Kerberos Squid without authentication?

killmasta93

@mcury
its because im opening the chrome inside of the windows server which im logged on as administrador

this is another user

mcury

Ok, in this last screenshot, the username is Windows10?
Is this user a member of the group used in ldapusersearch?

You are almost there.. soon we will find the problem

killmasta93

@mcury
thanks for the reply,
so on the squidguard

ldapusersearch ldap://apolo.casa.local:3268/dc=casa,dc=local?userPrincipalName?sub?(&(memberof=%2cCN=Users%2cDC=casa%2cDC=local)(userPrincipalName=%s))

and the user is located in

CN=windows10,CN=Users,DC=casa,DC=local

mcury

ldapusersearch ldap://apolo.casa.local:3268/dc=casa,dc=local?userPrincipalName?sub?(&(memberof=%2cCN=Users%2cDC=casa%2cDC=local)(userPrincipalName=%s))

You used a %2c in the wrong place (It means a ',')

It should be:

ldapusersearch ldap://apolo.casa.local:3268/dc=casa,dc=local?userPrincipalName?sub?(&(memberof=CN=Users%2cDC=casa%2cDC=local)(userPrincipalName=%s))

It's important to notice that you are not filtering users by group in this case..
I would create a group, like internet, add the members to this group, and then filter like this:

ldapusersearch ldap://apolo.casa.local:3268/dc=casa,dc=local?userPrincipalName?sub?(&(memberof=CN=internet%2cCN=Users%2cDC=casa%2cDC=local)(userPrincipalName=%s))

killmasta93

@mcury said in Kerberos Squid without authentication?:

ldapusersearch ldap://apolo.casa.local:3268/dc=casa,dc=local?userPrincipalName?sub?(&(memberof=CN=internet%2cCN=Users%2cDC=casa%2cDC=local)(userPrincipalName=%s))

Thanks again for the reply, so i changed to

ldapusersearch ldap://apolo.casa.local:3268/dc=casa,dc=local?userPrincipalName?sub?(&(memberof=CN=internet%2cCN=Users%2cDC=casa%2cDC=local)(userPrincipalName=%s))

then created group called internet added windows10 and administrador but same issue with popup

CN=internet,CN=Users,DC=casa,DC=local

Im thinking its a squid issue but dont know what else to do :(

mcury

Try port 389 instead of 3268.. Who knows..

killmasta93

@mcury

Thanks for the reply,
so on squid i had to remove

http_access allow deny

now i got to squidguard i see this log

(squidGuard): ldap_search_ext_s failed: Operations error (params: dc=casa,dc=local, 2, (&(memberof=CN=internet,CN=Users,DC=casa,DC=local)(userPrincipalName=administrador)),

i also had to configure on squidguard

mcury

So, is it working now ?

if not, I would focus on the ldapusersearch..

killmasta93

thanks for the reply,
so correct its navigating with the user now i need to block but i see the log on squidguard

12.05.2021 19:45:34	(squidGuard): ldap_search_ext_s failed: Operations error (params: DC=casa,DC=local, 2, (&(memberof=CN=internet,CN=Users,DC=casa,DC=local)(userPrincipalName=administrador)), userPrincipalName)

mcury

Try to tick that option in squidguard: Strip NT domain name.
If ticking it doesn't work, undo it..

mcury

Test this:

1 - Disable Squidguard authentication tab
2 - Enable Squid authentication tab with the following details:

Squid Authentication LDAP Settings > LDAP Base Domain:
DC=casa,DC=local -R

(-R option will enable the recursive search in domain).

Note: keep the ldapusersearch the same as before, using port 3268

Then try again and post here in case it works.

KaP

Google Chrome and other browsers from a certain version onwards (I can't say from which one) don't allow "Transparent" authentication without the Pop Up window appearing.
So I don't think you will be able to accomplish what you intended.

If I am wrong can you correct me please.

killmasta93

@mcury
Thanks for the reply, so got it working, i used the pf2ad script
but on ldap for squidguard how to add a group with a space the group is called domain users

ldapusersearch ldap://apolo.casa.local:3268/DC=casa,DC=local?sAMAccountName?sub?(&(sAMAccountName=%s)(memberOf=CN=domain users%2cCN=Users%2cDC=casa%2cDC=local))