Skripta Squid_db_auth:
#!/usr/bin/perl
# squid_db_auth.pl
# A basic squid authentication program
use strict;
use DBI;
use Getopt::Long;
use Pod::Usage;
use Digest::MD5 qw(md5 md5_hex md5_base64);
$|=1;
=pod
=head1 NAME
squid_db_auth - Database auth helper for Squid
=cut
my $dsn = "DBI:mysql:database=squid";
my $db_user = undef;
my $db_passwd = undef;
my $db_table = "passwd";
my $db_usercol = "user";
my $db_passwdcol = "password";
my $db_cond = "enabled = 1";
my $plaintext = 0;
my $md5 = 0;
my $persist = 0;
my $isjoomla = 0;
my $debug = 0;
my $hashsalt = undef;
=pod
=head1 SYNOPSIS
squid_db_auth [options]
=head1 DESCRIPTOIN
This program verifies username & password to a database
=over 8
=item B<--dsn>
Database DSN. Default "DBI:mysql:database=squid"
=item B<--user>
Database User
=item B<--password>
Database password
=item B<--table>
Database table. Default "passwd".
=item B<--usercol>
Username column. Default "user".
=item B<--passwdcol>
Password column. Default "password".
=item B<--cond>
Condition, defaults to enabled=1. Specify 1 or "" for no condition
If you use --joomla flag, this condition will be changed to block=0
=item B<--plaintext>
Database contains plain-text passwords
=item B<--md5>
Database contains unsalted md5 passwords
=item B<--salt>
Selects the correct salt to evaluate passwords
=item B<--persist>
Keep a persistent database connection open between queries.
=item B<--joomla>
Tells helper that user database is Joomla DB. So their unusual salt
hashing is understood.
=back
=cut
GetOptions(
'dsn=s' => \$dsn,
'user=s' => \$db_user,
'password=s' => \$db_passwd,
'table=s' => \$db_table,
'usercol=s' => \$db_usercol,
'passwdcol=s' => \$db_passwdcol,
'cond=s' => \$db_cond,
'plaintext' => \$plaintext,
'md5' => \$md5,
'persist' => \$persist,
'joomla' => \$isjoomla,
'debug' => \$debug,
'salt=s' => \$hashsalt,
);
my ($_dbh, $_sth);
$db_cond = "block = 0" if $isjoomla;
sub close_db()
{
return if !defined($_dbh);
undef $_sth;
$_dbh->disconnect();
undef $_dbh;
}
sub open_db()
{
return $_sth if defined $_sth;
$_dbh = DBI->connect($dsn, $db_user, $db_passwd);
if (!defined $_dbh) {
warn ("Could not connect to $dsn\n");
my @driver_names = DBI->available_drivers();
my $msg = "DSN drivers apparently installed, available:\n";
foreach my $dn (@driver_names) {
$msg .= "\t$dn";
}
warn($msg."\n");
return undef;
}
my $sql_query;
$sql_query = "SELECT $db_passwdcol FROM $db_table WHERE $db_usercol = ?" . ($db_cond ne "" ? " AND $db_cond" : "");
$_sth = $_dbh->prepare($sql_query) || die;
return $_sth;
}
sub check_password($$)
{
my ($password, $key) = @_;
if ($isjoomla){
my $salt;
my $key2;
($key2,$salt) = split (/:/, $key);
return 1 if md5_hex($password.$salt).':'.$salt eq $key;
}
else{
return 1 if defined $hashsalt && crypt($password, $hashsalt) eq $key;
return 1 if crypt($password, $key) eq $key;
return 1 if $md5 && md5_hex($password) eq $key;
return 1 if $plaintext && $password eq $key;
}
return 0;
}
sub query_db($) {
my ($user) = @_;
my ($sth) = open_db() || return undef;
if (!$sth->execute($user)) {
close_db();
open_db() || return undef;
$sth->execute($user) || return undef;;
}
return $sth;
}
my $status;
while (<>) {
my ($user, $password) = split;
$status = "ERR";
$user =~ s/%(..)/pack("H*", $1)/ge;
$password =~ s/%(..)/pack("H*", $1)/ge;
$status = "ERR database error";
my $sth = query_db($user) || next;
$status = "ERR unknown login";
my $row = $sth->fetchrow_arrayref() || next;
$status = "ERR login failure";
next if (!check_password($password, @$row[0]));
$status = "OK";
} continue {
close_db() if (!$persist);
print $status . "\n";
}
=pod
=head1 COPYRIGHT
Copyright (C) 2007 Henrik Nordstrom <[email protected]>
Copyright (C) 2010 Luis Daniel Lucio Quiroz <[email protected]> (Joomla support)
This program is free software. You may redistribute copies of it under the
terms of the GNU General Public License version 2, or (at youropinion) any
later version.
=cut
Sto znaci da skripta radi svoj posao.
Problem se desava kada korisnik pokusava da se uloguje. Prozor za autentifikaciju se pojavi ali ne pusta dalje prilikom unosa tacnog username-a i password-a. Reaguje kao da je uneto pogresno.
Konfiguracija je prosta, sluzi za testiranje:
#
# Recommended minimum configuration:
#
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
auth_param basic program /usr/lib/squid/squid_db_auth.pl -user someuser -password xxxx -plaintext -persist
auth_param basic casesensitive off
auth_param basic children 8
auth_param basic credentialsttl 1 hour
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
acl aaaa proxy_auth REQUIRED
#
# Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
acl db-auth proxy_auth REQUIRED
http_access allow db-auth
http_access allow localhost
http_access deny all
# Deny requests to certain unsafe ports
# Deny CONNECT to other than secure SSL ports
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
# And finally deny all other access to this proxy
# Squid normally listens to port 3128
http_port 8080
# We recommend you to use at least the following line.
hierarchy_stoplist cgi-bin ?
# Uncomment and adjust the following to add a disk cache directory.
# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
Da li se neko sretao sa ovakvim problemom?