Kerberos Squid without authentication?

killmasta93

@mcury
thanks for the reply,
so on the squidguard

ldapusersearch ldap://apolo.casa.local:3268/dc=casa,dc=local?userPrincipalName?sub?(&(memberof=%2cCN=Users%2cDC=casa%2cDC=local)(userPrincipalName=%s))

and the user is located in

CN=windows10,CN=Users,DC=casa,DC=local

mcury

ldapusersearch ldap://apolo.casa.local:3268/dc=casa,dc=local?userPrincipalName?sub?(&(memberof=%2cCN=Users%2cDC=casa%2cDC=local)(userPrincipalName=%s))

You used a %2c in the wrong place (It means a ',')

It should be:

ldapusersearch ldap://apolo.casa.local:3268/dc=casa,dc=local?userPrincipalName?sub?(&(memberof=CN=Users%2cDC=casa%2cDC=local)(userPrincipalName=%s))

It's important to notice that you are not filtering users by group in this case..
I would create a group, like internet, add the members to this group, and then filter like this:

ldapusersearch ldap://apolo.casa.local:3268/dc=casa,dc=local?userPrincipalName?sub?(&(memberof=CN=internet%2cCN=Users%2cDC=casa%2cDC=local)(userPrincipalName=%s))

killmasta93

@mcury said in Kerberos Squid without authentication?:

ldapusersearch ldap://apolo.casa.local:3268/dc=casa,dc=local?userPrincipalName?sub?(&(memberof=CN=internet%2cCN=Users%2cDC=casa%2cDC=local)(userPrincipalName=%s))

Thanks again for the reply, so i changed to

ldapusersearch ldap://apolo.casa.local:3268/dc=casa,dc=local?userPrincipalName?sub?(&(memberof=CN=internet%2cCN=Users%2cDC=casa%2cDC=local)(userPrincipalName=%s))

then created group called internet added windows10 and administrador but same issue with popup

CN=internet,CN=Users,DC=casa,DC=local

Im thinking its a squid issue but dont know what else to do :(

mcury

Try port 389 instead of 3268.. Who knows..

killmasta93

@mcury

Thanks for the reply,
so on squid i had to remove

http_access allow deny

now i got to squidguard i see this log

(squidGuard): ldap_search_ext_s failed: Operations error (params: dc=casa,dc=local, 2, (&(memberof=CN=internet,CN=Users,DC=casa,DC=local)(userPrincipalName=administrador)),

i also had to configure on squidguard

mcury

So, is it working now ?

if not, I would focus on the ldapusersearch..

killmasta93

thanks for the reply,
so correct its navigating with the user now i need to block but i see the log on squidguard

12.05.2021 19:45:34	(squidGuard): ldap_search_ext_s failed: Operations error (params: DC=casa,DC=local, 2, (&(memberof=CN=internet,CN=Users,DC=casa,DC=local)(userPrincipalName=administrador)), userPrincipalName)

mcury

Try to tick that option in squidguard: Strip NT domain name.
If ticking it doesn't work, undo it..

mcury

Test this:

1 - Disable Squidguard authentication tab
2 - Enable Squid authentication tab with the following details:

Squid Authentication LDAP Settings > LDAP Base Domain:
DC=casa,DC=local -R

(-R option will enable the recursive search in domain).

Note: keep the ldapusersearch the same as before, using port 3268

Then try again and post here in case it works.

KaP

Google Chrome and other browsers from a certain version onwards (I can't say from which one) don't allow "Transparent" authentication without the Pop Up window appearing.
So I don't think you will be able to accomplish what you intended.

If I am wrong can you correct me please.

killmasta93

@mcury
Thanks for the reply, so got it working, i used the pf2ad script
but on ldap for squidguard how to add a group with a space the group is called domain users

ldapusersearch ldap://apolo.casa.local:3268/DC=casa,DC=local?sAMAccountName?sub?(&(sAMAccountName=%s)(memberOf=CN=domain users%2cCN=Users%2cDC=casa%2cDC=local))