Здравствуйте !
Имеем сквид на убунту, настроена авторизация керберос. Группа в домене имеет полный доступ в интернет без ограничений
Создан список blacklist - для ограничений группы squid_user
Что необходимо: каким то образом прикрутить этот список к группе squid_user, что б члены группы не могли попасть на заблокированные ресурсы.
Заранее спасибо !
Конфиг:
acl url_filtred src 192.168.0.1-192.168.1.250
auth_param negotiate program /usr/lib/squid/negotiate_kerberos_auth -s HTTP/Linux.MY.DOMAIN.RU
auth_param negotiate children 20 startup=0 idle=1
auth_param negotiate keep_alive on
#auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/internet_users
#auth_param basic children 5
#auth_param basic realm =MY.DOMAIN.RU=
#auth_param basic credentialsttl 2 hours
##ACCESS_GROUP###
external_acl_type squid-admin ttl=300 negative_ttl=60 %LOGIN /usr/lib/squid/ext_kerberos_ldap_group_acl -a -g squid-admin -D MY.DOMAIN.RU
external_acl_type squid-user ttl=300 negative_ttl=60 %LOGIN /usr/lib/squid/ext_kerberos_ldap_group_acl -a -g squid-user -D MY.DOMAIN.RU
external_acl_type squid-whitelist ttl=300 negative_ttl=60 %LOGIN /usr/lib/squid/ext_kerberos_ldap_group_acl -a -g squid-whitelist -D MY.DOMAIN.RU
########################GROUP##################################
acl squid-admin external squid-admin
acl squid-user external squid-user
acl squid-whitelist external squid-whitelist
#
acl localnet src 192.168.0.0/24 192.168.1.0/24 # RFC1918 possible internal network
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
acl auth proxy_auth REQUIRED
######################HTTP_ACCESS##############################
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
###########FROM_GROUP#########################################
http_access allow squid-admin
http_access allow squid-user
http_access allow squid-whitelist
#############################################################
http_access deny manager
#http_access allow auth
http_access allow localhost
http_access deny all
http_port 192.168.1.252:3128
cache_mem 1024 MB
maximum_object_size_in_memory 512 KB
maximum_object_size 4 MB
cache_dir ufs /var/spool/squid 2048 16 256
access_log daemon:/var/log/squid/access.log squid
logfile_rotate 31
coredump_dir /var/spool/squid
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern (Release|Packages(.gz)*)$ 0 20% 2880
refresh_pattern . 0 20% 4320
