16.3. Setting up Squid as a Caching Proxy With Kerberos Authentication

# yum install squid krb5-workstation

# kinit administrator@AD.EXAMPLE.COM

# export KRB5_KTNAME=FILE:/etc/squid/HTTP.keytab
# net ads keytab CREATE -U administrator

# net ads keytab ADD HTTP -U administrator

# chown squid /etc/squid/HTTP.keytab

#  klist -k /etc/squid/HTTP.keytab
Keytab name: FILE:/etc/squid/HTTP.keytab
KVNO Principal
---- --------------------------------------------------------------------------
...
   2 HTTP/proxy.ad.example.com@AD.EXAMPLE.COM
...

1. To configure the negotiate_kerberos_auth helper utility, add the following configuration entry to the top of /etc/squid/squid.conf:

   auth_param negotiate program /usr/lib64/squid/negotiate_kerberos_auth -k /etc/squid/HTTP.keytab -s HTTP/proxy.ad.example.com@AD.EXAMPLE.COM

   The following describes the parameters passed to the negotiate_kerberos_auth helper utility in the example above:
   • -k file sets the path to the key tab file. Note that the squid user must have read permissions on this file.
   • -s HTTP/host_name@kerberos_realm sets the Kerberos principal that Squid uses.
   Optionally, you can enable logging by passing one or both of the following parameters to the helper utility:
   • -i logs informational messages, such as the authenticating user.
   • -d enables debug logging.
   Squid logs the debugging information from the helper utility to the /var/log/squid/cache.log file.
2. Add the following ACL and rule to configure that Squid allows only authenticated users to use the proxy:

   acl kerb-auth proxy_auth REQUIRED
   http_access allow kerb-auth

   Important

   Specify these settings before the http_access deny all rule.
3. Remove the following rule to disable bypassing the proxy authentication from IP ranges specified in localnet ACLs:

   http_access allow localnet

4. The following ACL exists in the default configuration and defines 443 as a port that uses the HTTPS protocol:

   acl SSL_ports port 443

   If users should be able to use the HTTPS protocol also on other ports, add an ACL for each of these port:

   acl SSL_ports port port_number

5. Update the list of acl Safe_ports rules to configure to which ports Squid can establish a connection. For example, to configure that clients using the proxy can only access resources on port 21 (FTP), 80 (HTTP), and 443 (HTTPS), keep only the following acl Safe_ports statements in the configuration:

   acl Safe_ports port 21
   acl Safe_ports port 80
   acl Safe_ports port 443

   By default, the configuration contains the http_access deny !Safe_ports rule that defines access denial to ports that are not defined in Safe_ports ACLs.
6. Configure the cache type, the path to the cache directory, the cache size, and further cache type-specific settings in the cache_dir parameter:

   cache_dir ufs /var/spool/squid 10000 16 256

   With these settings:
   • Squid uses the ufs cache type.
   • Squid stores its cache in the /var/spool/squid/ directory.
   • The cache grows up to 10000 MB.
   • Squid creates 16 level-1 sub-directories in the /var/spool/squid/ directory.
   • Squid creates 256 sub-directories in each level-1 directory.
   If you do not set a cache_dir directive, Squid stores the cache in memory.

1. Create the cache directory:

   # mkdir -p path_to_cache_directory

2. Configure the permissions for the cache directory:

   # chown squid:squid path_to_cache_directory

3. If you run SELinux in enforcing mode, set the squid_cache_t context for the cache directory:

   # semanage fcontext -a -t squid_cache_t "path_to_cache_directory(/.*)?"
   # restorecon -Rv path_to_cache_directory

   If the semanage utility is not available on your system, install the policycoreutils-python-utils package.

# firewall-cmd --permanent --add-port=3128/tcp
# firewall-cmd --reload

# systemctl start squid

# systemctl enable squid

# kinit user@AD.EXAMPLE.COM

# klist

# /usr/lib64/squid/negotiate_kerberos_auth_test proxy.ad.example.com

Token: YIIFtAYGKwYBBQUCoIIFqDC...