{"id":89,"date":"2011-10-01T13:45:00","date_gmt":"2011-10-01T13:45:00","guid":{"rendered":"http:\/\/juliomonteiro.net\/?p=89"},"modified":"2018-02-14T13:46:19","modified_gmt":"2018-02-14T13:46:19","slug":"microsoft-faz-parceria-com-novell-2-2","status":"publish","type":"post","link":"https:\/\/juliomonteiro.net\/?p=89","title":{"rendered":"Instalação do Debian como Firewall e controle de acesso a internet- Autenticando Usuários no ad por Kerberos."},"content":{"rendered":"

O Orion \u00e9 um aplica\u00e7\u00e3o onde venho desenvolvendo varias fun\u00e7\u00f5es, tudo voltado para a seguran\u00e7a da Internet.<\/font><\/p>\n

Escrevo este Tutorial pois ser\u00e1 de muita utilidade para quem estiver afim de desenvolver seu conhecimento em Linux.<\/font><\/p>\n

Case tudo aqui eu consegui aprender no decorrer de 4 anos, onde venho estudando um pouco sobre Linux, e a cada dia me apaixono mais, pois ele me mostra um outro lado da TI.<\/font><\/p>\n

<\/font> <\/p>\n

Bom vamos l\u00e1.<\/font><\/p>\n

A primeira coisa a se fazer \u00e9 baixar a ultima vers\u00e3o do Debian que pode ser encontrado neste site.<\/font><\/p>\n

http:\/\/www.debian.org\/CD\/netinst\/<\/font><\/a><\/p>\n

Quando este procedimento foi postado a vers\u00e3o era debian-503.<\/font><\/p>\n

http:\/\/cdimage.debian.org\/debian-cd\/5.0.3\/i386\/iso-cd\/debian-503-i386-netinst.iso<\/font><\/a><\/p>\n

O Debian que utilizaremos ser\u00e1 o debian b\u00e1sico e depois iremos instalando os aplicativos de acordo <\/font><\/p>\n

com a necessidade.<\/font><\/p>\n

\"clip_image002\"<\/font><\/a><\/p>\n

\"clip_image002[4]\"<\/font><\/a>\"clip_image002[6]\"<\/font><\/a>\"clip_image002[8]\"<\/font><\/a>\"clip_image002[10]\"<\/font><\/a>\"clip_image002[12]\"<\/font><\/a><\/p>\n

\"clip_image002[14]\"<\/font><\/a>\"clip_image002[16]\"<\/font><\/a>\"clip_image002[18]\"<\/font><\/a>\"clip_image002[20]\"<\/font><\/a>\"clip_image002[22]\"<\/font><\/a><\/p>\n

<\/font> <\/p>\n

\"clip_image002[24]\"<\/font><\/a>\"clip_image002[26]\"<\/font><\/a>\"clip_image002[28]\"<\/font><\/a>\"clip_image002[30]\"<\/font><\/a>\"clip_image002[32]\"<\/font><\/a><\/p>\n

<\/font> <\/p>\n

\"clip_image002[34]\"<\/font><\/a>\"clip_image002[36]\"<\/font><\/a>\"clip_image002[38]\"<\/font><\/a>\"clip_image002[40]\"<\/font><\/a>\"clip_image002[42]\"<\/font><\/a><\/p>\n

<\/font><\/strong><\/p>\n

Passos necess\u00e1rios <\/font><\/strong><\/p>\n

Atualizando o Debian<\/font><\/u><\/b>
<\/strong>apt-get update
apt-get upgrade
apt-get dist-upgrade <\/font><\/p>\n

Instalando ssh
<\/strong>apt-get install ssh <\/font><\/p>\n

Aplicativos basicos necess\u00e1rios<\/strong>
apt-get install aptitude vim tcpdump nmap libncurses5-dev iptraf dhcpcd lshw elinks mc most arping ntpdate<\/font><\/p>\n

