Atualmente, tenho a configuração do squid 3.2 com autenticação NTLM e pull do Grupo LDAP. Eu também tenho MySar correndo para puxar os relatórios.
Parece que a maneira como o log funciona é passando duas vezes, uma para autenticar e outra para aceitar. No entanto, com as coisas que são negadas, nenhum nome de usuário é registrado, o que torna o squid difícil de solucionar problemas de alguém no escritório, considerando que temos servidores de terminal que têm vários usuários em um endereço IP.
Então, eu acho que a minha pergunta é: existem soluções para isso? De qualquer forma, para mudar a maneira como ele registra, então sabemos se algo foi negado a qual usuário foi?
Meu squid.conf
#=======================
# NTLM AUTHENTICATION >
#=======================
auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 10
auth_param ntlm keep_alive on
#auth_param ntlm max_challenge_lifetime_reuses 5
#===============================
# EXTERNAL ACL TO PULL GROUPS >
#===============================
external_acl_type nt_group %LOGIN /usr/lib64/squid/ext_wbinfo_group_acl
#=======================
# ACL >
#=======================
#ACL for Groups
acl CustomerServiceGroup external nt_group CustomerService
acl InternetToolsGroup external nt_group InternetTools
acl AllCustomerInternetSitesGroup external nt_group AllCustomerInternetSites
acl UnrestrictedGroup external nt_group UnrestrictedInternet
acl WarehouseGroup external nt_group Warehouse
# Security Provisions
#acl manager proto cache_object
#acl localhost src 127.0.0.1/32 ::1
#acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
#The Network
acl Thenetwork src 10.10.0.0/16
acl ntlm proxy_auth REQUIRED
# ANTI-PROXY GROUP
acl ProxyBL dstdomain "/etc/squid/global/BL-proxy.txt"
# WHITELIST GROUPS
acl CallCenterWL dstdomain "/etc/squid/callcenter/WL-callcenter.txt"
#acl WarehouseWL dstdomain "/etc/squid/warehouse/WL-warehouse.txt"
# BLACKLIST GROUPS
#acl CallCenterBL dstdomain "/etc/squid/callcenter/BL-callcenter.txt"
# Keywords Whitelist
#acl CallCenterKW url_regex -i "/etc/squid/callcenter/KW-callcenter.txt"
# Keywords Blacklist
acl GlobalKW url_regex -i "/etc/squid/global/KW-global.txt"
# Ports
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
#===================
# ACL RULES >
#===================
# Global Blacklist
#http_access deny Blacklist all
# Global Deny Blacklist and Keyword filters
http_access deny GlobalKW all
http_access deny ProxyBL all
# Unrestricted Group allow all
http_access allow all UnrestrictedGroup ntlm
# Enabled Whitelist & Keywords
#http_access allow CallCenterKW InternetToolsGroup ntlm
# Activates Whitelist
http_access allow CallCenterWL CustomerServiceGroup ntlm
http_access allow CallCenterWL InternetToolsGroup ntlm
http_access allow CallCenterWL AllCustomerInternetSitesGroup ntlm
# WarehouseGroup Restriction
http_access deny all WarehouseGroup
# Only allow cachemgr access from localhost
#http_access allow manager localhost
#http_access deny manager
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
# TheNetwork allow with auth * Allows everything, only enable when needed *
#http_access allow Thenetwork ntlm
# Deny CONNECT to other than secure SSL ports
#http_access deny CONNECT !SSL_ports
#=====================
# ACL ACCESS RULES >
#=====================
# Allow any keywords
#http_access allow CallCenterKW ntlm
# Allow only the whitelist
#http_access allow CallCenterWL ntlm
# Deny anything not on the whitelist
#http_access deny !CallCenterWL
# Deny everything else
http_access deny all
#================
# CONFIG MISC >
#================
#Cache administrator Email
cache_mgr [email protected]
# Squid normally listens to port 3128
http_port 8080
# We recommend you to use at least the following line.
hierarchy_stoplist cgi-bin ?
# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /var/spool/squid 100 16 256
#useragent_log /var/log/squid/user.log
#access_log /var/log/squid/naccess.log squid
# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
#debug_options ALL,9
Meu access.log
1362426657.752 0 10.10.7.71 TCP_DENIED/403 3956
GET http://www.porn.com/ - HIER_NONE/- text/html
1362426722.483 154 10.10.7.71 TCP_MISS/200 1841
GET http://media.washingtonpost.com/wp-srv/css/global.css
alucas HIER_DIRECT/24.143.206.89 text/css
Observe como o site recusado não retornou nenhum usuário, mas um que foi aceito registrou um nome de usuário.
Tenho certeza de que isso é algo que estou perdendo ou fazendo algo errado. Qualquer ajuda seria muito apreciada.
Obrigado Aaron