• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Squid+Dansguardian with Active Directory (NTLM) Single Sign On WORKING!!!

Cache/Proxy
44
135
129.0k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • D
    dig1234
    last edited by Sep 2, 2013, 11:35 AM

    Firefox/IE mostly xp some 7. Had same issue in multiple AD environments.

    1 Reply Last reply Reply Quote 0
    • E
      echowings
      last edited by Sep 14, 2013, 10:27 AM Sep 12, 2013, 7:26 AM

      Hi,wheelz
      I'd successfully to build pfsense as you show us. It's work perfectly. But I got a problem that is i can not using application such as gtalk, office 2013  to using proxy. The auth is failed and squid told me 407 denied. Is that a way to slove the problems ?

      1 Reply Last reply Reply Quote 0
      • H
        harshkukreja
        last edited by Nov 11, 2013, 9:11 AM

        Hi! Wheelz

        First of all thanks for such a great post!! I have followed your steps but I am stuck with the below error which is not starting squid:

        php: /status_services.php: The command '/usr/local/etc/rc.d/squid.sh stop' returned exit code '1', the output was 'FATAL: Bungled /usr/pbi/squid-i386/etc/squid/squid.conf line 97: acl_uses_indirect_client on;follow_x_forwarded_for allow localhost;auth_param ntlm program /usr/local/bin/ntlm_auth –use-cached-creds --helper-protocol=squid-2.5-ntlmssp;auth_param ntlm children 10;auth_param ntlm keep_alive on;acl password proxy_auth REQUIRED;http_access allow password Squid Cache (Version 3.3.8): Terminated abnormally. CPU Usage: 0.010 seconds = 0.000 user + 0.010 sys Maximum Resident Size: 31904 KB Page faults with physical i/o: 0'

        What I have to achieve is this:

        To pass all users through non-transparent squid proxy using wpad/ pac file authenticating transparently SSO via NTLM using Samba 4 AD Domain Controller with squidgaurd web content filtering.

        ALL computers joined to a domain must authenticate to squid using SSO passing through squidgaurd web content filtering to Internet.

        Please help to achieve the same.

        Thanks

        Harsh Kukreja

        Email: harshkukreja2008@gmail.com

        1 Reply Last reply Reply Quote 0
        • S
          sm1ly
          last edited by Nov 11, 2013, 9:36 AM Nov 11, 2013, 9:28 AM

          hello all.
          thx for this great post.

          I got some questions. about groups.
          I dont understand how to use multiply groups.
          for example I got soc_group and nosoc_group
          soc_group can go to yahoo.com
          nosoc_group - can't do that.

          the second problem.
          i defined non default group  and it block users not in OU 110 and group rdp_110 it writes that user banned, but users inside this group (rdp_110) can use all sites((((

          and the second question.
          what about reports? I need report with username - but not IP

          1 Reply Last reply Reply Quote 0
          • K
            khushal
            last edited by Nov 23, 2013, 10:44 PM

            This works for SquidGaurd too with minor changes… Good Work..

            I was able to configure pfSense + Squid3 + SquidGaurd3 + Active Directory with Single SignOn (SSO).

            thanks
            KsN

            1 Reply Last reply Reply Quote 0
            • E
              echowings
              last edited by Nov 25, 2013, 3:05 PM

              @khushal:

              This works for SquidGaurd too with minor changes… Good Work..

              I was able to configure pfSense + Squid3 + SquidGaurd3 + Active Directory with Single SignOn (SSO).

              thanks
              KsN

              Is that you make the gtalk like application working well ? I got some problems. All browser is okay.

              1 Reply Last reply Reply Quote 0
              • D
                dig1234
                last edited by Nov 25, 2013, 4:12 PM

                Can you provide some details on how you implemented this. In many situations SquidGuard is sufficient and easier to manage than dansguardian.

                @khushal:

                This works for SquidGaurd too with minor changes… Good Work..

                I was able to configure pfSense + Squid3 + SquidGaurd3 + Active Directory with Single SignOn (SSO).

                thanks
                KsN

                1 Reply Last reply Reply Quote 0
                • T
                  titus91360
                  last edited by Nov 25, 2013, 4:23 PM

                  GREAT !
                  I'm really interesting with your configuration.
                  Could you tell us what minor changes did you make ?

                  @khushal:

                  This works for SquidGaurd too with minor changes… Good Work..