Deixando VIM Colorido
<\/strong>echo “syntax enable” > ~\/.vimrc <\/font><\/p>\n

Shell Colorido
<\/strong>vim \/root\/.bashrc <\/font><\/p>\n

Adicionar as seguintes linhas abaixo:<\/font><\/strong><\/em><\/p>\n

####### ~\/.bashrc: executed by bash(1) for non-login shells.
export PS1=’\\h:\\w\\$ ‘
umask 022<\/font><\/p>\n

# You may uncomment the following lines if you want `ls’ to be colorized:
export LS_OPTIONS=’–color=auto’
eval “`dircolors`”
alias ls=’ls $LS_OPTIONS’
alias l=’ls $LS_OPTIONS -lA’<\/font><\/p>\n

# Some more alias to avoid making mistakes:
alias rm=’rm -i’
alias cp=’cp -i’
alias mv=’mv -i’<\/font><\/p>\n

export MANPAGER=”\/usr\/bin\/most -s”
export HISTTIMEFORMAT=”%F %T “<\/font><\/p>\n

alias grep=’grep –color=auto’<\/font><\/p>\n

Instalando o Squid
<\/strong>aptitude install squid <\/font><\/p>\n

Criar pasta arquivos dentro de \/etc\/squid<\/strong> <\/font><\/p>\n

cd \/etc\/squid
mkdir arquivos
cd arquivos\/<\/font><\/p>\n

criar arquivos para acl <\/font><\/strong><\/p>\n

touch audio
touch bancos
touch comando
touch compactadores
touch downloads
touch entretenimento
touch esporte
touch execut\u00e1vel
touch governamental
touch imagem
touch messenger
touch pornografia
touch provedores
touch relacionamento
touch revistas
touch video
touch webmail<\/font><\/p>\n

BKP do squid.conf <\/font><\/strong><\/p>\n

cd \/etc\/squid
mkdir backup
cp squid.conf \/etc\/squid\/backup\/squid.conf.default<\/font><\/p>\n

Limpando Squid.conf <\/font><\/strong><\/p>\n

cd \/etc\/squid
cp squid.conf squid.conf.original
egrep -v “^#|^$” squid.conf.original > squid.conf <\/font><\/p>\n

<\/font> <\/p>\n

Configura\u00e7\u00e3o do Squid.conf com Autentica\u00e7\u00e3o no AD (2003\/2008)<\/font><\/strong><\/p>\n

<\/font><\/strong><\/p>\n

########## AUTENTICA\u00c7\u00c3O #####################<\/font><\/p>\n

auth_param ntlm program \/usr\/bin\/ntlm_auth –helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 10
auth_param basic program \/usr\/bin\/ntlm_auth –helper-protocol=squid-2.5-basic
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off
authenticate_cache_garbage_interval 10 seconds
authenticate_ttl 0 seconds<\/font><\/p>\n

###########################################<\/font><\/p>\n

refresh_pattern ^ftp:        1440    20%    10080
refresh_pattern ^gopher:    1440    0%    1440
refresh_pattern -i (\/cgi-bin\/|\\?) 0    0%    0
refresh_pattern (Release|Package(.gz)*)$    0    20%    2880
refresh_pattern .        0    20%    4320<\/font><\/p>\n

####ACL\u00b4S DEFAULT ############################<\/font><\/p>\n

acl all src all
acl manager proto cache_object
acl localhost src 127.0.0.1\/32
acl to_localhost dst 127.0.0.0\/8<\/font><\/p>\n

acl localnet src 192.168.11.0\/24<\/font><\/p>\n

acl SSL_ports port 443 # https
acl SSL_ports port 563 # snews
acl SSL_ports port 873 # rsync
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 631 # cups
acl Safe_ports port 873 # rsync
acl Safe_ports port 901 # SWAT
acl purge method PURGE
acl CONNECT method CONNECT<\/font><\/p>\n

