![\"Free](\"\/wp-content\/uploads\/2020\/03\/229c5f1df948da65810db95ef2b4d2a2.png\")
<\/p>\n<\/p>\n
pfSense+Squid with HTTPS filtering + Single Sign-On (SSO) technology with filtering by Active Directory groups<\/p>\n
The company has a need to implement a proxy server with the ability to filter access to websites (including HTTPS) by groups from AD, so that users do not have to enter any additional passwords, and administration can be done via a web interface. Quite a request, isn't it?<\/p>\n
A correct response would be to purchase solutions such as Kerio Control or UserGate, but as always, there is no money, yet the need persists.<\/p>\n
This is where our reliable old friend Squid comes to the rescue, but again \u2014 where to get a web interface? SAMS2? It's outdated. This is where pfSense comes to the rescue.<\/p>\n
This article will describe the method for configuring the Squid proxy server.
\nKerberos will be used for user authentication.
\nSquidGuard will be used for filtering by domain groups.<\/p>\n
For monitoring, Lightsquid, sqstat, and internal pfSense monitoring systems will be used. The basis will be pfSense, Installation Instructions.<\/a><\/p>\n Inside, we will set up authentication on the firewall itself using domain accounts. Instructions.<\/a><\/p>\n Very Important!<\/p>\n Before starting the Squid installation, DNS must be configured server<\/a> in pfSense, creating an A record and PTR records on our DNS server, and configuring NTP so that the time does not differ from the time on the domain controller.<\/p>\n And in your network, allow the WAN interface of pfSense to access the internet, while users on the local network connect to the LAN interface, including ports 7445 and 3128 (in my case, 8080).<\/p>\n Is everything ready? Is the connection to the domain via LDAP for authentication on pfSense established and the time synchronized? Great. It's time to proceed with the main process.<\/p>\n We will install Squid, SquidGuard, and LightSquid from the pfSense package manager in the \u2018System\/Package Manager\u2019 section.<\/p>\n After a successful installation, we proceed to \"Services\/Squid Proxy server\/\" and first configure caching in the Local Cache tab. I set everything to 0, as I don't see much point in caching websites, which browsers handle perfectly. After configuration, click the \"Save\" button at the bottom of the screen to allow us to make the main proxy settings.<\/p>\n We set the main configuration as follows:<\/p>\n The default port is 3128, but I prefer to use 8080.<\/p>\n The selected parameters in the Proxy Interface tab determine which interfaces our proxy will listen to. server<\/a>Since this firewall is designed in such a way that it accesses the internet via the WAN interface, even though LAN and WAN may be in the same local subnet, I recommend using the LAN specifically for the proxy.<\/p>\n The loopback is needed for sqstat to work.<\/p>\n Below you will find the settings for the Transparent proxy and SSL Filter, but we don't require them; our proxy will not be transparent, and for HTTPS filtering, we will not engage in certificate substitution (since we have document flow, bank clients, etc.); we will simply observe the handshake.<\/p>\n At this stage, we need to go to our domain controller and create an account for authentication (you can also use the one you set up for authentication to pfSense itself). A very important factor here is that if you intend to use AES128 or AES256 encryption, make sure to check the corresponding boxes in the account settings.<\/p>\n If your domain represents a rather complex forest with many directories or your domain is .local, then possibly, though not certainly, you will have to use a simple password for this account; this bug is known, but it may simply not work with a complex password, so it needs to be checked on a specific case.<\/p>\n After all this, we create a key file for Kerberos; on the domain controller, open the command line with administrator rights and enter:<\/p>\n Where we specify our FQDN pfSense, strictly adhering to the case, in the mapuser parameter we input our domain account and its password, and in crypto we choose the encryption method. I used rc4 for operation, and in the -out field, we select where to send our finished key file. Now we can edit\/create \/etc\/krb5.conf<\/p>\n where \/etc\/krb5.keytab is the key file we created.<\/p>\n Make sure to check Kerberos functionality using kinit; if it doesn\u2019t work, there\u2019s no point in reading further.<\/p>\n Having successfully configured Kerberos, we will attach it to our Squid.<\/p>\n To do this, go to Services > Squid Proxy Server, and in the main settings scroll to the very bottom where we will find the \u2018Advanced Settings\u2019 button.<\/p>\n In the Custom Options (Before Auth) field, we will enter:<\/p>\n u\u0434\u0435 auth_param negotiate program \/usr\/local\/libexec\/squid\/negotiate_kerberos_auth<\/i> \u2014 selects the required Kerberos authentication helper.<\/p>\n \u2014 some characteristic of the node (for example, a number). The key is needed to identify the element of the tree corresponding to this key. Example of a binary search tree: -s<\/i> with the value GSS_C_NO_NAME<\/i> \u2014 specifies the use of any account from the key file.<\/p>\n \u2014 some characteristic of the node (for example, a number). The key is needed to identify the element of the tree corresponding to this key. Example of a binary search tree: -k<\/i> with the value \/usr\/local\/etc\/squid\/squid.keytab<\/i> \u2014 specifies to use this particular keytab file. In my case, it's the same keytab file we created, which I copied to the directory \/usr\/local\/etc\/squid\/ and renamed because Squid didn\u2019t want to cooperate with that directory, possibly due to insufficient permissions.<\/p>\n \u2014 some characteristic of the node (for example, a number). The key is needed to identify the element of the tree corresponding to this key. Example of a binary search tree: -t<\/i> with the value -t none<\/i> \u2014 disables cyclical requests to the domain controller, which significantly reduces the load on it if you have more than 50 users. WhatsApp is used as an example for a reason \u2014 it is very particular about proxies with authentication and will not work unless allowed before authentication. Go to Services > SquidGuard Proxy Filter.<\/p>\n In the LDAP Options, enter the details of our account used for Kerberos authentication in the following format:<\/p>\n If there are spaces or non-Latin characters, the entire entry should be enclosed in single or double quotes:<\/p>\n Next, make sure to check these boxes:<\/p>\n
\nIt will also address a common problem associated with implementing Single Sign-On (SSO) technology, namely applications attempting to access the internet under their system account.