                  I was able to configure pfSense + Squid3 + SquidGaurd3 + Active Directory with Single SignOn (SSO).

                  thanks
                  KsN

                  1 Reply Last reply Reply Quote 0
                  • E
                    echowings
                    last edited by Dec 8, 2013, 8:56 AM

                    @khushal:

                    This works for SquidGaurd too with minor changes… Good Work..

                    I was able to configure pfSense + Squid3 + SquidGaurd3 + Active Directory with Single SignOn (SSO).

                    thanks
                    KsN

                    Hi, my friends , I found that dansguardian is not working well when many person online using dansguardian as proxy. So i switch to squidguard. But i 'm not successfully to using ldap to auth  squidguard  against AD. Could help me to show how you configure it ? 
                    Thank you very much!

                    1 Reply Last reply Reply Quote 0
                    • F
                      Fabusch
                      last edited by Dec 23, 2013, 3:11 PM Dec 23, 2013, 3:09 PM

                      Hello Community,

                      Many thanks to wheelz for that strange ;D and cool workarround. Its working very very well, with some corrections ;-)
                      First of oll:
                      Im working as a Sysadmin in several schools (high- and professionalschool) in South Tirol.
                      Such a long time ago, I am interesting in Linux/Unix products to protect my networks or also only to test some cool stuff, thats not possible f.e. with windows :P. But now i am having trouble with things that exactly this post deals with and were im now stucking just some weeks. The general problem is, that the windows firewall product (known as ISA/TMG) will no longer suported in the future. Therefore i want to try to setup somthing similar with a  Linux/Unix System.
                      How i have allready said, this workarround is working pretty well, the only thing i need to correct is:

                      • 12. d) smb.conf –> insert there the command: winbind cache time = 60
                          idmap uid = 10000 - 20000 (enable for testing)
                          idmap gid = 10000 - 20000 (enable for testing)
                      • 17.) the Quote which must be inserted in the "Custom settings section" in the General tab of the Proxy is right and works, but only of you write it directly with the vi in the shell into the squid.conf (/usr/pbi/squid-i386/etc/squid/squid.conf) otherwise, some characters disappear ;-)
                      • 20. b.iii) the username must be in this format to work properly: username@domain.local

                      Now my problem: With the Microsoft ISA/TMG i can configure, that for example users(Students and Teachers, in my case), that are member of the Group "Internet" (created under Users.domain.local) can access the Internet. If they are not member of this group, they can never access the internet. Therefore i have allready written a tool (little .exe file), which with I or the teachers can put the students to this group (if they need the Inet during there lession) and after the lession the teachers put them away from the group Internet.
                      Now i am stucking to realize this with my pfsense box. I have googled now some weeks but I wasn't able to configure this (i just have had some nightmares about this problem and now I am at the point to go totaly insane). I tried to ad the squid_ldap_group feature (which is working with my Server 2008 R2, when i try it manualy in the shell) with the appropriate acl's (i dont now if they configured in the right way because the search results are quite confusing and are also conflicting themselves). I also tried IPFire but its always the same, im not able to configure it in this way, that when the users are member of this group, they can access to the Inet.
                      Maybe someone can give me a hint ore some good document were I can work further.

                      Kind regards and merry merry Christmas to everyone!!

                      1 Reply Last reply Reply Quote 0
                      • L
                        lucapsg
                        last edited by Jan 30, 2014, 11:19 PM

                        Hi all,
                        first of all, thank you again for the wonderful work.

                        I configured everything without problems on pfsense 2.0.3 and it's fine.
                        It works with 2.1?
                        Someone is using it?

                        1 Reply Last reply Reply Quote 0
                        • W
                          wheelz
                          last edited by Jan 31, 2014, 2:20 PM

                          I am on version 2.1 and am using it fine.  I think some of the versions are different now for the extra pkg_add commands but other than that I don't think there were too many differences in what I had to do.

