-   Linux - Server (
-   -   SquidGuard - Ldap doesnt filter users (

kool_kid 03-21-2011 02:09 PM

SquidGuard - Ldap doesnt filter users

I have a setup of squid3 with ntlm authen and I use squidGuard 1.5 to filter my web traffic.

My squid3 is authenticating users properly and parsing all rules. The problem is with squidguard which doesn't seem to filter out users. below is my squidguard config.


dbhome /usr/local/squidGuard/db
logdir /usr/local/squidGuard/log
ldapbinddn      "cn=Ldap,cn=Users,dc=domain,dc=com"
ldapbindpass    secretpass
ldapcachetime  300
ldapprotover    3

src Allowed_Top_Mgmt {
        ldapusersearch  "ldap://,dc=com?sAMAccountName?sub?(&(sAMAccountName=%s)(memberOf=cn=Allowed_Full_Proxy_Users%2cou=Group%20Accounts%2cdc=domain%2cdc=com))"

dest ads {
    domainlist  ads/domains
    urllist    ads/urls
acl {
    Allowed-Top-Mgmt {
        pass !ads all
    default {
        pass none

My squidguard logs have these messages.


  [30393] (squidGuard): ldap_search_ext_s failed: Bad search filter (params: dc=domain,dc=com, 2, (&(sAMAccountName=domain\peter.hank)(memberOf=cn=Allowed_Full_Proxy_Users,ou=Group Accounts,dc=domain,dc=com)), sAMAccountName)
2011-03-21 18:44:51 [30393] Added LDAP source: domain%5cpeter.hank
2011-03-21 18:44:51 [30393] DEBUG: sgFindUser called with: domain%5cpeter.hank

peter.hank user is unable to access anything or any other user from other group is not able to access anything. Peter.hank is a member of the above defined group, I have cross checked it.
Please do give me some ways to test ldapuser. Some pointers would even work.


kool_kid 03-23-2011 02:21 PM

This was happening because squidGuard was parsing my login ID as DOMAIN%5cUSERNAME. Yeah, "\" was converted into %5c. With this format ldap was unable to search users and hence apply default acl for all users.

I applied this patch by Mat (Thanks mate) and recompiled squidGuard and added 2 lines (mentioned below) in squidGuard.conf after recompilation.

stripntdomain true
striprealm true

Zetec 03-23-2011 03:08 PM

That's a nice find. I always found squid with LDAP a little funny. May have to have another go at it. :D

kool_kid 03-23-2011 03:25 PM

I was on a verge to ditch it as well lol. But all is good, I always have a soft corner for squid and squidguard :)

All times are GMT -5. The time now is 10:52 PM.