DEPLOYMENT OF NEW PROXY SERVER WITH NEW WINDOWS 2008 R2 AD AT MAX LIFE GURGAON By: Navdeep Mathur TETRA INFORMATION SERVICES PVT. LTD

OBJECTIVE

New proxy server was implementated at Max Life to achieve the following points

Authentication with AD (Windows 2008 R2) for SSO
IP based policy (blocking or allowing of URLs)
Expected users 30,000 with concurrency 6000
Websense integration
Single session
Reporting tool
GUI

IP of AD server :- 172.23.51.241, 172.23.51.240

IP of proxy servers :- 172.23.64.27

Architecture

Preinstalltion

Packages Required

The following packages are required

- krb5-workstation-1.6.1-25.el5
- pam_krb5-2.2.14-1
- krb5-auth-dialog-0.7-1
- krb5-devel-1.6.1-25.el5
- krb5-server-1.6.1-25.el5
- krb5-libs-1.6.1-25.el5
- squid-3.1.14.STABLE9
- samba3-winbind-3.5.18-44.el5
- samba3-3.5.18-44.el5
- samba3-utils-3.5.18-44.el5
- samba3-doc-3.5.18-44.el5
- samba3-cifsmount-3.5.18-44.el5
- samba3-debuginfo-3.5.18-44.el5
- samba3-client-3.5.18-44.el5

Note :

Need to Download all the samba 3.5 packages from internet then create repo and install.

Increasing the value of ulimit

ulimit –n 32768

Generating rpm of squid from source rpm of squid

rpm –ivh squid*.src.rpm

rpmbuild –ba /usr/src/redhat/SPEC/squid.spec

rpm –Uvh /usr/src/redhat/RPMS/ x86_64/squid-3*.rpm

rpm –Uvh /usr/src/redhat/RPMS/ x86_64/ squid-debuginfo-3*.rpm

Now we edit the startup script of squid to increas ulimit every startup

# vi /etc/init.d/squid

#### increase user limit while executing this script #################

ulimit -HSn 32768

The proxy server time must be synchronized with AD server. This can be achieved by making proxy server as ntp client of AD

vi /etc/ntp.conf

server 172.23.51.241

ntpdate -u 172.23.51.241 ( enter this command 3 times)

/etc/init.d/ntpd start

chkconfig ntpd on

Make entry in /etc/hosts file as shown below

127.0.0.1 localhost.localdomain localhost

172.23.64.27 proxy1.maxlife.max.com proxy1

172.23.64.27 squidproxy1.maxlife.max.com squidproxy1

172.23.57.241 mlidc2.maxlife.max.com mlidc2

DNS is necessary for AD, so /etc/resolv.conf should be modified accordingly to point to dns server. In my case , AD was also DNS server so my entries were as follow

vi /etc/resolv.conf

nameserver 172.23.51.241

nameserver 172.23.51.240

Note:- Proper entry for proxy server must be done in DNS in other to join domain

KERBEROS CONFIGURATION

Kerberos is a network authentication protocol created by MIT which uses secret-key cryptography to secure passwords over the network. Here we configured kerberos to get the ticket from AD. This tickets are stored in proxy server , and winbind uses this tickets for achieving SSO.

/etc/krb5.conf

[logging]

default = FILE:/var/log/krb5libs.log

kdc = FILE:/var/log/krb5kdc.log

admin_server = FILE:/var/log/kadmind.log

[libdefaults]

ticket_lifetime = 24000000

default_realm = MAXLIFE.MAX.COM

default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5 des3-hmac-sha1

default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5 des3-hmac-sha1

permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5 des3-hmac-sha1

dns_lookup_realm = false

dns_lookup_kdc = false

[realms]

MAXLIFE.MAX.COM = {

default_domain = MAXLIFE.MAX.COM

kdc = 172.23.57.241:88

}

[domain_realm]

.maxlife.max.com = MAXLIFE.MAX.COM

maxlife.max.com = MAXLIFE.MAX.COM

[kdc]

profile = /var/kerberos/krb5kdc/kdc.conf

[appdefaults]

pam = {

debug = false

ticket_lifetime = 36000

renew_lifetime = 36000

forwardable = true

krb4_convert = false

}

Save the file and enter following commands

# kinit critical1

Enter the password for critical1:

# klist ( This command will display cached tickets)

CONFIGURATION OF SAMBA

winbind is a component of the Samba suite of programs that solves the unified logon problem. Winbind uses a UNIX implementation of Microsoft RPC calls, Pluggable Authentication Modules (PAMs), and the name service switch (NSS) to allow Windows NT domain users to appear and operate as UNIX users on a UNIX machine. Winbind is critical component for SSO.

We will make Samba as a member of AD domain.

[global]

netbios aliases = MAXPROXY

#workgroup = MNYLDEL

workgroup = MAXLIFE

realm = MAXLIFE.MAX.COM

client ntlmv2 auth = no

client schannel = auto

log level = 3

log file = /var/log/samba/%m.log

max log size = 300

strict allocate = no

debug timestamp = no

socket options = IPTOS_LOWDELAY TCP_NODELAY

wins server =

os level = 8

security = ADS

encrypt passwords = yes

smb passwd file = /etc/sysconfig/sambad/smbpasswd

password server = 172.23.57.241

idmap uid = 10000-30000

idmap gid = 10000-30000

winbind enum users = yes

winbind enum groups = yes

winbind cache time = 15

Save the above file & start the necessary services

# /etc/init.d/smb start

# /etc/init.d/winbind start

Joing the samba into AD domain with the following command

# net ads join -U critical1%Password

Basic Check: # wbinfo -tchecking the trust secret via RPC calls succeeded# wbinfo -g

Check support of ntlm authentication:

# wbinfo -a user%passwordplaintext password authentication succeededchallenge/response password authentication succeeded

Required Changes :

1. 1. chown –R root.squid /var/lib/samba/winbindd_privileged

CONFIGURATION OF SQUID INTEGRATING WITH AD(WINDOWS 2008 R2)

# TAG: url_rewrite_program

url_rewrite_program /opt/Websense/bin/WsRedtor

auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp

auth_param ntlm children 400

auth_param ntlm keep_alive on

auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic

auth_param basic children 32

auth_param basic realm Squid proxy-caching web server

auth_param basic credentialsttl 2 hours

acl all src all

#

#Recommended minimum configuration:

acl manager proto cache_object

acl localhost src 127.0.0.1/32

acl to_localhost dst 127.0.0.0/8

#acl cacheallow src 172.23.53.10/32

acl blocksite url_regex -i abcdefghh.com

acl lanip src 172.23.70.71/32

acl internet src 10.253.0.0/16 172.16.0.0/16 172.23.0.0/16

acl axisip src "/etc/squid/axisip"

acl ndncip src "/etc/squid/ndncip"

acl ndnc dstdom_regex -i ndncregistry.gov.in

acl axisip2 src 172.23.20.19 172.23.20.87 172.23.21.17 172.23.243.102 172.23.243.123 172.23.249.154 172.23.249.70 172.23.251.12 172.23.251.151 172.23.251.27 172.23.251.67 172.23.252.40 172.23.30.107 172.23.30.32 172.23.30.41 172.23.30.41 172.23.31.98 172.23.40.6 172.23.40.6 172.23.71.111 172.23.20.120

acl bloombergip src 172.23.251.5

acl indiabullsip src "/etc/squid/axisip"

acl swissreip src "/etc/squid/swissreip"

#acl axisbank url_regex -i iconnect.co.in axisbank.com

acl axisbank dstdom_regex -i .iconnect.co.in

acl axisbank2 dstdom_regex -i axisbank

acl swissre dstdom_regex -i .swissre.com

acl bloomberg dstdom_regex -i .bloomberg.net

acl indiabulls dstdom_regex -i .indiabulls.com

acl allowsites dstdom_regex -i .gallup.com

#acl indiabulls src "/etc/squid/axisip"

acl blockinternet src 10.10.10.10

acl allowinternet src "/etc/squid/gointernetip"

acl internetip max_user_ip -s 1

acl ldapauth proxy_auth REQUIRED

external_acl_type ad_auth children=400 %LOGIN /usr/lib64/squid/wbinfo_group.pl

acl adgroups external ad_auth Internet_proxy_access Internet_Accounting_Managers Internet_Actuarial Internet_Actuarial_Exceptions Internet_Additional_Distribution Internet_Additional_Distribution_Exceptions Internet_Agency Internet_Agency_Exceptions Internet_Bancassurance Internet_Bancassurance_Exceptions Internet_BDSP Internet_BDSP_Exceptions Internet_Branches_Kios Internet_CEOs_Office Internet_CEOs_Office_Exceptions Internet_COOs_Office Internet_COOs_Office_Exceptions Internet_DST Internet_DST_Exceptions Internet_Emerging_Markets Internet_Emerging_Markets_Exceptions Internet_Exceptions Internet_Facility_Services Internet_Facility_Services_Exceptions Internet_Finance Internet_Finance_Exceptions Internet_Group_Business Internet_Group_Business_Exceptions Internet_Human_Resources Internet_Human_Resources_Exceptions Internet_Information_Technology Internet_Information_Technology_Exceptions Internet_Investment_Desk Internet_Investment_Desk_Exceptions Internet_IT_Administrator Internet_IT_Administrator_Exceptions Internet_Legal Internet_Legal_Exceptions Internet_Marketing Internet_Marketing_Exceptions Internet_Misc Internet_Misc_Exceptions Internet_New_Markets_SBU Internet_New_Markets_SBU_Exceptions Internet_Operations Internet_Operations_Exceptions Internet_Procurement Internet_Procurement_Exceptions Internet_Product_Development Internet_Product_Development_Exceptions Internet_Product_Management Internet_Product_Management_Exceptions Internet_Quality_Business_Excellence Internet_Quality_Business_Excellence_Exceptions Internet_Renewals Internet_Renewals_Exceptions Internet_Risk_Management Internet_Risk_Management_Exceptions Internet_Underwritting Internet_Underwritting_Exceptions Internet_Vendor Internet_Vendor_Exceptions Internet_Executive Internet_MaxVijay Internet_MaxVijay_Exception Internet_Allmail_Exceptions WIFI_Access Internet_Access_Skype Internet_Actuarial_Skype_Exception Internet_Additional_Distribution_Skype_Exception Internet_Agency_Skype_Exception Internet_Bancassurance_Skype_Exception Internet_CEOs_Skype_Exception Internet_COOs_Skype_Exception INternet_DST_Skype_Exception Internet_Emerging_Skype_Exception Internst_Excutive_Skype_Exception Internet_Finance_Skype_Exception Internet_Group_Business_Skype_Exception Internet_HR_Skype_Exception Internet_Information_Technology_Skype_Exception Internet_Investment_Skype_Exception Internet_IT_Skype_Exception Internet_Legal_Skype_Exception Internet_Marketing_Skype_Exception INternet_Misc_Skype_Exception Internet_NEw_Markets_Skype_Exception Internet_Operations_Skype_Exception Internet_Procurement_Skype_Exception Internet_Product_development_skype_exception Internet_Product_Management_Skype_Exception Internet_Quality_Business_Skype_Exception Internet_Renewals_Skype_Exception Internet_Risk_Management_Skype_Exception INternet_underwritting_skype_Exception INternet_vendor_Skype_Exception Internet_BDSP_Skype_Exception Internet_Misc_Category_Exception

acl SSL_ports port 443

acl Safe_ports port 80 # http

acl SSL_ports port 38026

acl SSL_ports port 38021

acl SSL_ports port 32220-32399

acl SSL_ports2 port 38026

acl SSL_ports2 port 38021

acl SSL_ports2 port 32220-32399

acl Safe_ports port 80 # http

acl Safe_ports port 21 # ftp

acl Safe_ports port 38026 # ftp

acl Safe_ports port 32220-32399 # ftp

acl Safe_ports port 32220-32230 # ftp

acl Safe_ports port 38021 # ftp

acl Safe_ports2 port 38026 # ftp

acl Safe_ports2 port 32220-32399 # ftp

acl Safe_ports2 port 38021 # ftp

acl Safe_ports port 443 # https

acl Safe_ports port 70 # gopher

acl Safe_ports port 210 # wais

acl Safe_ports port 1025-65535 # unregistered ports

acl Safe_ports1 port 100-65535 # unregistered ports

acl Safe_ports2 port 100-65535 # unregistered ports

acl Safe_ports port 280 # http-mgmt

acl Safe_ports port 488 # gss-http

acl Safe_ports port 591 # filemaker

acl Safe_ports port 777 # multiling http

acl CONNECT method CONNECT

acl Safe_ports port 8889

acl Viratech src 172.23.252.35

acl ViratechIndia dstdom_regex -i .viratechindia.com

acl Viratechsoftware dstdom_regex -i .viratechsoftware.com

acl maxqmaxindia dstdom_regex -i maxq.maxindia.com*

http_access allow ndncip ndnc

http_access allow axisip axisbank

http_access allow axisip2 axisbank2

#http_access allow googledocs

#http_access allow googledocs1

#http_access allow googledocs2

http_access allow maxqmaxindia

#http_access allow axisip2 axisbank2

http_access allow swissreip swissre

http_access allow bloombergip bloomberg

http_access allow indiabullsip indiabulls

http_access allow internet allowsites

http_access allow manager internet

http_access deny manager

http_access allow allowinternet

http_access deny blockinternet

http_access deny blocksite

http_access deny internetip

http_access deny !adgroups

http_access allow internet ldapauth

/etc/init.d/squid start

Check logs :

