You've promised the skeptical Abmas Snack Foods management team that you can show them how Samba can ease itself and other Open Source technologies into their existing infrastructure and deliver sound business advantages. Cost cutting is high on their agenda (a major promise of the acquisition). You have chosen Web proxying and caching as your proving ground.

Abmas Snack Foods has several thousand users housed at its head office and multiple regional offices, plants, and warehouses. A high proportion of the business's work is done online, so Internet access for most of these users is essential. All Internet access, including for all regional offices, is funneled through the head office and is the job of the (now your) networking team. The bandwidth requirements were horrific (comparable to a small ISP), and the team soon discovered proxying and caching. In fact, they became one of the earliest commercial users of Microsoft ISA.

The team is not happy with ISA. Because it never lived up to its marketing promises, it underperformed and had reliability problems. You have pounced on the opportunity to show what Open Source can do. The one thing they do like, however, is ISA's integration with Active Directory. They like that their users, once logged on, are automatically authenticated against the proxy. If your alternative to ISA can operate completely seamlessly in their Active Directory domain, it will be approved.

This is a hands-on exercise. You build software applications so that you obtain the functionality Abmas needs.

Functionally, the user's Internet Explorer requests a browsing session with the Squid proxy, for which it offers its AD authentication token. Squid hands off the authentication request to the Samba-3 authentication helper application called ntlm_auth. This helper is a hook into winbind, the Samba-3 NTLM authentication daemon. Winbind enables UNIX services to authenticate against Microsoft Windows domains, including Active Directory domains. As Active Directory authentication is a modified Kerberos authentication, winbind is assisted in this by local Kerberos 5 libraries configured to check passwords with the Active Directory server. Once the token has been checked, a browsing session is established. This process is entirely transparent and seamless to the user.

Enabling this consists of:

You are a stranger in a strange land, and all eyes are upon you. Some would even like to see you fail. For you to gain the trust of your newly acquired IT people, it is essential that your solution does everything the old one did, but does it better in every way. Only then will the entrenched positions consider taking up your new way of doing things on a wider scale.

If Samba and/or Squid RPMs are installed, they should be updated. You can build both from source.

Locating the packages to be un-installed can be achieved by running:

root#  rpm -qa | grep -i samba
root#  rpm -qa | grep -i squid

The identified packages may be removed using:

root#  rpm -e samba-common

[libdefaults]
	default_realm = LONDON.ABMAS.BIZ

[realms] 
	LONDON.ABMAS.BIZ = {
	kdc = w2k3s.london.abmas.biz
	}

root#  klist -e 

passwd: files winbind
shadow: files
group: files winbind

	cache_effective_user squid
	cache_effective_group squid

	auth_param ntlm program /usr/bin/ntlm_auth \
                                --helper-protocol=squid-2.5-ntlmssp
	auth_param ntlm children 5
	auth_param ntlm max_challenge_reuses 0
	auth_param ntlm max_challenge_lifetime 2 minutes
	auth_param basic program /usr/bin/ntlm_auth \
                                --helper-protocol=squid-2.5-basic
	auth_param basic children 5
	auth_param basic realm Squid proxy-caching web server
	auth_param basic credentialsttl 2 hours
	acl AuthorizedUsers proxy_auth REQUIRED
	http_access allow all AuthorizedUsers

Microsoft Windows networking protocols permeate the spectrum of technologies that Microsoft Windows clients use, even when accessing traditional services such as Web browsers. Depending on whom you discuss this with, this is either good or bad. No matter how you might evaluate this, the use of NTLMSSP as the authentication protocol for Web proxy access has some advantages over the cookie-based authentication regime used by all competing browsers. It is Samba's implementation of NTLMSSP that makes it attractive to implement the solution that has been demonstrated in this chapter.