我通过 AD 和 Kerberos V5 制作透明代理。CentOS 已加入 Windows 域，域如下：
[root@vs-otr-squid02 ~]# realm list
domain.ru
type: kerberos
realm-name: DOMAIN.RU
domain-name: domain.ru
configured: kerberos-member
server-software: active-directory
client-software: sssd
required-package: oddjob
required-package: oddjob-mkhomedir
required-package: sssd
required-package: adcli
required-package: samba-common-tools
login-formats: %[email protected]
login-policy: allow-realm-logins
鱿鱼信息：
Squid Cache: Version 3.5.20
Service Name: squid
configure options: '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--disable-strict-error-checking' '--exec_prefix=/usr' '--libexecdir=/usr/lib64/squid' '--localstatedir=/var' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--with-logdir=$(localstatedir)/log/squid' '--with-pidfile=$(localstatedir)/run/squid.pid' '--disable-dependency-tracking' '--enable-eui' '--enable-follow-x-forwarded-for' '--enable-auth' '--enable-auth-basic=DB,LDAP,MSNT-multi-domain,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB,SMB_LM,getpwnam' '--enable-auth-ntlm=smb_lm,fake' '--enable-auth-digest=file,LDAP,eDirectory' '--enable-auth-negotiate=kerberos' '--enable-external-acl-helpers=file_userip,LDAP_group,time_quota,session,unix_group,wbinfo_group,kerberos_ldap_group' '--enable-cache-digests' '--enable-cachemgr-hostname=localhost' '--enable-delay-pools' '--enable-epoll' '--enable-ident-lookups' '--enable-linux-netfilter' '--enable-removal-policies=heap,lru' '--enable-snmp' '--enable-ssl-crtd' '--enable-storeio=aufs,diskd,rock,ufs' '--enable-wccpv2' '--enable-esi' '--enable-ecap' '--with-aio' '--with-default-user=squid' '--with-dl' '--with-openssl' '--with-pthreads' '--disable-arch-native' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fpie' 'LDFLAGS=-Wl,-z,relro -pie -Wl,-z,relro -Wl,-z,now' 'CXXFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fpie' 'PKG_CONFIG_PATH=:/usr/lib64/pkgconfig:/usr/share/pkgconfig'
Keytab文件内容：
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
1 3 HTTP/[email protected]
AD 用户 - squid2018，为其创建此 keytab 文件。请确保：
[root@vs-otr-squid02 ~]# kinit HTTP/[email protected]
Password for HTTP/[email protected]:
squid2018 的密码已接受，收到票：
[root@vs-otr-squid02 ~]# klist
Ticket cache: KEYRING:persistent:0:0
Default principal: HTTP/[email protected]
Valid starting Expires Service principal
06/27/2018 12:05:09 06/27/2018 22:05:09 krbtgt/[email protected]
renew until 07/04/2018 12:04:52
删除它。
设置 /etc/squid/squid.conf
# Active Directory
auth_param negotiate program /usr/lib64/squid/negotiate_kerberos_auth -s HTTP/[email protected]
auth_param negotiate children 600
auth_param negotiate keep_alive off
external_acl_type ad_group_member_check ttl=120 %LOGIN /usr/lib64/squid/ext_ldap_group_acl -d -v3 -P -R -K -b "DC=domain,DC=ru" -D "[email protected]" -w VerySecretPassword -f "(&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru))" -h hs-dc-1.domain.ru
# Authenticate
acl auth proxy_auth REQUIRED
acl ad_users external ad_group_member_check full_access
# Standart ports
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
# Standart permisson
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localhost
http_access allow auth
# Permission for AD users
http_access allow ad_users
# Deny everything else
http_access deny all
# Proxy ports
http_port 172.31.4.64:3128
http_port 172.31.4.64:3127 transparent
# Cache settings
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
# DNS
dns_nameservers 172.31.2.113
dns_v4_first on
Squid工作状态：
[root@vs-otr-squid02 ~]# systemctl status squid
● squid.service - Squid caching proxy
Loaded: loaded (/usr/lib/systemd/system/squid.service; enabled; vendor preset: disabled)
Active: active (running) since Wed 2018-06-27 11:31:08 MSK; 42min ago
Process: 2753 ExecStop=/usr/sbin/squid -k shutdown -f $SQUID_CONF (code=exited, status=0/SUCCESS)
Process: 2762 ExecStart=/usr/sbin/squid $SQUID_OPTS -f $SQUID_CONF (code=exited, status=0/SUCCESS)
Process: 2756 ExecStartPre=/usr/libexec/squid/cache_swap.sh (code=exited, status=0/SUCCESS)
Main PID: 2765 (squid)
CGroup: /system.slice/squid.service
├─2765 /usr/sbin/squid -f /etc/squid/squid.conf
├─2767 (squid-1) -f /etc/squid/squid.conf
├─2768 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D [email protected] -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru
├─2769 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D [email protected] -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru
├─2770 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D [email protected] -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru
├─2771 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D [email protected] -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru
├─2772 (ext_ldap_group_acl) -d -v3 -P -R -K -b DC=domain,DC=ru -D [email protected] -w VerySecretPassword -f (&(objectclass=person)(sAMAccountName=%v)(memberOf=cn=%g,CN=Domain Users,CN=Users,DC=domain,DC=ru)) -h hs-dc-1.domain.ru
└─2773 (logfile-daemon) /var/log/squid/access.log
Jun 27 11:31:08 vs-otr-squid02 systemd[1]: Starting Squid caching proxy...
