Всем привет.
Конфиг:
auth_param negotiate program /usr/lib64/squid/negotiate_kerberos_auth -d -k /etc/squid/squid.keytab -s HTTP/squid.corp.domain.ru@CORP.DOMAIN.RU
auth_param negotiate children 100 startup=0 idle=10
auth_param negotiate keep_alive on
acl authenticated_user proxy_auth REQUIRED
http_access deny !authenticated_user
external_acl_type inet_buh ttl=300 negative_ttl=60 %LOGIN /usr/lib64/squid/ext_kerberos_ldap_group_acl -g Internet-buh@CORP.DOMAIN.RU
acl localnet src 172.16.100.0/24
acl buh external inet_buh
acl auth proxy_auth REQUIRED
acl SSL_ports port 443 9443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
acl white_list dstdomain "/etc/squid/whitelist.txt"
acl black_list dstdomain "/etc/squid/blocked_http.txt"
dns_nameservers 172.16.100.11
# access rule
http_access allow buh white_list
http_access deny buh all
http_access allow localhost
http_access deny all
http_port 3128
always_direct allow all
sslproxy_cert_error allow all
acl blocked ssl::server_name "/etc/squid/blocked_https.txt"
acl step1 at_step SslBump1
ssl_bump peek step1
ssl_bump terminate blocked
ssl_bump splice all
coredump_dir /var/spool/squid
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
cache_dir aufs /var/spool/squid 20000 49 256
maximum_object_size 61440 KB
minimum_object_size 3 KB
cache_swap_low 90
cache_swap_high 95
maximum_object_size_in_memory 512 KB
memory_replacement_policy lru
logfile_rotate 4
Если добавляю юзера в AD в группу inet_buh, то в браузере
ОШИБКА
Запрошенный URL не может быть получен
В логах:
1654417319.278 0 172.16.100.101 TCP_DENIED/407 4578 GET http://ya.ru/ - HIER_NONE/- text/html
1654417319.344 42 172.16.100.101 TCP_DENIED/403 7156 GET http://ya.ru/ user01@CORP.DOMAIN.RU HIER_NONE/- text/html
1654417319.474 0 172.16.100.101 TCP_DENIED/403 4629 GET http://squid.corp.viang.ru:3128/squid-internal-static/icons/SN.png user01@CORP.DOMAIN.RU HIER_NONE/- text/html
Указываю в whitelist.txt домен ya.ru, о не помогает.
Если в squid.conf вместо http_access deny all указать http_access allow all, то везде пускает.
В чем может быть ошибка конфига?