                          1 Reply Last reply Reply Quote 0
                          • P
                            percyiii
                            last edited by Apr 11, 2014, 12:58 AM

                            Loaded the upgrade because of the openssl scare..
                            Dans now at 2.12.0.3_2 pkg v.0.1.8
                            Says no file /usr/pbi/dansguardian-amd64/etc/dansguardian/authplugins/proxy-ntlm.conf
                            So i loaded one from another box..
                            now says
                            auth_plugin_load() returned NULL pointer with config file: /usr/pbi/dansguardian-amd64/etc/dansguardian/authplugins/proxy-ntlm.conf
                            Any ideas?
                            THX

                            1 Reply Last reply Reply Quote 0
                            • P
                              percyiii
                              last edited by Apr 22, 2014, 7:21 PM

                              Have 3 boxes running this configuration.. Works great except… after heavy usage from 75 users.. The box goes to a crawl..
                              We are using
                              ESXI 5.1
                              all boxes up to date.
                              packages
                              Dansgaurdian
                              Shellcmd
                              Squid3
                              sarg

                              2 of 3 have separate virtual drives for the cache,logs, and sarg... sym linked ..
                              the 3rd has a 40G drive..
                              All do the same thing.
                              during peak hours they get real slow...
                              Only way seems to work is pair two together on the domain dns..
                              ie two entries for proxy.here.pvt one x.x.x.x and one y.y.y.y

                              Am going to try 2 real boxes.. but having a hard time trouble shooting the slowness...
                              Restarting squid seems to help...

                              tried setting
                              squid cache file system to aufs seems no change
                              vfs.read_max=32 to vfs.read_max=128 in System -> Advanced -> Sytem Tunables no change??

                              any ideas..

                              1 Reply Last reply Reply Quote 0
                              • marcellocM
                                marcelloc
                                last edited by Apr 23, 2014, 3:38 AM

                                Look for squid tweak on freebsd and set it on system tunable.

                                What max client value are you using on dansguardian?

                                Treinamentos de Elite: http://sys-squad.com

                                Help a community developer! ;D

                                1 Reply Last reply Reply Quote 0
                                • P
                                  percyiii
                                  last edited by Apr 23, 2014, 12:22 PM

                                  @marcelloc:

                                  Look for squid tweak on freebsd and set it on system tunable.

                                  What max client value are you using on dansguardian?

                                  Ok this may be it.. But where is the max client value set? In the GUI.. Is this the Min/Max children?

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    percyiii
                                    last edited by Apr 23, 2014, 12:31 PM

                                    @percyiii:

                                    @marcelloc:

                                    Look for squid tweak on freebsd and set it on system tunable.

                                    What max client value are you using on dansguardian?

                                    Ok this may be it.. But where is the max client value set? In the GUI.. Is this the Min/Max children?

                                    Ok I had the client IP's default which should be 0 So I set it to 0 I also set min maxchildren 32/180 the spare to 8/64 and age set to 10000 will see if that helps…
                                    THX for heading me in a better direction..

                                    1 Reply Last reply Reply Quote 0
                                    • marcellocM
                                      marcelloc
                                      last edited by Apr 24, 2014, 2:00 AM

                                      set clients close to 1024. In some cases I use 8k users to get a better performance(it depends on compiling package to support it, so keep client max values under 1024).

                                      IIRC, you can check if processes are near configured limit by using ps ax | grep dansguardian | wc -l

                                      Treinamentos de Elite: http://sys-squad.com

                                      Help a community developer! ;D

                                      1 Reply Last reply Reply Quote 0
                                      • I
                                        iMongui
                                        last edited by May 2, 2014, 8:55 PM

                                        General Tab -> Config settings section –> Auth Plugins = Proxy-Ntlm

                                        When I activate this feature, my service goes down :/ I only can work with Auth Plugins = None.

                                        Anyone can help me? I only need to activate this feature, I dont need more because i did all steps and now is working but I dont have AD support :/

                                        1 Reply Last reply Reply Quote 0
                                        • E
                                          evanderv
                                          last edited by May 12, 2014, 3:42 PM

                                          @percyiii:

                                          Loaded the upgrade because of the openssl scare..
                                          Dans now at 2.12.0.3_2 pkg v.0.1.8
                                          Says no file /usr/pbi/dansguardian-amd64/etc/dansguardian/authplugins/proxy-ntlm.conf
                                          So i loaded one from another box..
                                          now says
                                          auth_plugin_load() returned NULL pointer with config file: /usr/pbi/dansguardian-amd64/etc/dansguardian/authplugins/proxy-ntlm.conf
                                          Any ideas?
                                          THX

                                          I am having this same problem also.  proxy-ntlm.conf was never put into the authplugins on the latest dansguardian from pfsense.

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.