just Active Directory but the general concept is this:

1. Define connection to Active Directory for the Users.
2. Define how to lookup Groups from AD.
3. Define an ACL that includes members of an AD Group (in this example, the AD group is called InternetGeneralUsers and the Squid ACL is called users-general.
4. Define an allow rule that allow the Squid ACL users-general to go through the proxy.