########ACL\u00b4S DEFAULT #########################<\/font><\/p>\n

external_acl_type NT_global_group children=10 %LOGIN \/usr\/lib\/squid\/wbinfo_group.pl<\/font><\/p>\n

acl ProxyUsers external NT_global_group proxy_user   ——-> Grupo do Ad com permiss\u00e3o para autentica\u00e7\u00e3o no SQUID<\/font><\/p>\n

############### ACL\u00b4S  #######################<\/font><\/p>\n

acl diretoria proxy_auth “\/etc\/squid\/arquivos\/diretoria”
acl relacionamento url_regex “\/etc\/squid\/arquivos\/relacionamento”
acl sites_liberados url_regex “\/etc\/squid\/arquivos\/sites_liberados”
acl sites_bloqueados url_regex “\/etc\/squid\/arquivos\/sites_bloqueados”
acl palavras_negadas url_regex “\/etc\/squid\/arquivos\/palavras_negadas”
acl extensoes_liberadas url_regex “\/etc\/squid\/arquivos\/extensoes_liberadas”
acl extensoes_bloqueadas url_regex “\/etc\/squid\/arquivos\/extensoes_bloqueadas”
acl dominios_bloqueados dstdom_regex -i “\/etc\/squid\/arquivos\/dominios_bloqueados”
acl dominios_liberados dstdom_regex -i “\/etc\/squid\/arquivos\/dominios_liberados”
acl usuarios_bloqueados proxy_auth “\/etc\/squid\/arquivos\/usuarios_bloqueados”
acl porno url_regex “\/etc\/squid\/arquivos\/porno”<\/font><\/p>\n

########### RESTRI\u00c7\u00d5ES DE PROXY ######################<\/font><\/p>\n

http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access allow CONNECT
http_access allow !SSL_ports !Safe_ports
http_access allow localhost<\/font><\/p>\n

http_access allow diretoria
http_access allow sites_liberados
http_access allow extensoes_liberadas
http_access allow dominios_liberados
http_access deny relacionamento
http_access deny sites_bloqueados
http_access deny palavras_negadas
http_access deny extensoes_bloqueadas
http_access deny dominios_bloqueados
http_access deny usuarios_bloqueados
http_access deny porno
http_access allow ProxyUsers  ——>   ACL de usuario autenticados no AD
http_access deny all<\/font><\/p>\n

icp_access allow localnet
icp_access deny all<\/font><\/p>\n

###########################################################################<\/font><\/p>\n

access_log \/var\/log\/squid\/access.log squid
logfile_rotate 10
error_directory \/usr\/share\/squid\/errors\/Portuguese
hosts_file \/etc\/hosts
http_port 3128
coredump_dir \/var\/spool\/squid
visible_hostname plserver02
cache_mgr <\/font>suporte@contoso.com.br<\/font><\/a>
dns_nameservers 192.168.x.y  —–> Servidor de DNs da Rede <\/font><\/p>\n

Instalando o SAMBA
<\/strong>aptitude install samba samba-common winbind smbclient<\/font><\/p>\n

Configurando winbind<\/strong> <\/p>\n

vim \/etc\/init.d\/winbind
chgrp proxy \/var\/run\/samba\/winbindd_privileged\/ || return 1 <\/font><\/p>\n

Configura\u00e7\u00e3o do smb.conf<\/font><\/strong><\/p>\n

#============== Global Settings =====================
[global] 
    workgroup = CONTOSO 
    realm = CONTOSO.LOCAL
    netbios name = orion
    server string = Servidor Proxy
    dns proxy = no
    log file = \/var\/log\/samba\/log.%m
    max log size = 1000
    syslog = 0
    panic action = \/usr\/share\/samba\/panic-action %d
    security = ADS
    domain master = no
    idmap uid = 10000-20000
    idmap gid = 10000-20000
    template shell = \/bin\/bash
    template homedir = \/home\/%D\/%U
    winbind enum groups = yes
    winbind enum users = yes
    winbind use default domain = yes
    winbind separator = +
    usershare allow guests = yes <\/font><\/p>\n

