[Gutl-l] Re: Autentificacion Kerberos y Squid

Arian la configuracion de mi squid es la siguiente http_port 3128 icp_port 0 #hierarchy_stoplist cgi-bin ? acl QUERY urlpath_regex cgi-bin \? #no_cache deny QUERY cache deny QUERY cache_mem 640 MB maximum_object_size 4096 KB minimum_object_size 0 KB maximum_object_size_in_memory 2048 KB cache_dir ufs /var/spool/squid 2048 16 256 access_log /var/log/squid/access.log common cache_log /var/log/squid/cache.log cache_store_log none log_mime_hdrs on pid_filename /var/run/squid.pid dns_nameservers 192.168.17.3 diskd_program none #auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp #auth_param ntlm children 50 #auth_param ntlm keep_alive off #external_acl_type ad_group %LOGIN /usr/lib64/squid/ext_wbinfo_group_acl auth_param negotiate program /usr/lib64/squid/negotiate_kerberos_auth -r -d -s HTTP/cmgproxy.cmg.escambray.com.cu(a)CMG.ESCAMBRAY.COM.CU -k /etc/HTTP.keytab auth_param negotiate children 20 startup=0 idle=1 auth_param negotiate keep_alive off external_acl_type acl_nav_nac ttl=300 negative_ttl=60 %LOGIN /usr/lib64/squid/ext_kerberos_ldap_group_acl -a -g Intranet -D CMG.ESCAMBRAY.COM.CU external_acl_type acl_nav_inter ttl=300 negative_ttl=60 %LOGIN /usr/lib64/squid/ext_kerberos_ldap_group_acl -a -g Intranet -D CMG.ESCAMBRAY.COM.CU acl nav_nac external acl_nav_nac acl nav_inter external acl_nav_inter #acl DptoProceso external ad_group Proceso #acl DptoComercial external ad_group Comercial #acl DptoEconomia external ad_group Economia #acl DptoDireccion external ad_group Direccion #acl UserFTP external ad_group FTP #acl auth_sitios dstdomain .escambray.com.cu #acl auth_sitios_ip src 10.1.2.2 10.1.2.5 #auth_param ntlm max_challenge_reuses 0 #auth_param ntlm max_challenge_lifetime 60 seconds #authenticate_ip_ttl 20 seconds request_header_max_size 5 KB refresh_pattern ^ftp:           1440    20%     10080 refresh_pattern ^gopher:        1440    0%      1440 refresh_pattern -i (/cgi-bin/|\?)       0      0%       0 refresh_pattern .               0       20%     4320 #Recommended minimum configuration: #acl all src ALL acl manager proto cache_object #acl localhost src 127.0.0.1 #acl to_localhost dst 127.0.0.0/8 acl SSL_ports port 443 563 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 563 # https, snews acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl auth_ports port 21 1025-65535 acl CONNECT method CONNECT # ------ Las mias --------- #acl mired src 192.168.17.0/24 #cl adminred proxy_auth victormanuel acl kerb-auth proxy_auth REQUIRED #Negando acceso por exceso en cuota #http_access deny  autenticacion blocked_user # NUESTRAS REGLAS DE FILTRADO #http_access allow localhost cache_peer proxy.escambray.com.cu parent 3128 0 no-query login=infcmg:*infocmg-98 acl local_escambray dstdomain .escambray.com.cu #acl local_escambray_ip src 10.1.2.0/24 192.168.17.0/24 always_direct allow local_escambray #always_direct allow local_escambray_ip never_direct allow all #http_access deny MiRed !autenticacion !internet #http_access allow CONNECT  auth_sitios auth_ports http_access allow kerb-auth http_access allow nav_nac http_access allow nav_inter # password DptoProceso #http_access allow localnet password DptoComercial #http_access allow localnet password DptoEconomia #http_access allow localnet password DptoDireccion #http_access allow localnet password UserFTP http_access allow manager #localhost http_access deny manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access deny all #Reglas de Ancho de Banda delay_pools 2 delay_class 1 2 delay_class 2 2 #delay_class 3 2 #delay_class 4 2 #delay_class 5 2 #delay_class 6 2 #delay_class 7 2 delay_access 1 allow nav_nac delay_access 2 allow nav_inter #delay_access 3 allow DptoEconomia #delay_access 4 allow DptoDireccion #delay_access 5 allow Dir_Proc #delay_access 6 allow ServGen #delay_access 7 allow Informaticos #Pool Generico Diurno delay_parameters 1 900000/5242880 524288/4194304 delay_parameters 2 900000/5242880 524288/4194304 #delay_parameters 3 900000/5242880 524288/4194304 #delay_parameters 4 900000/5242880 524288/4194304 #delay_parameters 5 900000/5242880 524288/4194304 #delay_parameters 6 900000/5242880 524288/4194304 #delay_parameters 7 900000/5242880 524288/4194304 #Fin de Reglas de Control de Ancho de Banda http_reply_access allow all icp_access allow all visible_hostname proxy_camaguey error_directory /usr/share/squid/errors/es snmp_port 0 snmp_access deny all El 8/8/2020 a las 03:04:24 a.m., Arian Molina Aguilera escribió: