LINUX.ORG.RU
ФорумAdmin

Не получается связать два прокси-сервера squid работающих с доменными группами

 


0

1

Добрый день!

Прошу помочь разобраться!

Имеется два удаленных офиса соединеных через VPN тунель. В офисах развернуты сервера Active Directory, основной и подчиненный. Так же в офисах имеются прокси-сервера на базе CentOS 7, squid 3.5 которые настроенны на работу с домменными группами.
Прилетела задача отказаться в филиале от интернета и выпустить пользователей в интернет через головной офис. Между офисами будет VPN повер провайдерского L2. Так вот необходимо все запросы приходящие на прокси-сервер филиала пересылать на прокси-сервер головного офиса который будет выпускать в инет и при этом группы должны работать.
Не могуразобраться как правильно это реализовать.

Конфиг в головном офисе:

auth_param negotiate program /usr/lib64/squid/negotiate_kerberos_auth -d -s HTTP/proxy01.samba.domain.ru
auth_param negotiate children 20 startup=10 idle=5
auth_param negotiate keep_alive off

#acl trustedproxy src 10.190.196.35 #ip прокси в филиале (если раскоментировать, филиал подключаеся но без авторизации и доменных групп)
#http_access allow trustedproxy

external_acl_type squid-all-access-01 ttl=300 negative_ttl=60 children-startup=15 ipv4 %LOGIN %ACL /usr/lib64/squid/ext_kerberos_ldap_group_acl -a -g squid-all-access-01 -D SAMBA.DOMAIN.RU

acl auth proxy_auth REQUIRED
acl SSL_ports port 443
acl Safe_ports port 80
acl Safe_ports port 443
acl Safe_ports port 1025-65535
acl CONNECT method CONNECT

acl squid-all-access-01 external squid-all-access-01

http_access deny CONNECT !SSL_ports
http_access deny !Safe_ports
http_access allow squid-all-access-01
http_access deny all

http_port 3128



Конфиг в филиале:

auth_param negotiate program /usr/lib64/squid/negotiate_kerberos_auth -d -s HTTP/proxy02.samba.domain.ru@SAMBA.DOMAIN.RU
auth_param negotiate children 200 startup=10 idle=5
auth_param negotiate keep_alive off

external_acl_type squid-all-access-02 ttl=300 negative_ttl=60 ipv4 %LOGIN /usr/lib64/squid/ext_kerberos_ldap_group_acl -a -g squid-all-access-02 -K -D SAMBA.DOMAIN.RU

cache_peer proxy01.samba.domain.ru parent 3128 0 no-query no-digest no-netdb-exchange default login=squid:passwd
cache_peer_access proxy01.samba.domain.ru allow all
never_direct allow all

acl auth proxy_auth REQUIRED

acl SSL_ports port 443
acl SSL_ports port 563
acl Safe_ports port 80
acl Safe_ports port 443
acl Safe_ports port 1025-65535
acl CONNECT method CONNECT

acl squid-all-access-02 external squid-all-access-02

http_access deny CONNECT !SSL_ports
http_access deny !Safe_ports
http_access allow squid-all-access-02
http_access deny all

http_port 3128

В данной конфигурации на тестовой машине инет не появляется.

Лог с прокси головного офиса:

2022/11/03 15:19:58.871 kid1| 28,4| Eui48.cc(178) lookup: id=0x5612c008df04 query ARP table
2022/11/03 15:19:58.871 kid1| 28,4| Eui48.cc(222) lookup: id=0x5612c008df04 query ARP on each interface (80 found)
2022/11/03 15:19:58.871 kid1| 28,4| Eui48.cc(228) lookup: id=0x5612c008df04 found interface lo
2022/11/03 15:19:58.871 kid1| 28,4| Eui48.cc(228) lookup: id=0x5612c008df04 found interface eth0
2022/11/03 15:19:58.871 kid1| 28,4| Eui48.cc(237) lookup: id=0x5612c008df04 looking up ARP address for 10.190.196.35 on eth0
2022/11/03 15:19:58.871 kid1| 28,3| Eui48.cc(520) lookup: id=0x5612c008df04 10.190.196.35 NOT found
2022/11/03 15:19:58.871 kid1| 28,4| FilledChecklist.cc(66) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0x7ffcdaa27670
2022/11/03 15:19:58.871 kid1| 28,4| Checklist.cc(197) ~ACLChecklist: ACLChecklist::~ACLChecklist: destroyed 0x7ffcdaa27670
2022/11/03 15:19:58.872 kid1| 28,3| Checklist.cc(70) preCheck: 0x5612c0061188 checking slow rules
2022/11/03 15:19:58.872 kid1| 28,5| Acl.cc(138) matches: checking follow_x_forwarded_for
2022/11/03 15:19:58.872 kid1| 28,5| Checklist.cc(400) bannedAction: Action 'DENIED/0is not banned
2022/11/03 15:19:58.872 kid1| 28,5| Acl.cc(138) matches: checking follow_x_forwarded_for#1
2022/11/03 15:19:58.872 kid1| 28,5| Acl.cc(138) matches: checking all
2022/11/03 15:19:58.872 kid1| 28,9| Ip.cc(95) aclIpAddrNetworkCompare: aclIpAddrNetworkCompare: compare: 10.190.196.35/[::] ([::]) vs [::]-[::]/[::]
2022/11/03 15:19:58.872 kid1| 28,3| Ip.cc(539) match: aclIpMatchIp: '10.190.196.35' found
2022/11/03 15:19:58.872 kid1| 28,3| Acl.cc(158) matches: checked: all = 1
2022/11/03 15:19:58.872 kid1| 28,3| Acl.cc(158) matches: checked: follow_x_forwarded_for#1 = 1
2022/11/03 15:19:58.872 kid1| 28,3| Acl.cc(158) matches: checked: follow_x_forwarded_for = 1
2022/11/03 15:19:58.872 kid1| 28,3| Checklist.cc(63) markFinished: 0x5612c0061188 answer DENIED for match
2022/11/03 15:19:58.872 kid1| 28,3| Checklist.cc(163) checkCallback: ACLChecklist::checkCallback: 0x5612c0061188 answer=DENIED
2022/11/03 15:19:58.872 kid1| 28,3| Checklist.cc(70) preCheck: 0x5612c00feb98 checking slow rules
2022/11/03 15:19:58.872 kid1| 28,5| Acl.cc(138) matches: checking http_access
2022/11/03 15:19:58.872 kid1| 28,5| Checklist.cc(400) bannedAction: Action 'DENIED/0is not banned
2022/11/03 15:19:58.872 kid1| 28,5| Acl.cc(138) matches: checking http_access#1
2022/11/03 15:19:58.872 kid1| 28,5| Acl.cc(138) matches: checking !Safe_ports
2022/11/03 15:19:58.872 kid1| 28,5| Acl.cc(138) matches: checking Safe_ports
2022/11/03 15:19:58.872 kid1| 28,3| Acl.cc(158) matches: checked: Safe_ports = 1
2022/11/03 15:19:58.872 kid1| 28,3| Acl.cc(158) matches: checked: !Safe_ports = 0
2022/11/03 15:19:58.872 kid1| 28,3| Acl.cc(158) matches: checked: http_access#1 = 0
2022/11/03 15:19:58.872 kid1| 28,5| Checklist.cc(400) bannedAction: Action 'DENIED/0is not banned
2022/11/03 15:19:58.872 kid1| 28,5| Acl.cc(138) matches: checking http_access#2
2022/11/03 15:19:58.872 kid1| 28,5| Acl.cc(138) matches: checking CONNECT
2022/11/03 15:19:58.872 kid1| 28,3| Acl.cc(158) matches: checked: CONNECT = 1
2022/11/03 15:19:58.872 kid1| 28,5| Acl.cc(138) matches: checking !SSL_ports
2022/11/03 15:19:58.872 kid1| 28,5| Acl.cc(138) matches: checking SSL_ports
2022/11/03 15:19:58.872 kid1| 28,3| Acl.cc(158) matches: checked: SSL_ports = 1
2022/11/03 15:19:58.872 kid1| 28,3| Acl.cc(158) matches: checked: !SSL_ports = 0
2022/11/03 15:19:58.872 kid1| 28,3| Acl.cc(158) matches: checked: http_access#2 = 0
2022/11/03 15:19:58.872 kid1| 28,5| Checklist.cc(400) bannedAction: Action 'DENIED/0is not banned
2022/11/03 15:19:58.872 kid1| 28,5| Acl.cc(138) matches: checking http_access#3
2022/11/03 15:19:58.872 kid1| 28,5| Acl.cc(138) matches: checking !auth
2022/11/03 15:19:58.872 kid1| 28,5| Acl.cc(138) matches: checking auth
2022/11/03 15:19:58.872 kid1| WARNING: Unsupported or unconfigured/inactive proxy-auth scheme, 'Basic c3F1aWQ6eGMzNzhkZjNlUg=='
2022/11/03 15:19:58.872 kid1| 28,4| Acl.cc(76) AuthenticateAcl: returning 3 sending authentication challenge.
2022/11/03 15:19:58.872 kid1| 28,3| Checklist.cc(63) markFinished: 0x5612c00feb98 answer AUTH_REQUIRED for AuthenticateAcl exception
2022/11/03 15:19:58.872 kid1| 28,3| Acl.cc(158) matches: checked: auth = -1
2022/11/03 15:19:58.872 kid1| 28,3| Acl.cc(158) matches: checked: !auth = -1
2022/11/03 15:19:58.872 kid1| 28,3| Acl.cc(158) matches: checked: http_access#3 = -1
2022/11/03 15:19:58.872 kid1| 28,3| Acl.cc(158) matches: checked: http_access = -1
2022/11/03 15:19:58.872 kid1| 28,3| Checklist.cc(163) checkCallback: ACLChecklist::checkCallback: 0x5612c00feb98 answer=AUTH_REQUIRED
2022/11/03 15:19:58.872 kid1| 28,8| Gadgets.cc(51) aclGetDenyInfoPage: got called for auth
2022/11/03 15:19:58.872 kid1| 28,8| Gadgets.cc(70) aclGetDenyInfoPage: aclGetDenyInfoPage: no match
2022/11/03 15:19:58.872 kid1| 28,4| FilledChecklist.cc(66) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0x7ffcdaa26bf0
2022/11/03 15:19:58.872 kid1| 28,4| Checklist.cc(197) ~ACLChecklist: ACLChecklist::~ACLChecklist: destroyed 0x7ffcdaa26bf0
2022/11/03 15:19:58.872 kid1| 28,4| FilledChecklist.cc(66) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0x7ffcdaa26bf0
2022/11/03 15:19:58.873 kid1| 28,4| Checklist.cc(197) ~ACLChecklist: ACLChecklist::~ACLChecklist: destroyed 0x7ffcdaa26bf0
2022/11/03 15:19:58.873 kid1| 28,4| FilledChecklist.cc(66) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0x5612c00feb98
2022/11/03 15:19:58.873 kid1| 28,4| Checklist.cc(197) ~ACLChecklist: ACLChecklist::~ACLChecklist: destroyed 0x5612c00feb98
2022/11/03 15:19:58.873 kid1| 28,4| FilledChecklist.cc(66) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0x5612c0061188
2022/11/03 15:19:58.873 kid1| 28,4| Checklist.cc(197) ~ACLChecklist: ACLChecklist::~ACLChecklist: destroyed 0x5612c0061188
2022/11/03 15:19:58.873 kid1| 33,2| client_side.cc(817) swanSong: local=10.190.32.35:3128 remote=10.190.196.35:44004 flags=1
2022/11/03 15:19:58.873 kid1| 28,3| Checklist.cc(70) preCheck: 0x7ffcdaa273f0 checking fast ACLs
2022/11/03 15:19:58.873 kid1| 28,5| Acl.cc(138) matches: checking access_log daemon:/var/log/squid/access.log
2022/11/03 15:19:58.873 kid1| 28,5| Acl.cc(138) matches: checking (access_log daemon:/var/log/squid/access.log line)
2022/11/03 15:19:58.873 kid1| 28,3| Acl.cc(158) matches: checked: (access_log daemon:/var/log/squid/access.log line) = 1
2022/11/03 15:19:58.873 kid1| 28,3| Acl.cc(158) matches: checked: access_log daemon:/var/log/squid/access.log = 1
2022/11/03 15:19:58.873 kid1| 28,3| Checklist.cc(63) markFinished: 0x7ffcdaa273f0 answer ALLOWED for match
2022/11/03 15:19:58.873 kid1| 28,4| FilledChecklist.cc(66) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0x7ffcdaa273f0
2022/11/03 15:19:58.873 kid1| 28,4| Checklist.cc(197) ~ACLChecklist: ACLChecklist::~ACLChecklist: destroyed 0x7ffcdaa273f0
2022/11/03 15:19:58.977 kid1| 28,4| Eui48.cc(178) lookup: id=0x5612c008df04 query ARP table
2022/11/03 15:19:58.977 kid1| 28,4| Eui48.cc(222) lookup: id=0x5612c008df04 query ARP on each interface (80 found)
2022/11/03 15:19:58.977 kid1| 28,4| Eui48.cc(228) lookup: id=0x5612c008df04 found interface lo
2022/11/03 15:19:58.977 kid1| 28,4| Eui48.cc(228) lookup: id=0x5612c008df04 found interface eth0
2022/11/03 15:19:58.977 kid1| 28,4| Eui48.cc(237) lookup: id=0x5612c008df04 looking up ARP address for 10.190.196.35 on eth0
2022/11/03 15:19:58.977 kid1| 28,3| Eui48.cc(520) lookup: id=0x5612c008df04 10.190.196.35 NOT found
2022/11/03 15:19:58.977 kid1| 28,4| FilledChecklist.cc(66) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0x7ffcdaa27670
2022/11/03 15:19:58.977 kid1| 28,4| Checklist.cc(197) ~ACLChecklist: ACLChecklist::~ACLChecklist: destroyed 0x7ffcdaa27670
2022/11/03 15:19:58.977 kid1| 28,3| Checklist.cc(70) preCheck: 0x5612c0061188 checking slow rules
2022/11/03 15:19:58.977 kid1| 28,5| Acl.cc(138) matches: checking follow_x_forwarded_for

maxpopov89
() автор топика
10 декабря 2022 г.

Удалось решить следующим образом.

На прокси головного офиса разрешил адрес прокси филиала.

acl trustedproxy src <IP>
http_access allow trustedproxy

На прокси филиала.

# Подключение к вышестоящему прокси-серверу
cache_peer <FQDN> parent 3128 0 no-query no-digest no-netdb-exchange default
cache_peer_access <FQDN> allow all
never_direct allow all


Не уверен на сколько это правильно, но инет появился!

maxpopov89
() автор топика