Use squid on ubuntu server 11.10 joined to a domain in order to force NTLM authentication (review ubuntu 11.10)

This installation was made on an ubuntu server 11.10 and is partially based on my previous tutorial.


Install squid:
sudo apt-get install squid

You can already test the installation by configuring your web browser to use your server on port 3128 as the proxy server. You should receive an error web page generated by squid or the requested web page.

In order to request your domain controler, you have to install the following packages:
sudo apt-get install samba krb5-user libpam-krb5 winbind

During the installation, you should be prompted for a default kerberos realm.
Enter your domain name in capital letters : YOURDOMAIN.COM

You can test that all is running fine by typing the following command:
sudo kinit Administrator
You will be prompted for the administrator password.
If all is correctly configured, the command should return no result.

You can also check the credential cache with:
sudo klist

Edit /etc/samba/smb.conf and add or modify the following items:
[global]
workgroup = YOURDOMAIN
realm = YOURDOMAIN.COM
security = ads
winbind use default domain = yes
# only add the next line if your server's name is longer
# than 18 characters and truncate the name to 18 chars
netbios name = mysquidserver
[...]
Please note that workgroup option is not ended with the Top Level Domain (.COM or whatever)

Restart samba and winbind services:
sudo service smbd restart
sudo service winbind restart

Try to join the domain with the following command:
sudo net ads join -U Administrator
sudo net join -U Administrator

You should get a similar result:
Using short domain name -- YOURDOMAIN
Joined 'mysquidserver' to realm 'yourdomain.com'
If you get a warning message about the DNS, you can simply ignore it ;)

You can now test the configuration with the following command that gives you the list of users:
wbinfo -u

In case of any problem, restart samba and winbind before googleing.


Now that your server is joined to your AD domain, we can configure squid.

First, test the ntlm authentication:
sudo /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
Directly after, enter a valid domain user and the corresponding password separated by a space:
username password
The answer should be:
OK
Hit CTRL+D to exit.

Edit the file /etc/squid/squid.conf.
Add or edit the following:
auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 5
auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
auth_param basic children 5
auth_param basic realm YOURDOMAIN.COM
auth_param basic credentialsttl 2 hours
acl ntlm proxy_auth REQUIRED
http_access allow ntlm
append_domain .yourdomain.com
cache_effective_group winbindd_priv


Restart squid : sudo service squid restart

Enjoy !

#1 #2 #3 #4 #5 #5