SUSE LINUX Enterprise & openSUSE Community
มีนาคม 26, 2019, 10:04:25 PM *
ยินดีต้อนรับคุณ, บุคคลทั่วไป กรุณา เข้าสู่ระบบ หรือ ลงทะเบียน
ส่งอีเมล์ยืนยันการใช้งาน?

เข้าสู่ระบบด้วยชื่อผู้ใช้ รหัสผ่าน และระยะเวลาในเซสชั่น
ข่าว:
 
   หน้าแรก   ช่วยเหลือ ค้นหา เข้าสู่ระบบ สมัครสมาชิก  

[Why we need your support] SUSE and openSUSE are trademarks of Attachmate Group, Inc. - WE ARE NOT IN ANY WAY ASSOCIATED WITH SUSE AND ATTACHMATE GROUP. SUSEThailand.com is a SUSE Linux user and community found in Thailand but not limited to other country suse linux user to join in. Currently active contents (How to's, Scripts, Tips, Tricks, Tutorials, Linux Command Line, and Troubleshooting) this suse linux how to's and expert support are SUSE Linux.
หน้า: [1]   ลงล่าง
  พิมพ์  
ผู้เขียน
หัวข้อ: How to configure Squid authentication with RADIUS use LDAP and Single sign-on  (อ่าน 2454 ครั้ง)
0 สมาชิก และ 1 บุคคลทั่วไป กำลังดูหัวข้อนี้
Sontaya
Administrator
Expert : ผู้เชี่ยวชาญ
*****

Karma: +1/-0
ออฟไลน์ ออฟไลน์

กระทู้: 1931


Administrator


เว็บไซต์
« เมื่อ: เมษายน 16, 2012, 09:05:42 PM »


How to configure Squid authentication with RADIUS use LDAP and Single sign-on

ตัวอย่าง การคอนฟิก squid3 + Single sign-on

โค๊ด:
#
# Recommended minimum configuration:
#

# TAG: auth_param
#added by sontaya
#################RADIUS authentication################################
auth_param basic program /usr/sbin/squid_radius_auth -h 192.168.1.222 -w PASSword
auth_param basic children 5
auth_param basic realm Squid RADIUS authentication
auth_param basic credentialsttl 5 minute
auth_param basic casesensitive on
################################################################

#################Sigle sign-on#######################################
authenticate_ttl 1 hours
authenticate_ip_ttl 2 hours
################################################################

acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

#added by sontaya
#######################################################################
acl sso_ip max_user_ip -s 1
#######################################################################

###########################ACL for RADIUS AUTH###########################
acl radiusauth proxy_auth REQUIRED
#######################################################################

#
# Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager

# Deny requests to certain unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed

#added by sontaya
#######################ngle sign-on (SSO)###################################
http_access deny sso_ip
#######################################################################

###########################Allow for RADIUS AUTH#############################
http_access allow radiusauth
#######################################################################

http_access allow localnet

# Allow localhost always proxy functionality
http_access allow localhost

# And finally deny all other access to this proxy
http_access deny all

# Squid normally listens to port 3128
http_port 3128

# We recommend you to use at least the following line.
hierarchy_stoplist cgi-bin ?

# Uncomment and adjust the following to add a disk cache directory.
#cache_dir aufs /var/cache/squid 100 16 256

# Leave coredumps in the first cache dir
coredump_dir /var/cache/squid

# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320


NOTE:

RADIUS Server / Proxy server: 192.168.1.222 | prot 3128

=======================================================================
#Default:
# authenticate_ttl 1 hour

#  TAG: authenticate_ip_ttl
#       If you use proxy authentication and the 'max_user_ip' ACL, this
#       directive controls how long Squid remembers the IP addresses
#       associated with each user.  Use a small value (e.g., 60 seconds) if
#       your users might change addresses quickly, as is the case with
#       dialups. You might be safe using a larger value (e.g., 2 hours) in a
#       corporate LAN environment with relatively static address assignments.
#
#Default:
# authenticate_ip_ttl 0 seconds


#       acl aclname max_user_ip [-s] number
#         # This will be matched when the user attempts to log in from more
#         # than <number> different ip addresses. The authenticate_ip_ttl
#         # parameter controls the timeout on the ip entries.
#         # If -s is specified the limit is strict, denying browsing
#         # from any further IP addresses until the ttl has expired. Without
#         # -s Squid will just annoy the user by "randomly" denying requests.
#         # (the counter is reset each time the limit is reached and a
#         # request is denied)
#         # NOTE: in acceleration mode or where there is mesh of child proxies,
#         # clients may appear to come from multiple addresses if they are
#         # going through proxy farms, so a limit of 1 may cause user problems.


ติดตั้ง FreeRADIUS บน SLES11 SP2 และ Radius authentication using LDAP
« แก้ไขครั้งสุดท้าย: เมษายน 16, 2012, 09:07:39 PM โดย Sontaya » แจ้งลบกระทู้นี้หรือติดต่อผู้ดูแล   บันทึกการเข้า

ageLOC Technology
หน้า: [1]   ขึ้นบน
  พิมพ์  
 
กระโดดไป:  

(@)2007 SUSE Linux user community found in Thailand. This site is not an official openSUSE and SUSE website, and is not in any way affiliated with or endorsed by SUSE Linux GmbH or Novell. openSUSE and SUSE are trademarks of Novell, Inc. in the United States and other countries.
Powered by MySQL Powered by PHP Powered by SMF 1.1.21 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!
หน้านี้ถูกสร้างขึ้นภายในเวลา 0.212 วินาที กับ 20 คำสั่ง (Pretty URLs adds 0.072s, 2q)