Configurer Squid pour l'authentification avec Kerberos et Windows 2008/2003/7/XP

[Clippy]

Ceci est something I setup recently et was assez a big pain. My environment was getting squid to authenticate a Windows 7 client against a Windows 2008 Server invisibly. NTLM is pas really an option, as using it requires a registry change on chaque client.

MS have been recommending Kerberos depuis Windows 2000, so c'est finally time to get avec le program.

Many, beaucoup de thanks to Markus Moeller of le Squid mailing lists for helping to get this working.

[Clippy]

Ceci est setup avec Squid 3.0, has aussi been tested avec Squid 3.1 et should work avec Squid 2.7. Your Windows user must be a member of le SQUID_USERS group in Active Directory (for this case anyway).

On le Windows side, Windows XP et Windows 2007 have been tested against Windows 2008, et Windows XP against Windows 2003.

Note that almost chaque step requires le one avant it to proceed.

If you have a problem, DNS is **always** le premier place to look. Both Windows machines should be able to ping le Linux server by name (and vice versa), et you may need to run `ipconfig /flushdns` at times. A reboot may help too, si you want to be really sure il y a no cruft hanging around.

## Domain info

- Windows domain: `dom.local`

- Domain server: `server.dom.local`, `172.17.3.11`

- CentOS squid server: `centos.dom.local`, `172.17.3.10`

## Domain server setup

- Create `dom.local` reverse zone in le DNS config.

- Create static ('A') record for `centos.dom.local` pointing to `172.17.3.10`, select **Yes** quand asked si you want to setup le reverse PTR as well.

## Windows 2008

For Windows 2008 server you need to install [Hotfix 951191](http://support.microsoft.com/kb/951191).

## Linux Setup

## Minor packages

Install packages

```
$ yum install -y cyrus-sasl-gssapi cvs autoconf automake openldap openldap-devel krb5-workstation krb5-devel gcc-c++

```

Install `msktutil`. Vous devez to patch it avant you build it.

```
$ wget http://download.systemimager.org/~finley/msktutil/msktutil_0.3.16.orig.tar.gz
$ wget http://download.systemimager.org/~finley/msktutil/msktutil_0.3.16-7.diff.gz
$ gunzip msktutil_0.3.16-7.diff.gz
$ tar zxf msktutil_0.3.16.orig.tar.gz
$ cd msktutil-0.3.16
$ patch &2
exit 6
fi
. /etc/sysconfig/squid

# don't raise an error if the config file is incomplete.
# set defaults instead:
SQUID_OPTS=${SQUID_OPTS:-"-D"}
SQUID_PIDFILE_TIMEOUT=${SQUID_PIDFILE_TIMEOUT:-20}
SQUID_SHUTDOWN_TIMEOUT=${SQUID_SHUTDOWN_TIMEOUT:-100}

if [ -z "$SQUID" ]; then
echo "Insufficient privilege" 1>&2
exit 4
fi

for adir in $CACHE_SWAP; do
if [ ! -d $adir/00 ]; then
echo -n "init_cache_dir $adir... "
$SQUID -z -F -D >> /var/log/squid-3.0/squid.out 2>&1
fi
done
echo -n $"Starting $prog: "
$SQUID $SQUID_OPTS >> /var/log/squid-3.0/squid.out 2>&1
RETVAL=$?
if [ $RETVAL -eq 0 ]; then
timeout=0;
while : ; do
[ ! -f /var/run/squid-3.0.pid ] || break
if [ $timeout -ge $SQUID_PIDFILE_TIMEOUT ]; then
RETVAL=1
break
fi
sleep 1 && echo -n "."
timeout=$((timeout+1))
done
fi
[ $RETVAL -eq 0 ] && touch /var/lock/subsys/squid-3.0
[ $RETVAL -eq 0 ] && echo_success
[ $RETVAL -ne 0 ] && echo_failure
echo
return $RETVAL
}

stop() {
. /etc/sysconfig/squid

# don't raise an error if the config file is incomplete.
# set defaults instead:
SQUID_SHUTDOWN_TIMEOUT=${SQUID_SHUTDOWN_TIMEOUT:-100}

echo -n $"Stopping $prog: "
$SQUID -k check >> /var/log/squid-3.0/squid.out 2>&1
RETVAL=$?
if [ $RETVAL -eq 0 ] ; then
$SQUID -k shutdown &
rm -f /var/lock/subsys/squid-3.0
timeout=0
while : ; do
[ -f /var/run/squid-3.0.pid ] || break
if [ $timeout -ge $SQUID_SHUTDOWN_TIMEOUT ]; then
echo
return 1
fi
sleep 2 && echo -n "."
timeout=$((timeout+2))
done
echo_success
echo
else
echo_failure
echo
fi
return $RETVAL
}

reload() {
. /etc/sysconfig/squid
# don't raise an error if the config file is incomplete.
# set defaults instead:
SQUID_OPTS=${SQUID_OPTS:-"-D"}

$SQUID $SQUID_OPTS -k reconfigure
}

restart() {
stop
start
}

condrestart() {
[ -e /var/lock/subsys/squid-3.0 ] && restart || :
}

rhstatus() {
status $SQUID && $SQUID -k check
}

probe() {
return 0
}

case "$1" in
start)
start
;;

stop)
stop
;;

reload)
reload
;;

restart)
restart
;;

condrestart)
condrestart
;;

status)
rhstatus
;;

probe)
exit 0
;;

*)
echo $"Usage: $0 {start|stop|status|reload|restart|condrestart}"
exit 2
esac

exit $?

```

These are le important lines:

```
KRB5_KTNAME=/etc/HTTP.keytab
export KRB5_KTNAME

```

## Client Machine

Set votre proxy to server `centos.dom.local` using port `3128`. C'est important that you use le fully qualified domain name et NOT le IP address.