2

So, I've been running a project lately, which is to mount a Squid proxy on Raspbian (on Raspberry pi via webmin). This project is divided into two parts;

  • The first, which I have already completed, is to configure a Squid that works transparently for the user.

  • The second one (which is the one that is driving me crazy and is totally independent from the first part), consists of configuring a proxy which authenticates with an active directory (either LDAP or AD) Obviously the process will be somewhat different but at least if I can do it with one of them , I will be able to do the other), so that, (preferably **), when a user tries to access the internet, a screen pops up asking for the username and password, in order to control which users / groups of the directory can access to the internet and apply different ACLs to different users.

** I have put preferably since I have been reading that when configuring squid proxy to be authenticated in an active directory, it detects which user is trying to access and the authentication screen is no longer necessary, but I could not confirm it since I have not arrived to make the proxy work in this way.

While I have not documented the process, I can provide the tutorial that I have followed to the letter (except for some commands and configurations that have changed due to software updates ...). It is the following:

https://www.howtoforge.com/debian-squeeze-squid-kerberos-ldap-authentication-active-directory-integration-and-cyfin-reporter

As I say, I followed the tutorial to the letter, but I have not managed to make the proxy work, or at least, I have not got any user to surf the Internet, so after a time of unsuccessful testing I come here to ask if there is Some way of doing what I need: the fact that only users authenticated in the AD can make use of the proxy, and that ACLs can be applied on these (or perhaps on groups of users).

If this is possible, I would appreciate someone giving me some information on how I can do this or at least some more recent tutorial that I can follow.

Thank you very much in advance and I hope that someone can help me with this.

THR4SH3RP0L0
  • 121
  • 1
  • 1
  • 3

1 Answers1

1

Note that in transparent proxy deployment the browser is not aware of the proxy, thus the browser refuses to present any user credentials to unknown requestor. In order to use proxy authentication you must configure your browser to explicitly connect to the proxy (default port 3128 in case of Squid).

Having switched to explicit proxy deployment, you need to configure Squid to use authenticators that will perform AD/LDAP authentication on behalf of Squid. The long guide for Active Directory integration is at https://docs.diladele.com/administrator_guide_6_4/active_directory/index.html. In short - use Negotiate/NTLM, NTLM or Basic LDAP authentication helpers.

Rafael
  • 534
  • 2
  • 3
  • 1
    Yes! I was aware of that. This seems like a very extense guide, I'll give it a try, If I get it to work I'll mark this as the correct answer, thank you so much! – THR4SH3RP0L0 Nov 13 '18 at 12:31