Squid mit NTLM AUTH und eine W2k3 Domäne

[global]
workgroup =  DOMAINNAME
netbios name = PROXY
realm = fqdn
password server = PDC
client use spnego = yes
security = ADS
encrypt passwords = yes
winbind refresh tickets = yes
idmap uid = 10000-20000
idmap gid = 10000-20000
winbind separator = /
winbind enum users = yes
winbind enum groups = yes
winbind cache time = 10
winbind use default domain = yes

[libdefaults]
	default_realm = DOMAIN.LOCAL
	clockskew = 300

# The following krb5.conf variables are only for MIT Kerberos.
	krb4_config = /etc/krb.conf
	krb4_realms = /etc/krb.realms
	kdc_timesync = 1
	ccache_type = 4
	forwardable = true
	proxiable = true

# The following encryption type specification will be used by MIT Kerberos
# if uncommented.  In general, the defaults in the MIT Kerberos code are
# correct and overriding these specifications only serves to disable new
# encryption types as they are added, creating interoperability problems.

#	default_tgs_enctypes = aes256-cts arcfour-hmac-md5 des3-hmac-sha1 des-cbc-crc des-cbc-md5
#	default_tkt_enctypes = aes256-cts arcfour-hmac-md5 des3-hmac-sha1 des-cbc-crc des-cbc-md5
#	permitted_enctypes = aes256-cts arcfour-hmac-md5 des3-hmac-sha1 des-cbc-crc des-cbc-md5

# The following libdefaults parameters are only for Heimdal Kerberos.
	v4_instance_resolve = false
	v4_name_convert = {
		host = {
			rcmd = host
			ftp = ftp
		}
		plain = {
			something = something-else
		}
	}
	fcc-mit-ticketflags = true

[realms]
	TANK.LOCAL= {
		kdc = PDC:88
		admin_server = PDC
	}

[domain_realm]
  .domain.local=  DOMAIN.LOCAL

[appdefaults]
	pam = {
		ticket_lifetime = 1d
		renew_lifetime = 1d
		forwardable = true
		proxiable = false
		retain_after_close = false
		minimum_uid = 1
	}
	
[login]
	krb4_convert = true
	krb4_get_tickets = false

[logging]
	default = SYSLOG:NOTICE:DAEMON
	default = FILE:/var/log/krb5libs.log
	kdc = FILE:/var/log/kdc.log
	kadmind = FILE:/var/log/kadmind.log

Linux:~# wbinfo -t
checking the trust secret via RPC calls succeeded

### Port
http_port 3128

### Stoplist
hierarchy_stoplist cgi-bin ?

### Cache
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
cache_dir ufs /var/squid-cache 2024 16 256
# Bei 1 GB flüchtigem Speicher
cache_mem 512 MB
cache_replacement_policy heap GDSF
memory_replacement_policy heap GDSF

### Logfiles
access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log
emulate_httpd_log on
log_fqdn on

### Hostfile
hosts_file /etc/hosts

###FTP
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320

### Access
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 # https
acl SSL_ports port 563 # snews
acl SSL_ports port 873 # rsync
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 631 # cups
acl Safe_ports port 873 # rsync
acl Safe_ports port 901 # SWAT
acl purge method PURGE
acl CONNECT method CONNECT

##############################################
# Zugriffe für GOInternet (Gruppe, die surfen darf)
##############################################

auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp --require-membership-of="Domäne\\GOinternet"  
auth_param ntlm children 10 #auth_param ntlm max_challenge_reuses 0 
#auth_param ntlm max_challenge_lifetime 2 minutes 
#auth_param ntlm use_ntlm_negotiate off auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic 
auth_param basic children 5 
auth_param basic realm Domain Proxy Server 
auth_param basic credentialsttl 2 hours 
auth_param basic casesensitive off 
authenticate_cache_garbage_interval 10 seconds 

# Credentials past their TTL are removed from memory 
authenticate_ttl 0 seconds 

#### Regeln für den Zugriff für alle Benutzer
acl AlleBenutzerIntra dstdomain .spitalbuelach.ch
acl AlleBenutzerGoogle dstdomain .google-analytics.com
acl AlleBenutzerKomp dstdomain .kompendium.ch
acl AlleBenutzerPsych dstdomain wdeg.itrust.de
acl AlleBenutzerSBB dstdomain .sbb.ch

#### Anwendung der Regel für alle Benutzer
http_access allow AlleBenutzerIntra
http_access allow AlleBenutzerGoogle
http_access allow AlleBenutzerKomp
http_access allow AlleBenutzerPsych
http_access allow AlleBenutzerSBB

acl lcl src ip.ad.re.ss/lan
acl auth proxy_auth REQUIRED 
http_access allow lcl auth 
http_access deny all 
miss_access allow all 
icp_access deny all 

##############################################
# Ende Zugriffe für GOInternet
##############################################

http_access allow manager localhost
http_access deny manager
# Only allow purge requests from localhost
http_access allow purge localhost
http_access deny purge
# Deny requests to unknown ports
http_access deny !Safe_ports
# Deny CONNECT to other than SSL ports
http_access deny CONNECT !SSL_ports
http_access deny all

ts-server003.domain.local - - [17/Jul/2009:15:48:05 +0200] "GET https://administrator.de/ HTTP/1.1" 407 1754 TCP_DENIED:NONE  

[2009/07/17 15:48:09, 0] utils/ntlm_auth.c:get_require_membership_sid(230)
  Could not parse TANK+allaccess into seperate domain/name parts!

auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp --require-membership-of="Domäne+Gruppe"</code  

die anderen sagen, dass dieser weg richtig ist:

auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp --require-membership-of="Domäne\\Gruppe"