The solution might not be the most elegant, but it’s a working one. You’ll need to install the Kerberos, Samba, Squid and NTP packages.

In this solution will be allowing all users in the InternetOn AD group to have access automatically. Any users outside this group will be denied access. Computers outside the AD trying to use the proxy will be prompt for username and password.

krb5.conf

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = YOURDOMAIN
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = yes

[realms]
YOURDOMAIN = {
kdc = yourpdc
admin_server = yourpdc
default_domain = YOURDOMAIN
kpasswd_server = yourpdc
}

[domain_realm]
.yourdomain = yourdomain

[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf

[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}

#####################################################

smb.conf

[global]
workgroup = YOURDOMAIN
server string = SQUIDPROXY (or any other name you want)
security = ADS
auth methods = winbind
encrypt passwords = yes
idmap uid = 70001-90000
winbind enum users = yes
winbind gid = 70001-90000
winbind enum groups = yes
client use spnego = yes
winbind separator = \\
load printers = yes
cups options = raw
log file = /var/log/samba/%m.log
max log size = 50
password server = yourpdcIP
realm = YOURDOMAIN
dns proxy = no

[homes]
comment = Home Directories
browseable = no
writable = yes

[printers]
comment = All Printers
path = /usr/spool/samba
browseable = no
guest ok = no
writable = no
printable = yes

#####################################################

squid.conf

http_port 8080
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
hosts_file /etc/hosts
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
access_log /var/log/squid/access.log squid
emulate_httpd_log on

auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 5
auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours

external_acl_type ADS %LOGIN /usr/lib/squid/wbinfo_group.pl
acl interneton external ADS InternetOn

acl blocksites url_regex "/etc/squid/squid-block.acl"
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 563 # https, snews
acl SSL_ports port 873 # rsync
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # waisacl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 631 # cups
acl Safe_ports port 873 # rsync
acl Safe_ports port 901 # SWAT
acl purge method PURGE
acl CONNECT method CONNECT

acl AuthorizedUsers proxy_auth REQUIRED

http_access deny blocksites
http_access allow interneton
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access deny all
http_reply_access allow all
icp_access allow all
coredump_dir /var/spool/squid

#####################################################

Start samba, winbind and squid by this order.

Synchronize your squid server with the AD

ntpdate yourprimarydomaincontroller

Initialise Kerberos

kinit administrator@YOURDOMAIN

Test Kerberos connection

klist

Join Squid Server to AD

net ads join -S yourpdc -U administrator

Validate Trust

wbinfo -t

Validate if the wbinfo_group.pl script is working

echo "youralloweduser InternetOn" | /usr/lib/squid/wbinfo_group.pl -d
(it returns OK or ERR if the user is in the InternetOn group or not)

You might have some problems with the winbindd_privileged directory. If that’s the case:

cd /var/cache/samba
chgrp squid winbindd_privileged
chmod 750 winbindd_privileged

The problem with this setup is that when you change the InternetOn members, Samba / Winbind aren’t aware of the change until the cache clears, so I made a small script you can run in cron or manually.

clearcache.sh

#!/bin/bash
/etc/init.d/smb stop
/etc/init.d/winbind stop
rm -f /var/cache/samba/*.tdb
/etc/init.d/smb start
/etc/init.d/winbind start
/etc/init.d/squid reload

Test this at your own risk.

please explain why is my computer (added to not be mistaken with the router’s IP) LAN IP address showing on the email headers of the mails I send with Mail.app.

Thanks!

Bellow, in red, my computer’s private LAN IP Address. In green my Router’s Public/WAN IP address which is “normal” to be included on most email headers.

Return-Path: <rsaramago@gmail.com>
Received: from ?XX.XX.XX.XX? (pa6-XX-XX-XXX-XXX.netvisao.pt [XX.XX.XXX.XXX])
 by mx.google.com with ESMTPS id 7sm502355eyb.8.2009.11.13.01.07.07
 (version=TLSv1/SSLv3 cipher=RC4-MD5);
 Fri, 13 Nov 2009 01:07:08 -0800 (PST)
Subject: Teste
Mime-Version: 1.0 (Apple Message framework v1077)
Content-Type: multipart/alternative; boundary=Apple-Mail-1-623152288
From: Ricardo Saramago <rsaramago@gmail.com>
To: Testy McTest <test@test.pt>
X-Mailer: Apple Mail (2.1077)

Update: I’ve clarified some descriptions above after some user comments, I realized that It wasn’t clear what IPs I was referring to.

It seems that this is common on most email clients, except for Outlook. This “issue” triggered my attention when I was looking into the mail headers from a mail I sent from Mail.app in response to a mail from Outlook and they were indeed different in this aspect.