Jun 27 11:31:08 vs-otr-squid02 squid[2765]: Squid Parent: will start 1 kids
Jun 27 11:31:08 vs-otr-squid02 squid[2765]: Squid Parent: (squid-1) process 2767 started
Jun 27 11:31:08 vs-otr-squid02 systemd[1]: Started Squid caching proxy.
但是浏览器会显示一个输入名称和密码的窗口，这不应该。好的，我输入了，但它不被接受，并且在/var/log/squid/cache.log中：
2018/06/27 12:19:16 kid1| Accepting NAT intercepted HTTP Socket connections at local=172.31.4.64:3127 remote=[::] FD 24 flags=41
2018/06/27 12:19:29| Current Directory is /
2018/06/27 12:19:29 kid1| Preparing for shutdown after 0 requests
2018/06/27 12:19:29 kid1| Waiting 30 seconds for active connections to finish
2018/06/27 12:19:29 kid1| Closing HTTP port 172.31.4.64:3128
2018/06/27 12:19:29 kid1| Closing HTTP port 172.31.4.64:3127
2018/06/27 12:19:29 kid1| Current Directory is /
2018/06/27 12:19:29 kid1| Starting Squid Cache version 3.5.20 for x86_64-redhat-linux-gnu...
2018/06/27 12:19:29 kid1| Service Name: squid
2018/06/27 12:19:29 kid1| Process ID 2858
2018/06/27 12:19:29 kid1| Process Roles: worker
2018/06/27 12:19:29 kid1| With 16384 file descriptors available
2018/06/27 12:19:29 kid1| Initializing IP Cache...
2018/06/27 12:19:29 kid1| DNS Socket created at [::], FD 8
2018/06/27 12:19:29 kid1| DNS Socket created at 0.0.0.0, FD 10
2018/06/27 12:19:29 kid1| Adding nameserver 172.31.2.113 from squid.conf
2018/06/27 12:19:29 kid1| helperOpenServers: Starting 0/600 'negotiate_kerberos_auth' processes
2018/06/27 12:19:29 kid1| helperStatefulOpenServers: No 'negotiate_kerberos_auth' processes needed.
2018/06/27 12:19:29 kid1| helperOpenServers: Starting 5/5 'ext_ldap_group_acl' processes
2018/06/27 12:19:29 kid1| Logfile: opening log daemon:/var/log/squid/access.log
2018/06/27 12:19:29 kid1| Logfile Daemon: opening log /var/log/squid/access.log
2018/06/27 12:19:29 kid1| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec
2018/06/27 12:19:29 kid1| Store logging disabled
2018/06/27 12:19:29 kid1| Swap maxSize 0 + 262144 KB, estimated 20164 objects
2018/06/27 12:19:29 kid1| Target number of buckets: 1008
2018/06/27 12:19:29 kid1| Using 8192 Store buckets
2018/06/27 12:19:29 kid1| Max Mem size: 262144 KB
2018/06/27 12:19:29 kid1| Max Swap size: 0 KB
2018/06/27 12:19:29 kid1| Using Least Load store dir selection
2018/06/27 12:19:29 kid1| Current Directory is /
2018/06/27 12:19:29 kid1| Finished loading MIME types and icons.
2018/06/27 12:19:29 kid1| HTCP Disabled.
2018/06/27 12:19:29 kid1| Squid plugin modules loaded: 0
2018/06/27 12:19:29 kid1| Adaptation support is off.
2018/06/27 12:19:29 kid1| Accepting HTTP Socket connections at local=172.31.4.64:3128 remote=[::] FD 23 flags=9
2018/06/27 12:19:29 kid1| Accepting NAT intercepted HTTP Socket connections at local=172.31.4.64:3127 remote=[::] FD 24 flags=41
2018/06/27 12:19:30 kid1| storeLateRelease: released 0 objects
2018/06/27 12:19:46 kid1| Starting new negotiateauthenticator helpers...
