Início
Produtos
Red Hat Enterprise Linux
7
Networking Guide
16.3. Setting up Squid as a Caching Proxy With Kerberos Authentication

Este conteúdo não está disponível no idioma selecionado.

16.3. Setting up Squid as a Caching Proxy With Kerberos Authentication

This section describes a basic configuration of Squid as a caching proxy that authenticates users to an Active Directory (AD) using Kerberos. The procedure configures that only authenticated users can use the proxy.

Prerequisites

The procedure assumes that the /etc/squid/squid.conf file is as provided by the squid package. If you edited this file before, remove the file and reinstall the package.
The server on which you want to install Squid is a member of the AD domain. For details, see Setting up Samba as a Domain Member in the Red Hat Enterprise Linux 7 System Administrator's Guide.

Procedure

Install the following packages:
```
yum install squid krb5-workstation
```
```
# yum install squid krb5-workstation
```
Copy to Clipboard Toggle word wrap
Authenticate as the AD domain administrator:
```
kinit administrator@AD.EXAMPLE.COM
```
```
# kinit administrator@AD.EXAMPLE.COM
```
Copy to Clipboard Toggle word wrap

Create a keytab for Squid and store it in the /etc/squid/HTTP.keytab file:

export KRB5_KTNAME=FILE:/etc/squid/HTTP.keytab
net ads keytab CREATE -U administrator

# export KRB5_KTNAME=FILE:/etc/squid/HTTP.keytab
# net ads keytab CREATE -U administrator

Copy to Clipboard

Toggle word wrap

Add the HTTP service principal to the keytab:
```
net ads keytab ADD HTTP -U administrator
```
```
# net ads keytab ADD HTTP -U administrator
```
Copy to Clipboard Toggle word wrap
Set the owner of the keytab file to the squid user:
```
chown squid /etc/squid/HTTP.keytab
```
```
# chown squid /etc/squid/HTTP.keytab
```
Copy to Clipboard Toggle word wrap

Optionally, verify that the keytab file contains the HTTP service principal for the fully-qualified domain name (FQDN) of the proxy server:

 klist -k /etc/squid/HTTP.keytab

#  klist -k /etc/squid/HTTP.keytab
Keytab name: FILE:/etc/squid/HTTP.keytab
KVNO Principal
---- --------------------------------------------------------------------------
...
   2 HTTP/proxy.ad.example.com@AD.EXAMPLE.COM
...