The client’s computer Local IP address and the Router’s / Firewall / Modem / whatever public IP address are added by the SMTP Server to the Envelop’s “Received” line, which it probably gets from the EHLO.

Still, this isn’t secure as it allows malicious attackers to map a victims network very easy.

JoikuSpot is a free mobile software solution that turns Nokia Smartphones to WLAN HotSpots.

JoikuSpot software is installed directly to the phone. When switched on, laptops and ipods can establish instant and fast wireless internet connection via smartphone’s JoikuSpot access point using phone’s own 3G internet connection.

Multiple devices can connect to JoikuSpot in parallel and seamlessly share the same 3G internet connection. JoikuSpot acts thus as an internet gateway to external WLAN devices.

Useful isn’t it?

Little Snitch is a Mac OS X app that runs in the background and hooks with the kernel. As the name indicates, Little Snitch warns you when an application tries to make a network connection, asking you to decide if you allow, deny or add a permanent rule for that specific app in future connections.

A good amount of information on the connection being made is presented to the user, and on version 2 (still in beta), besides the improved network filtering, a visual Network Monitor has been implemented, allowing the user to have real time access to the connections as well as some some send / receive icons like Zone Labs’ Zone Alarm. The configuration interface has suffered some changes and it’s now more functional and user friendly than the previous version.

[tags]Little Snitch, Security, Networking, Mac OS X[/tags]

I’ve googled it and came and found nothing… Does anyone know who’s using this?

[tags]JACK-O`-LANTERN, User Agent, Browser, Search Engine, Crawlers[/tags]

This how to covers Ubuntu 6.06 Server (yes the server version of Ubuntu duh!) but it’s preety simple to adapt to other distros. Let’s start!

Be warned that you may loose some email messages in the process so test this first with a dummy account!

Assuming you have Ubuntu installed and updated, open a shell and type:

mkdir Maildir (create this on your home folder)

sudo apt-get install dovecot

Let it install all the packages need for dependecies.

Dovecot is an open source IMAP and POP3 server, is very simple to install / configure and suports the Maildir format which is a standard and the one we’re going to use. Dovecot is very complete and has several options, most of them related to security, I’m not covering those so feel free to explore.

So, back to the shell and enter:

sudo nano /etc/dovecot/dovecot.conf

Now change the following:

# Protocols we want to be serving:
# imap imaps pop3 pop3s
#protocols = imap imaps
#protocols = imap imaps

to

# Protocols we want to be serving:
# imap imaps pop3 pop3s
#protocols = imap imaps
protocols = imap imaps

Save the file and run dovecot:

sudo /usr/sbin/dovecot

And now test your IMAP Server:

mutt -f imap://yourusername@localhost

You should get a little nagging about the certificates but after that you enter your password and you should be able to see your empty IMAP folder.

Now the next part is to get the email from the other accounts and for this we’re using a little app named Getmail. Getmail can check your POP and IMAP accounts, I’ll cover only the POP accounts but there’s some examples you can check. Getmail also features some very usefull mail sorting options you can check later.

So, if you’re using Ubuntu 6.06 “normal” then you should be able to download Getmail via apt-get:

sudo apt-get install getmail

If you’re using the Ubuntu server version you won’t get this package via apt-get unless you add the right repository or download the package and install it manually:

wget http://archive.ubuntu.com/ubuntu/pool/universe/g/getmail4/getmail4_4.4.3-1_all.deb

dpkg -i getmail4_4.4.3-1_all.deb

Now comes the lame part

You’ll have to write a little configuration file for each of the POP / IMAP accounts you want to check. I’m going to give you an example for a regular POP account and for a GMAIL account.

Again, back to the shell and type:

cd
cd .getmail
touch gmailrc
sudo nano gmailrc

The configuration file for a GMAIL account:

[retriever]
type = SimplePOP3SSLRetriever
server = pop.gmail.com
port = 995
username = yourusername@gmail.com
password = yourpassword

[options]
delete = true

Save it and repeat the process for a regular POP account:

touch ispmailrc
sudo nano ispmailrc

[options]
delete = true

Save and test it:

sudo /usr/bin/getmail --rcfile=gmailrc

If all goes well you’ll get a few messages like this:

getmail version 4.4.3
Copyright (C) 1998-2005 Charles Cazabon. Licensed under the GNU GPL version 2.
SimplePOP3SSLRetriever:username@gmail.com@pop.gmail.com:995:
0 messages retrieved, 0 skipped

This means Getmail is working, now send yourself some messages to your accounts to test it and run getmail again to check if it delivers to your IMAP folders. You can check it using Mutt like we did earlier.

By now everything should be working perfectly, we just have to automate the email checking. Let’s use crontab. Go to the shell and enter:

crontab -e

Now copy this line and save the file:

* * * * * /usr/bin/getmail --rcfile=gmailrc --rcfile=ispmailrc >> /dev/null 2>&1

(this has to be all in one line, don’t break it or it won’t work correctly!)

And we’re done! Now use an IMAP compatible client like Mozilla Thunderbir or Evolution and you’ll never have to worry with email again.

[tags]IMAP, POP, E-Mail, Email, GMail, Personal Mail Server, Linux, Ubuntu, Ubuntu Server, Getmail, Dovecot[/tags]

- First of all install Automatix, this script will install the NDISWrapper and Gnome NetworkManager packages need to simplify the process.

- If you do a ifconfig you’ll probably see your wireless card listed as eth2, this will change later to wlan0.

- Make sure you have the NDISWrapper installed doing ndiswrapper on a terminal window. If you get a “command not found” error then something went wrong with Automatix, make sure you check the wreless networking packages. If you get an error response from the NDISWrapper that’s fine, it means you have it installed.

- This is one of the most important steps. Ubuntu loads the Prism54 kernel module, but this conflicts with the NDISWrapper, so you’ll have to sudo rmmod prism54 and then sudo gedit /etc/modprobe.d/blacklist and add the line blacklist prism54 to the file and save.

- Reboot.

- Now, download the SMC 2835 Windows XP drivers, unpack and install with Windows Wireless Drivers (System > Administration > Windows Wireless Drivers and then Install New Driver).

- By now your Wireless NIC should be listed as Wlan0 on ifconfig.

- You should have the Gnome NetworkManager applet on the Gnome panel near the clock, click it and choose “Connect to Other Wireless Network” and you’ll see WEP and WPA options. Just enter your Wireless Network SSID and password and you’re done.

You can probably adapt this mini tutorial to another wireless nic so let me know if this works with you.

[tags]Linux, Ubuntu, Dapper, Wireless, SMC, SMC 2835, NDISWrapper, Automatix, Gnome[/tags]

Now everything seems to be working fine, but I decided to catch up on some reading to refresh my knowledge on DNS. I found a very nice link collection on Linux Journal, check it out.

The Open Source version of DNS

OpenNIC: Democratic Name System DNS

Tutorials, Tips and Tricks, HowTo and other Articles

DNS Concepts

DNS HOWTO

DNS tricks and tips

DNS for Rocket Scientists

Internet Domain Name Structure

Domain Name System

Men & Mice – DNS Resources

Setting Up Your New Domain Mini-HOWTO

How to Use Domain-Based Blacklist Zones

Bind and Dnsmasq

freshmeat.net: Project details for Dnsmasq

Configuring BIND with Webmin – RimuHosting

BIND 9 Administrator Reference Manual

Berkeley Internet Name Domain (BIND)

Free DNS hosting

The Public DNS Service

List of free DNS hosting sites

Another list of free DNS hosting sites

Setting up Dynamic DNS at Home

How To Set Static and Dynamic DNS for Your ISP

Free Dynamic and Static DNS

Dynamic Network Services

Online Tools for the Beginner to play with

DNS, Network and other tools.

Expired Domain Name Search

E-Mail relay, DNS, Network and other tools

[tags]DNS, BIND, Dnsmasq, Zones, Domains, Networking[/tags]

The ‘Nyxem.e’ is a mass-mailing worm that also tries to spread using remote shares. It also tries to disable security-related and file sharing software as well as destroys files of certain types. It is similar to the ‘Email-Worm.Win32.VB.bi’ that was found a few days ago.

The worm’s destructive payload is activated on every third day of the month and replaces the content of user’s files with a text string “DATA Error [47 0F 94 93 F4 K5]“. Among these files are: DOC, XLS, MDB, MDE, PPT, PPS, ZIP, RAR, PDF, PSD and DMP.

You can get more info on Nyxem.E here.

[tags]Nyxem.E, virus, trojan, worm, DATA Error [47 0F 94 93 F4 K5][/tags]

Speaking about Linux, In my daily basis I’ve been blessed to work with Window$ at full time. Sometimes I have to retrieve and edit information from several text files and logs in order to troubleshoot problems that occurr. Not having a single Linux box in our network (except the proxy), I was in need to find utilities like tail, grep and other gnu/linux utils that worked in win32. I could install Cygwin, but I rather have something native instead of an emulated environment, so I installed UnxUtils – native Win32 ports of the GNU utilities I was looking for. It works like a charm!

Other app that I call essential is UltraEdit 32. Although it’s paid software, UltraEdit has great feautures.

Skipping to another topic: Reading.

I would like to share with you two excelent pieces of tech literature. One is a free book on Asterisk provided by OReilly , the other is a tutorial on Subnets.

[tags]Linux, Windows, GNU, grep, tail, Cygnwin, UltraEdit32, Asterisk, Subnet[/tags]