Debian Squeeze, Squid, Kerberos/LDAP Authentication, Active Directory Integration And Cyfin Reporter

Introduction

This document covers setup of a Squid Proxy which will seamlessly integrate with Active Directory for authentication using Kerberos with LDAP as a backup for users not authenticated via Kerberos. Authorisation is managed by Groups in Active Directory. This is especially useful for Windows 7 clients which no longer support NTLMv2 without changing the local computer policy. It is capable of using white lists and black lists for site access and restrictions.

For this guide the following examples are utilised - you should update any sections with the clients domain, hostnames and IP's where necessary.

Domain = example.local
Subnet = 192.168.0.0/24
Proxy Server: IP = 192.168.0.26, HOSTNAME = squidproxy.example.local
Windows Server 1: IP = 192.168.0.1, HOSTNAME = domaincontroller1.example.local
Windows Server 2: IP = 192.168.0.10, HOSTNAME = server2.example.local

A base install of Debian Squeeze is assumed as well as basic Debian administration skills. vi is assumed as the text editor.

Prerequisites

Client Internet Explorer Browsers need to have "Enable Integrated Windows Authentication" ticked in Internet Options :: Advanced settings as well as Proxy Auto detection enabled - google these if not sure. All modern web browsers will support proxy auto detection. Firefox and Chrome also support Windows Authentication.

DNS Configuration

Install dnsutils:

apt-get install dnsutils

On the Windows DNS server add a new A record entry for the proxy server's hostname and ensure a corresponding PTR (reverse DNS) entry is also created and works. Check that the proxy is using the Windows DNS Server for name resolution and update /etc/resolv.conf accordingly.

vi /etc/resolv.conf

search example.local
nameserver 192.168.0.1
nameserver 192.168.0.10

Ping an internal and external hostname to ensure DNS is operating.

ping domaincontroller1.example.local -c 4 && ping google.com -c 4

Check you can reverse look up the Windows Server and the local proxy ip from the Windows DNS.

dig -x 192.168.0.1
dig -x 192.168.0.26

Warning: If either DNS lookup fails do not proceed until fixed or proxy authentication will fail.

NTP Configuration

Install the ntp package:

apt-get install ntp

Because Kerberos needs to have the time synchronized with Windows Domain Controllers for authentication we configure the proxy to obtain time from the them.

vi /etc/ntp.conf

Locate the following section and update the ntp servers as required. If you have more than one Domain Controller or NTP Server you may add multiple lines.

# You do need to talk to an NTP server or two (or three).
#server ntp.your-provider.example
server domaincontroller1.example.local
server server2.example.local

Then restart and test NTP.

invoke-rc.d ntp restart
ntpq -p

You should see output that refers to the Domain Controllers and other NTP Servers which are processed in the order that they appear in the conf file.

Configure Kerberos

Install Kerberos packages:

apt-get install krb5-user libkrb53

Just accept the defaults presented to any debconf dialog's presented as we are overwriting them.

Set up Kerberos.

cp /etc/krb5.conf /etc/krb5.conf.default
cat /dev/null > /etc/krb5.conf
vi /etc/krb5.conf

Edit the file replacing the variables (highlighted) with the client's domain and server.

Warning: Depending on your Windows Domain Controllers OS Version un-comment the relevant Windows 200X section and comment out the opposing section.

If you only have 1 Domain Controller remove the additional "kdc" entry from the "[realms]" section.

[libdefaults]
        default_realm = EXAMPLE.LOCAL
        dns_lookup_kdc = no
        dns_lookup_realm = no
        ticket_lifetime = 24h
        default_keytab_name = /etc/squid3/PROXY.keytab
; for Windows 2003
        default_tgs_enctypes = rc4-hmac des-cbc-crc des-cbc-md5
        default_tkt_enctypes = rc4-hmac des-cbc-crc des-cbc-md5
        permitted_enctypes = rc4-hmac des-cbc-crc des-cbc-md5
; for Windows 2008 with AES
;        default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
;        default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
;        permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
[realms]
        EXAMPLE.LOCAL = {
                kdc = domaincontroller1.example.local
                kdc = server2.example.local
                admin_server = domaincontroller1.example.local
                default_domain = example.local
        }
[domain_realm]
        .example.local = EXAMPLE.LOCAL
        example.local = EXAMPLE.LOCAL

Install Squid 3

apt-get install squid3 ldap-utils

Note: Squid configuration takes places after msktutil is configured.

Install and run msktutil

Obtain the msktutil package and install it.

cd /var/cache/apt/archives/ wget http://fuhm.net/software/msktutil/releases/msktutil_0.4-2_i386.deb
apt-get install libsasl2-modules-gssapi-mit libsasl2-modules
dpkg -i msktutil_0.4-2_i386.deb
cd

Initiate a kerberos session to the server so msktutil can use it to create our Proxy object in Active directory that will be used for access.

kinit administrator

Enter the domain administrator password.

It should then return without errors. You can see if you successfully obtained a ticket with:

klist

Now we configure the proxy in AD with service principles by running msktutil (update the highlighted values with your network).

Warning: You should not move the object from the OU that you use msktutil to create it in.

msktutil -c -b "CN=COMPUTERS" -s HTTP -k /etc/squid3/PROXY.keytab --computer-name SQUIDPROXY \
--upn HTTP/squidproxy.example.local --server domaincontroller1.example.local --verbose

If you are using a Server 2008 domain then add "--enctypes 28" at the end of the command.

msktutil -c -b "CN=COMPUTERS" -s HTTP -k /etc/squid3/PROXY.keytab --computer-name SQUIDPROXY \
--upn HTTP/squidproxy.example.local --server domaincontroller1.example.local --verbose --enctypes 28

Set the permissions on the keytab so squid can read it.

chgrp proxy /etc/squid3/PROXY.keytab
chmod g+r /etc/squid3/PROXY.keytab

On the Windows Server reset the Computer Account in AD by right clicking on the SQUIDPROXY Computer and select "Reset Account", then run msktutil as follows to ensure the keytab is updated as expected and that the keytab is being sourced by msktutil from /etc/krb5.conf correctly.

Reboot the proxy first to clear the kerberos tickets generated by kinit command then run the following:

msktutil --auto-update --verbose

If the keytab is not found try adding "-k /etc/squid3/PROXY.keytab" to the command to see if it works and then troubleshoot until resolved or users will not be able to authenticate with Squid.

Add the following to cron so it can automatically updates the computer account in active directory when it expires (typically around 30 days). I pipe it through logger so I can see any errors in syslog if necessary. As stated the msktutil uses the default /etc/krb5.conf file for its paramaters so be aware of that if you decide to make any changes in it.

The SHELL and PATH variables are there to ensure cron runs properly change this if you know what your doing.

crontab -e

SHELL=/bin/bash
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
# m h  dom mon dow   command
00 4  *   *   *     msktutil --auto-update --verbose | logger -t msktutil