Why doesn't Squid authenticate through Actice Directory?

Question

LDAP

Colleagues, good afternoon. I configure a transparent proxy through AD and Kerberos V5. CentOS 7 injected into domain with realm:

[[email protected] ~]# realm list
domain.ru
  type: kerberos
  realm-name: DOMAIN.RU
  domain-name: domain.ru
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common-tools
  login-formats: %[email protected]
  login-policy: allow-realm-logins

Build Squid:

Squid Cache: Version 3.5.20
Service Name: squid
configure options:  '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--disable-strict-error-checking' '--exec_prefix=/usr' '--libexecdir=/usr/lib64/squid' '--localstatedir=/var' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--with-logdir=$(localstatedir)/log/squid' '--with-pidfile=$(localstatedir)/run/squid.pid' '--disable-dependency-tracking' '--enable-eui' '--enable-follow-x-forwarded-for' '--enable-auth' '--enable-auth-basic=DB,LDAP,MSNT-multi-domain,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB,SMB_LM,getpwnam' '--enable-auth-ntlm=smb_lm,fake' '--enable-auth-digest=file,LDAP,eDirectory' '--enable-auth-negotiate=kerberos' '--enable-external-acl-helpers=file_userip,LDAP_group,time_quota,session,unix_group,wbinfo_group,kerberos_ldap_group' '--enable-cache-digests' '--enable-cachemgr-hostname=localhost' '--enable-delay-pools' '--enable-epoll' '--enable-ident-lookups' '--enable-linux-netfilter' '--enable-removal-policies=heap,lru' '--enable-snmp' '--enable-ssl-crtd' '--enable-storeio=aufs,diskd,rock,ufs' '--enable-wccpv2' '--enable-esi' '--enable-ecap' '--with-aio' '--with-default-user=squid' '--with-dl' '--with-openssl' '--with-pthreads' '--disable-arch-native' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -fpie' 'LDFLAGS=-Wl,-z,relro  -pie -Wl,-z,relro -Wl,-z,now' 'CXXFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -fpie' 'PKG_CONFIG_PATH=:/usr/lib64/pkgconfig:/usr/share/pkgconfig'

The contents of the keytab file:

slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    3               HTTP/[email protected]

There is a user in AD - squid2018, for which the keytab was created. We check:

[[email protected] ~]# kinit HTTP/[email protected]
Password for HTTP/[email protected]:

The password for squid2018 is accepted, we get a ticket:

[[email protected] ~]# klist
Ticket cache: KEYRING:persistent:0:0
Default principal: HTTP/[email protected]

Valid starting       Expires              Service principal
06/27/2018 12:05:09  06/27/2018 22:05:09  krbtgt/[email protected]
        renew until 07/04/2018 12:04:52

Then we destroy it.
Contents of /etc/squid/squid.conf

# Авторизация в Active Directory
auth_param negotiate program /usr/lib64/squid/negotiate_kerberos_auth -s HTTP/[email protected]
auth_param negotiate children 600
auth_param negotiate keep_alive off

external_acl_type ad_group_member_check ttl=120 %LOGIN /usr/lib64/squid/ext_ldap_group_acl -d -v3 -P -R -K -b "DC=domain,DC=ru" -D "[email protected]" -w VerySecretPassword -f "(&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru))" -h hs-dc-1.domain.ru

# Обязательная авторизация, без неё нет доступа!
acl auth proxy_auth REQUIRED

# Стандартные порты
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT

# Стандартные разрешения
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localhost
http_access allow auth
http_access deny all

# Порты прокси-сервера
http_port 172.31.4.64:3128
http_port 172.31.4.64:3127 transparent

# Настройки кэширования
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

# Принудительно задаем желаемый DNS-сервер
dns_nameservers 172.31.2.113
dns_v4_first on

# Включаем русский язык для сообщений сервера
error_directory /usr/share/squid/errors/ru-ru
error_default_language ru

Squid status:

[[email protected] ~]# systemctl status squid
● squid.service - Squid caching proxy
   Loaded: loaded (/usr/lib/systemd/system/squid.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2018-06-27 11:31:08 MSK; 42min ago
  Process: 2753 ExecStop=/usr/sbin/squid -k shutdown -f $SQUID_CONF (code=exited, status=0/SUCCESS)
  Process: 2762 ExecStart=/usr/sbin/squid $SQUID_OPTS -f $SQUID_CONF (code=exited, status=0/SUCCESS)
  Process: 2756 ExecStartPre=/usr/libexec/squid/cache_swap.sh (code=exited, status=0/SUCCESS)
 Main PID: 2765 (squid)
   CGroup: /system.slice/squid.service
           ├─2765 /usr/sbin/squid -f /etc/squid/squid.conf
           ├─2767 (squid-1) -f /etc/squid/squid.conf
           ├─2768 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D [email protected] -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru
           ├─2769 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D [email protected] -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru
           ├─2770 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D [email protected] -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru
           ├─2771 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D [email protected] -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru
           ├─2772 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D [email protected] -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru
           └─2773 (logfile-daemon) /var/log/squid/access.log

Jun 27 11:31:08 vs-otr-squid02 systemd[1]: Starting Squid caching proxy...
Jun 27 11:31:08 vs-otr-squid02 squid[2765]: Squid Parent: will start 1 kids
Jun 27 11:31:08 vs-otr-squid02 squid[2765]: Squid Parent: (squid-1) process 2767 started
Jun 27 11:31:08 vs-otr-squid02 systemd[1]: Started Squid caching proxy.

But in the browser, a window for entering a name and password pops up, which should not be. Okay, I enter, but it is not accepted, and in /var/log/squid/cache.log this is what it says:

2018/06/27 12:19:46 kid1| Starting new negotiateauthenticator helpers...
2018/06/27 12:19:46 kid1| helperOpenServers: Starting 1/600 'negotiate_kerberos_auth' processes
2018/06/27 12:19:46 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:50 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:51 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:51 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:55 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:55 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:57 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:59 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:20:00 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:20:03 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:20:06 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}

Please help, colleagues. Thanks in advance.

Answer 1

У меня EL6, доводить до EL7 придется Вам самим.
- Как называется файл keytab? Если иначе чем krb5.keytab - его имя нужно передавать через окружение. Squid принимает его через переменную KRB5_KEYTAB, которую я занес в /etc/sysconfig/squid:

# Kerberos keytab file
KRB5_KTNAME="/etc/proxy.keytab"
export KRB5_KTNAME

- Принципал записан правильно? Вот так у меня выглядит auth_param:
Вот так выглядит external_acl, который отслеживает вхождение в группу:
(AccessFull - группа в AD)
- что говорит подобная команда?
(должна отработать без вопросов)
Каким орбразом мапился принципал? Я для этого использовал команду виндовой консоли (делалось давно!):
(использовался доменный юзер proxy и его пароль)