Debian Squeeze, Squid, Kerberos/LDAP 인증, Active Directory 통합 및 Cyfin Reporter - 페이지 2

vi /etc/default/squid3

KRB5_KTNAME=/etc/squid3/PROXY.keytab
export KRB5_KTNAME

####### /etc/squid3/squid.conf 구성 파일 #######
####### 캐시 관리자
cache_mgr [email protected]
####### kerberos 인증
auth_param negotiate program /usr/lib/squid3/squid_kerb_auth -d -s HTTP/squidproxy.example.local
auth_param negotiate children 10
auth_param negotiate keep_alive on
####### kerberos를 통해 인증되지 않은 클라이언트를 위한 ldap 접근 제공
auth_param basic program /usr/lib/squid3/squid_ldap_auth -R \
        -b "dc=example,dc=local" \
        -D [email protected] \
        -w "squidpass" \
        -f sAMAccountName=%s \
        -h domaincontroller1.example.local
auth_param basic children 10
auth_param basic realm Internet Proxy
auth_param basic credentialsttl 1 minute
####### ldap 권한
# 제한된 프록시 접근 기록됨
external_acl_type internet_users %LOGIN /usr/lib/squid3/squid_ldap_group -R -K \
        -b "dc=example,dc=local" \
        -D [email protected] \
        -w "squidpass" \
        -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=Internet Users,ou=Security Groups,ou=MyBusiness,dc=example,dc=local))" \
        -h domaincontroller1.example.local
# 전체 프록시 접근 비로그
external_acl_type internet_users_full_nolog %LOGIN /usr/lib/squid3/squid_ldap_group -R -K \
        -b "dc=example,dc=local" \
        -D [email protected] \
        -w "squidpass" \
        -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=Internet Users Full NoLog,ou=Security Groups,ou=MyBusiness,dc=example,dc=local))" \
        -h domaincontroller1.example.local
# 전체 프록시 접근 기록됨
external_acl_type internet_users_full_log %LOGIN /usr/lib/squid3/squid_ldap_group -R -K \
        -b "dc=example,dc=local" \
        -D [email protected] \
        -w "squidpass" \
        -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=Internet Users Full Log,ou=Security Groups,ou=MyBusiness,dc=example,dc=local))" \
        -h domaincontroller1.example.local
####### acl 프록시 인증 및 ldap 권한
acl auth proxy_auth REQUIRED
# 형식 "acl, aclname, acltype, acltypename, activedirectorygroup"
acl RestrictedAccessLog external internet_users Internet\ Users
acl FullAccessNoLog external internet_users_full_nolog Internet\ Users\ Full\ NoLog
acl FullAccessLog external internet_users_full_log Internet\ Users\ Full\ Log
acl whitelistsites url_regex -i "/etc/squid3/whitelistsites.txt"
acl blockedsites url_regex -i "/etc/squid3/blockedsites.txt"
####### squid 기본값
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # 등록되지 않은 포트
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # 다국어 http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
####### 인증 시행: 규칙의 순서가 권한 수준에 중요함
no_cache deny whitelistsites
http_access allow whitelistsites
http_access allow FullAccessNoLog auth
http_access allow FullAccessLog auth
http_access deny blockedsites
http_access allow RestrictedAccessLog auth
####### 로깅
# whitelistsites, FullAccessNoLog 기록하지 않음
access_log /var/log/squid3/access.log squid !whitelistsites !FullAccessNoLog
####### squid 기본값
http_access deny all
http_port 3128
hierarchy_stoplist cgi-bin ?
coredump_dir /var/spool/squid3
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

apt-get install apache2

vi /etc/apache2/conf.d/wpad.dat

AddType    application/x-ns-proxy-autoconfig .dat

vi /var/www/wpad.dat

function FindProxyForURL(url, host)
{
        $proxy = "PROXY squidproxy.example.local:3128";
        // 이 네트워크 내의 URL은 직접 접근됩니다.
        if (isInNet(host, "192.168.0.0", "255.255.0.0"))        {return "DIRECT";}
        if (isInNet(host, "172.16.0.0", "255.240.0.0"))         {return "DIRECT";}
        if (isInNet(host, "10.0.0.0", "255.0.0.0"))             {return "DIRECT";}
        if (isInNet(host, "127.0.0.0", "255.0.0.0"))            {return "DIRECT";}
        // 나머지 모든 것에 대해 프록시를 반환합니다.
        else return $proxy;
}

invoke-rc.d apache2 restart

* 절대 경로를 입력하거나 기본값을 수락하려면  를 누르십시오.
      : /opt/wavecrest/cyfin*

vi /etc/init.d/cyfin

#! /bin/sh
### BEGIN INIT INFO
# 제공:          cyfin
# 시작 필요:    $network $remote_fs
# 중지 필요:     $network $remote_fs
# 기본 시작:     2 3 4 5
# 기본 중지:      0 1 6
# 간단한 설명: cyfin reporter init 스크립트
### END INIT INFO
NAME=cyfin
SCRIPTNAME=/etc/init.d/$NAME
# VERBOSE 설정 및 기타 rcS 변수를 로드합니다.
. /lib/init/vars.sh
# LSB log_* 함수 정의.
# 이 파일이 존재하고 status_of_proc가 작동하도록 lsb-base (>= 3.2-14)에 의존합니다.
. /lib/lsb/init-functions
case "$1" in
        start)          sh /opt/wavecrest/cyfin/cyfin start
        ;;
        stop)           sh /opt/wavecrest/cyfin/cyfin stop
        ;;
        status)         sh /opt/wavecrest/cyfin/cyfin start
        ;;
        restart)        sh /opt/wavecrest/cyfin/cyfin restart
        ;;
        *)              echo "Usage: $SCRIPTNAME {start|stop|status|restart}" >&2
                        exit 3
        ;;
esac
: