Добрый день. Извините, не заметил, что скопировал строчки авторизации не до конца.
adserver2012.kh.wizard.net alamak.kh.wizard.net мои два контролера домена (2012 и 2003 соответственно)
Дублирую:
# OPTIONS FOR AUTHENTICATION
# -----------------------------------------------------------------------------
#
# Negotiate Kerberos and NTLM authentication
auth_param negotiate program /usr/lib/squid3/negotiate_wrapper_auth --ntlm /usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp --kerberos /usr/lib/squid3/negotiate_kerberos_auth -r -s squid.kh.wizard.net@KH.WIZARD.NET
auth_param negotiate children 200 startup=50 idle=10
auth_param negotiate keep_alive off
# Only NTLM authentication
auth_param ntlm program /usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 100 startup=20 idle=5
auth_param ntlm keep_alive off
# Basic authentication via ldap for clients not authenticated via kerberos/ntlm
auth_param basic program /usr/lib/squid3/basic_ldap_auth -v 3 -P -R -b "dc=kh,dc=wizard,dc=net" -D Squid@kh.wizard.net -W /etc/squid3/conf_param_ldappass.txt -f sAMAccountName=%s -h adserver2012.kh.wizard.net alamak.kh.wizard.net
auth_param basic children 20
auth_param basic realm "UbuntuGW SQUID Proxy Server Basic authentication!"
auth_param basic credentialsttl 2 hours
# ACCESS CONTROLS
# -----------------------------------------------------------------------------
#
# LDAP authorization
external_acl_type memberof ttl=3600 ipv4 %LOGIN /usr/lib/squid3/ext_ldap_group_acl -v 3 -P -R -K -b "dc=kh,dc=wizard,dc=net" -D Squid@kh.wizard.net -W /etc/squid3/conf_param_ldappass.txt -f "(&(objectclass=person)(sAMAccountName=%v)(memberOf.2.840.113556.1.4.1941:=cn=%g,OU=Security Groups,OU=KH-WIZARD,DC=kh,DC=wizard,DC=net))" -h adserver2012.kh.wizard.net alamak.kh.wizard.net
#
acl auth proxy_auth REQUIRED
acl BlockedAccess external memberof "/etc/squid3/conf_param_groups_blocked.txt"
acl RestrictedAccess external memberof "/etc/squid3/conf_param_groups_restricted.txt"
acl StandardAccess external memberof "/etc/squid3/conf_param_groups_standard.txt"
acl FullAccess external memberof "/etc/squid3/conf_param_groups_full_auth.txt"
acl AnonymousAccess external memberof "/etc/squid3/conf_param_groups_full_anon.txt"
acl allowedsites dstdomain "/etc/squid3/conf_param_sites_allowed.txt"
acl blockedsites dstdomain "/etc/squid3/conf_param_sites_blocked.txt"
acl prioritysites dstdomain "/etc/squid3/conf_param_sites_priority.txt"
#
В настройках доступа менял только сеть
acl localnet src 192.168.0.0/24 # RFC1918 possible internal network
Параметры сети
# NETWORK OPTIONS
# -----------------------------------------------------------------------------
#
http_port 192.168.10.2
http_port 127.0.0.1
#
и параметры кеша
# DISK CACHE OPTIONS
# ---------------------------------------------------------------------------
#
cache_replacement_policy heap LFUDA
cache_dir ufs /mnt/squid-cache/ 7000 16 256
maximum_object_size 32768 KB
Почему решил что доступ?
в терминале набирал
sudo tail -f /var/log/squid3/access.log
1459494995.785 1 192.168.10.14 TCP_DENIED/403 4994 GET http://google.com.ua/ pasha HIER_NONE/- text/html
1459494995.845 0 192.168.10.14 TCP_DENIED/403 3932 GET http://www.squid-cache.org/Artwork/SN.png pasha HIER_NONE/- text/html
1459495014.155 0 192.168.10.14 TCP_DENIED/403 4705 GET http://google.com.ua/ pasha HIER_NONE/- text/html
1459495014.215 0 192.168.10.14 TCP_DENIED/403 3932 GET http://www.squid-cache.org/Artwork/SN.png pasha HIER_NONE/- text/html