1. 1. 1. /var/log/squid/cache.log (for squid)
    2. /var/samba/winbindd.log ( for samba)

INSTALLATION OF PLUGIN ON SQUID WEB PROXY

Note : Websense 7.5 version only support squid 2.6 stable. Only websense install with squid 2.6 then squid upgrade

If you installed Websense Enterprise on a machine separate from the Squid Web Proxy Cache, you must install the Squid Plug-in on the Squid Web Proxy Cache machine so that Websense and Squid can communicate. You must install the Squid Plug-in after installing the Websense Filtering Service. To install the Squid Plug-in on the Squid Web Proxy Cache machine:

1. Log on to the machine as the root user.

2. Stop the Squid Web Proxy Cache.

3. Create a setup directory.

#mkdir /download/Websense

4. Download the installer file from http://www.websense.com/downloads

Linux: Websense750Setup_Lnx.tar.gz

This tar has already in the server proxy1 new at /downloads/downloads/

5. tar zxvf Websense750Setup_Lnx.tar.gz

6. Run the installation program from the setup directory with the following

command:

./install.sh

Installation type: Choose Custom.

Component selection: Select Filtering Plug-in from the list of components to install.

Policy Server: Provide the 172.23.50.23 of the Websense Server machine.

Filtering Service: Enter the IP address 172.23.50.27 of the Filtering Service machine and the port number is default.

Installation directory: /etc/squid/squid.conf

Required sbin : /usr/sbin/squid

Press Enter to begin the installation.

The Download Manager copies the appropriate installer files from Websense and begins the installation. The installer creates the /opt/Websense directory and installs the Squid Plug-in in that

location.

7. Exit the installer when the installer displays the successful installation message.

10. Start the Squid Web Proxy Cache.

#rpm –Uvh squid-3.1.14-1.el5.x86_64.rpm

#rpm –Uvh squid-debuginfo-3.0.STABLE9-1.x86_64.rpm

REPORTING TOOLS AND SYSLOG

Enable Syslog server on Proxy2 by editing /etc/sysconfig/syslog

SYSLOGD_OPTIONS=”-m 0”

to

SYSLOGD_OPTIONS=”-m 0 -r”

(Second server is not there so this time it not forward)

Installation of Sarg

Download sarg with the following command

# wget http://pkgs.repoforge.org/sarg/sarg-2.3.1-1.el5.rft.x86_64.rpm

# rpm –Uvh sarg-2.3.1-1.el5.rft.x86_64.rpm

This will install all the necessary cron scripts and create report daily , weekly and monthly.

Sarg report can be accessed

http://172.23.64.27/sarg

Installation of sqstat for instant reporting.

Php is required for this. Download sqstat with the following command

#wget http://samm.kiev.ua/sqstat/sqstat-1.20.zip

#unzip sqstat-1.20.zip

#mv sqstat-1.20 /var/www/html/sqstat

Edit /etc/squid.conf file as show below

acl manager proto cache_object

acl internet src 172.23.0.0/16

http_access allow manager internet

http_access deny manager

Restart the squid service and realtime report can be accessed with the following link

http://172.23.64.27/squidstat (Proxy1 Server)

GRAPHICAL USER INTERFACE

GUI for squid is provided using webmin.

# wget http://prdownloads.sourceforge.net/webadmin/webmin-1.600-1.noarch.rpm

# rpm –Uvh webmin-1.600-1.noarch.rpm

Webmin can be accessed with the following link

By default port no. is 10000 need to change to 8080

Goto /etc/webmin/miniserv.conf

Then change:

port=8080

listen=8080

wq

#/etc/init.d/webmin restart

# https://172.23.64.27:8080

[[Image:]]

Troubleshooting

1. When need to restart the squid server.

# /etc/init.d/squid restart

for send kill signal to running copy.

# squid -k shutdown

# /etc/init.d/squid start

2. User facing problem regarding user login.

# /etc/init.d/smb stop

# rm /var/cache/samba/*.tdb

# rm /etc/samba/secrets.tdb

# net ads join -U critical1% enter password

# /etc/init.d/smb start

# /etc/init.d/winbind restart

3. Log check cammands.

# tail -f /var/log/samba/wb-MAXLIFE.log

# tail -f /var/log/messages

#tail –f /var/log/squid/cache.log