2018/06/27 12:19:46 kid1| helperOpenServers: Starting 1/600 'negotiate_kerberos_auth' processes
2018/06/27 12:19:46 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:50 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:51 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:51 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:55 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:55 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:57 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:19:59 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:20:00 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:20:03 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
2018/06/27 12:20:06 kid1| ERROR: Negotiate Authentication validating user. Result: {result=BH, notes={message: received type 1 NTLM token; }}
/var/log/squid/access.log
1530088115.039 4 172.31.10.71 TCP_DENIED/407 4164 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530088115.039 4 172.31.10.71 TCP_DENIED/407 4164 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530088115.039 4 172.31.10.71 TCP_DENIED/407 4176 CONNECT yastatic.net:443 - HIER_NONE/- text/html
1530088115.039 4 172.31.10.71 TCP_DENIED/407 4164 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530088115.039 4 172.31.10.71 TCP_DENIED/407 4164 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530088115.039 4 172.31.10.71 TCP_DENIED/407 4176 CONNECT yastatic.net:443 - HIER_NONE/- text/html
1530088115.039 4 172.31.10.71 TCP_DENIED/407 4176 CONNECT yastatic.net:443 - HIER_NONE/- text/html
1530088115.039 4 172.31.10.71 TCP_DENIED/407 4176 CONNECT yastatic.net:443 - HIER_NONE/- text/html
1530088115.039 4 172.31.10.71 TCP_DENIED/407 4176 CONNECT yastatic.net:443 - HIER_NONE/- text/html
1530088115.039 4 172.31.10.71 TCP_DENIED/407 4176 CONNECT yastatic.net:443 - HIER_NONE/- text/html
1530088115.047 0 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530088116.578 1 172.31.10.71 TCP_DENIED/407 4333 CONNECT cdn.syndication.twimg.com:443 - HIER_NONE/- text/html
1530088116.585 7 172.31.10.71 TCP_DENIED/407 4313 CONNECT gekko.spiceworks.com:443 - HIER_NONE/- text/html
1530088116.585 6 172.31.10.71 TCP_DENIED/407 4269 CONNECT 3dnews.ru:443 - HIER_NONE/- text/html
1530088116.585 1 172.31.10.71 TCP_DENIED/407 5648 POST http://top-fwz1.mail.ru/tracker? - HIER_NONE/- text/html
1530088116.596 18 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530088118.941 0 172.31.10.71 TCP_DENIED/407 4236 CONNECT googleads.g.doubleclick.net:443 - HIER_NONE/- text/html
1530088118.946 0 172.31.10.71 TCP_DENIED/407 4341 CONNECT googleads.g.doubleclick.net:443 - HIER_NONE/- text/html
1530088121.934 0 172.31.10.71 TCP_DENIED/407 4228 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html
1530088121.938 0 172.31.10.71 TCP_DENIED/407 4333 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html
1530088125.390 0 172.31.10.71 TCP_DENIED/407 4228 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html
1530088125.393 0 172.31.10.71 TCP_DENIED/407 4333 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html
1530091186.082 0 172.31.10.71 TCP_DENIED/407 4164 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530091186.103 17 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530091190.539 1 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530091191.307 1 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530091191.770 0 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530091195.390 0 172.31.10.71 TCP_DENIED/407 4164 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530091195.395 0 172.31.10.71 TCP_DENIED/407 4228 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html
1530091195.396 1 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530091195.398 0 172.31.10.71 TCP_DENIED/407 4333 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html
1530091197.499 0 172.31.10.71 TCP_DENIED/407 4269 CONNECT yandex.ru:443 - HIER_NONE/- text/html
1530091199.183 0 172.31.10.71 TCP_DENIED/407 4348 GET http://forundex.ru/unix%20linux/favicon.ico - HIER_NONE/- text/html
1530091199.185 0 172.31.10.71 TCP_DENIED/407 4453 GET http://forundex.ru/unix%20linux/favicon.ico - HIER_NONE/- text/html
1530091200.420 0 172.31.10.71 TCP_DENIED/407 4228 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html
1530091200.423 0 172.31.10.71 TCP_DENIED/407 4333 CONNECT sec.api.browser.yandex.ru:443 - HIER_NONE/- text/html
1530091203.169 0 172.31.10.71 TCP_DENIED/407 4228 CONNECT cdn.syndication.twimg.com:443 - HIER_NONE/- text/html
1530091203.172 0 172.31.10.71 TCP_DENIED/407 4333 CONNECT cdn.syndication.twimg.com:443 - HIER_NONE/- text/html
1530091206.171 0 172.31.10.71 TCP_DENIED/407 4208 CONNECT gekko.spiceworks.com:443 - HIER_NONE/- text/html
1530091206.174 0 172.31.10.71 TCP_DENIED/407 4313 CONNECT gekko.spiceworks.com:443 - HIER_NONE/- text/html
我需要帮助。谢谢您的帮助。