Copy to Clipboard

Toggle word wrap

Edit the /etc/squid/squid.conf file:
1. To configure the negotiate_kerberos_auth helper utility, add the following configuration entry to the top of /etc/squid/squid.conf:
```
auth_param negotiate program /usr/lib64/squid/negotiate_kerberos_auth -k /etc/squid/HTTP.keytab -s HTTP/proxy.ad.example.com@AD.EXAMPLE.COM
```
```
auth_param negotiate program /usr/lib64/squid/negotiate_kerberos_auth -k /etc/squid/HTTP.keytab -s HTTP/proxy.ad.example.com@AD.EXAMPLE.COM
```
  Copy to Clipboard Toggle word wrap
  The following describes the parameters passed to the negotiate_kerberos_auth helper utility in the example above:
  - -k file sets the path to the key tab file. Note that the squid user must have read permissions on this file.
  - -s HTTP/host_name@kerberos_realm sets the Kerberos principal that Squid uses.
  Optionally, you can enable logging by passing one or both of the following parameters to the helper utility:
  - -i logs informational messages, such as the authenticating user.
  - -d enables debug logging.
  Squid logs the debugging information from the helper utility to the /var/log/squid/cache.log file.
2. Add the following ACL and rule to configure that Squid allows only authenticated users to use the proxy:
```
acl kerb-auth proxy_auth REQUIRED
http_access allow kerb-auth
```
```
acl kerb-auth proxy_auth REQUIRED
http_access allow kerb-auth
```
  Copy to Clipboard Toggle word wrap
  Important
  Specify these settings before the http_access deny all rule.
3. Remove the following rule to disable bypassing the proxy authentication from IP ranges specified in localnet ACLs:
```
http_access allow localnet
```
```
http_access allow localnet
```
  Copy to Clipboard Toggle word wrap
4. The following ACL exists in the default configuration and defines 443 as a port that uses the HTTPS protocol:
```
acl SSL_ports port 443
```
```
acl SSL_ports port 443
```
  Copy to Clipboard Toggle word wrap
  If users should be able to use the HTTPS protocol also on other ports, add an ACL for each of these port:
```
acl SSL_ports port port_number
```
```
acl SSL_ports port port_number
```
  Copy to Clipboard Toggle word wrap
5. Update the list of acl Safe_ports rules to configure to which ports Squid can establish a connection. For example, to configure that clients using the proxy can only access resources on port 21 (FTP), 80 (HTTP), and 443 (HTTPS), keep only the following acl Safe_ports statements in the configuration:
```
acl Safe_ports port 21
acl Safe_ports port 80
acl Safe_ports port 443
```
```
acl Safe_ports port 21
acl Safe_ports port 80
acl Safe_ports port 443
```
  Copy to Clipboard Toggle word wrap
  By default, the configuration contains the http_access deny !Safe_ports rule that defines access denial to ports that are not defined in Safe_ports ACLs.
6. Configure the cache type, the path to the cache directory, the cache size, and further cache type-specific settings in the cache_dir parameter:
```
cache_dir ufs /var/spool/squid 10000 16 256
```
```
cache_dir ufs /var/spool/squid 10000 16 256
```
  Copy to Clipboard Toggle word wrap
  With these settings:
  - Squid uses the ufs cache type.
  - Squid stores its cache in the /var/spool/squid/ directory.
  - The cache grows up to 10000 MB.
  - Squid creates 16 level-1 sub-directories in the /var/spool/squid/ directory.
  - Squid creates 256 sub-directories in each level-1 directory.
  If you do not set a cache_dir directive, Squid stores the cache in memory.
If you set a different cache directory than /var/spool/squid/ in the cache_dir parameter:
1. Create the cache directory:
```
mkdir -p path_to_cache_directory
```
```
# mkdir -p path_to_cache_directory
```
  Copy to Clipboard Toggle word wrap
2. Configure the permissions for the cache directory:
```
chown squid:squid path_to_cache_directory
```
```
# chown squid:squid path_to_cache_directory
```
  Copy to Clipboard Toggle word wrap
3. If you run SELinux in enforcing mode, set the squid_cache_t context for the cache directory:
```
semanage fcontext -a -t squid_cache_t "path_to_cache_directory(/.*)?"
restorecon -Rv path_to_cache_directory
```
```
# semanage fcontext -a -t squid_cache_t "path_to_cache_directory(/.*)?"
# restorecon -Rv path_to_cache_directory
```
  Copy to Clipboard Toggle word wrap
  If the semanage utility is not available on your system, install the policycoreutils-python-utils package.

Open the 3128 port in the firewall:

firewall-cmd --permanent --add-port=3128/tcp
firewall-cmd --reload

# firewall-cmd --permanent --add-port=3128/tcp
# firewall-cmd --reload

Copy to Clipboard

Toggle word wrap

Start the squid service:
```
systemctl start squid
```
```
# systemctl start squid
```
Copy to Clipboard Toggle word wrap
Enable the squid service to start automatically when the system boots:
```
systemctl enable squid
```
```
# systemctl enable squid
```
Copy to Clipboard Toggle word wrap

Verification Steps

To verify that the proxy works correctly, download a web page using the curl utility:

curl -O -L "https://www.redhat.com/index.html" --proxy-negotiate -u : -x "proxy.ad.example.com:3128"

# curl -O -L "https://www.redhat.com/index.html" --proxy-negotiate -u : -x "proxy.ad.example.com:3128"

Copy to Clipboard

Toggle word wrap

If curl does not display any error and the index.html file exists in the current directory, the proxy works.

Troubleshooting Steps

To manually test Kerberos authentication:

Obtain a Kerberos ticket for the AD account:
```
kinit user@AD.EXAMPLE.COM
```
```
# kinit user@AD.EXAMPLE.COM
```
Copy to Clipboard Toggle word wrap
Optionally, display the ticket:
```
klist
```
```
# klist
```
Copy to Clipboard Toggle word wrap
Use the negotiate_kerberos_auth_test utility to test the authentication:
```
/usr/lib64/squid/negotiate_kerberos_auth_test proxy.ad.example.com
```
```
# /usr/lib64/squid/negotiate_kerberos_auth_test proxy.ad.example.com
```
Copy to Clipboard Toggle word wrap
If the helper utility returns a token, the authentication succeeded.
```
Token: YIIFtAYGKwYBBQUCoIIFqDC...
```
```
Token: YIIFtAYGKwYBBQUCoIIFqDC...
```
Copy to Clipboard Toggle word wrap

Voltar ao topo

Este conteúdo não está disponível no idioma selecionado.

16.3. Setting up Squid as a Caching Proxy With Kerberos Authentication

Prerequisites

Procedure

Verification Steps

Troubleshooting Steps

Aprender

Experimente, compre e venda

Comunidades

Sobre a documentação da Red Hat

Tornando o open source mais inclusivo

Sobre a Red Hat

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links