\n<\/a><\/p>\nPreparation for installing Squid<\/h4>\n
Installation and Preliminary Configuration<\/h4>\n
![\"Free](\"\/wp-content\/uploads\/2020\/03\/b3333c720db87625c76ea56d194295ff.png\")
<\/p>\n![\"Free](\"\/wp-content\/uploads\/2020\/03\/d93a4a825a83de3e0c94cde9c1017411.png\")
<\/p>\n# ktpass -princ HTTP\/pfsense.domain.local@DOMAIN.LOCAL -mapuser pfsense -pass 3EYldza1sR -crypto {DES-CBC-CRC|DES-CBC-MD5|RC4-HMAC-NT|AES256-SHA1|AES128-SHA1|All} -ptype KRB5_NT_PRINCIPAL -out C:keytabsPROXY.keytab<\/code><\/pre>\n
\nAfter successfully creating the key file, we will send it to our pfSense. I used Far for this, but it can also be done using commands, Putty, or through the pfSense web interface in the 'Diagnostics Command Line' section.<\/p>\n![\"Free](\"\/wp-content\/uploads\/2020\/03\/0fb3830c14d216afa05ac45e3aec66e4.png\")
<\/p>\nConfiguring Squid authentication and access list without authentication<\/h4>\n
#\u0425\u0435\u043b\u043f\u0435\u0440\u044b\nauth_param negotiate program \/usr\/local\/libexec\/squid\/negotiate_kerberos_auth -s GSS_C_NO_NAME -k \/usr\/local\/etc\/squid\/squid.keytab -t none\nauth_param negotiate children 1000\nauth_param negotiate keep_alive on\n#\u0421\u043f\u0438\u0441\u043a\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430\nacl auth proxy_auth REQUIRED\nacl nonauth dstdomain \"\/etc\/squid\/nonauth.txt\" \n#\u0420\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \nhttp_access allow nonauth \nhttp_access deny !auth\nhttp_access allow auth<\/code><\/pre>\n
\nDuring testing, you can also add the key -d \u2014 i.e., diagnostics, which will show more logs.
\nauth_param negotiate children 1000<\/i> \u2014 defines how many simultaneous authentication processes can be run
\nauth_param negotiate keep_alive on<\/i> \u2014 keeps the connection alive during the authorization chain polling
\nacl auth proxy_auth REQUIRED<\/i> \u2014 creates and requires an access control list that includes users who have passed authentication
\nacl nonauth dstdomain \"\\\/etc\\\/squid\\\/nonauth.txt\"<\/i> \u2014 informs Squid about the nonauth access list, which contains the destination domains that everyone will always be allowed access to. We create the file and write the domains inside it in the format<\/p>\n.whatsapp.com\n.whatsapp.net<\/code><\/pre>\n
\nhttp_access allow nonauth<\/i> \u2014 allows access to this list for everyone
\nhttp_access deny !auth<\/i> \u2014 denies access to unauthorized users to other sites
\nhttp_access allow auth<\/i> \u2014 allows access to authorized users.
\nEverything, you have configured Squid, now it's time to start filtering by groups.<\/p>\nConfiguring SquidGuard<\/h4>\n
CN=pfsense,OU=service-accounts,DC=domain,DC=local<\/code><\/pre>\n'CN=sg,OU=service-accounts,DC=domain,DC=local'\n\"CN=sg,OU=service-accounts,DC=domain,DC=local\"<\/code><\/pre>\n![\"Free](\"\/wp-content\/uploads\/2020\/03\/162ca3f3b6d0977c8ac73f20b640f67c.png\")
<\/p>\n