#=======Share Definitions============================
[homes]
    comment = Home Directories
    browseable = no
    writeable = yes <\/font><\/p>\n

[printers]
    comment = All Printers
    path = \/var\/spool\/samba
    browseable = no
    printable = yes <\/font><\/p>\n

[Softwares]
    comment = Softwares Skylan
    writeable = yes
    create mode = 777
    path = \/x\/softwares
    directory mode = 777
    browseable = yes<\/font><\/p>\n

Instalando Kerberos<\/font><\/strong><\/p>\n

apt-get install krb5-user
apt-get install ldap-utils
apt-get install libldap-2.4-2 <\/font><\/p>\n

Coloque a infroma\u00e7\u00f5es corretas.<\/strong> 
Servidor de Kerberos para seu realm: CONTOSO.LOCAL                <\/strong><\/font><\/p>\n

Servidor administrativo para seu realm kerberos: CONTOSOSERVER<\/strong><\/font><\/p>\n

Configura\u00e7\u00f5es do krb5.conf (\/etc\/krb5.conf)<\/font><\/strong><\/p>\n

[libdefaults]
        default_realm = CONTOSO.LOCAL                <\/strong>
        dns_lookup_realm = false
        dns_lookup_kdc = true
        ticket_lifetime = 24000 <\/font><\/p>\n

[realms]
        SKYLAN.LOCAL = {
                kdc = contososerver01.contoso.local
                admin_server = contososerver01.contoso.local
                default_domain = CONTOSO.LOCAL
        } <\/font><\/p>\n

[domain_realm]
        .contoso.local = CONTOSO.LOCAL
        contoso.local = CONTOSO.LOCAL <\/font><\/p>\n

[logging]
        default = FILE:\/var\/log\/krb5.log
        kdc = FILE:\/var\/log\/krb5kdc.log
        admin_server = FILE:\/var\/log\/kadmin.log<\/font><\/p>\n

Configura\u00e7\u00f5es do nsswitch.conf (\/etc\/nsswitch.conf)<\/font><\/strong><\/p>\n

passwd:        compat <\/font>winbind
<\/strong>group:           compat <\/font>winbind
<\/strong>shadow:       compat winbind <\/strong><\/font><\/p>\n

hosts:          files dns
networks:       files <\/font><\/p>\n

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files<\/font><\/p>\n

<\/font><\/strong><\/p>\n

Atualizando relogio<\/font><\/strong><\/p>\n

ntpdate ntp.usp.br<\/font><\/p>\n

<\/font><\/strong><\/p>\n

Ingressando no Dom\u00ednio <\/font><\/strong><\/p>\n

kinit <\/font>administrador@CONTOSO.LOCAL<\/font><\/a><\/p>\n

net ads join \u2013U administrador<\/font><\/p>\n

net ads testjoin <\/font><\/p>\n

wbinfo \u2013t<\/font><\/p>\n

net ads user<\/font><\/p>\n

<\/font><\/strong><\/p>\n

Instalando o APACHE<\/strong>
apt-get install apache2 <\/font><\/p>\n

Instalando o MYSQL<\/strong>
apt-get install mysql-server mysql-client <\/font><\/p>\n

Instalando o PHP5
<\/strong>apt-get install php5 php5-sybase php5-symfony1.0 php5-tidy php5-uuid php5-xapian php5-xcache php5-xdebug php5-xmlrpc php5-xsl php5-mysql phpmyadmin <\/font><\/p>\n

<\/font> <\/p>\n

Criar pasta para downloads firewall e backups<\/font><\/strong><\/p>\n

cd ..
mkdir x
cd \/x
mkdir downloads
mkdir softwares
mkdir backups
mkdir firewall
chmod 777 firewall\/
cd downloads<\/font><\/p>\n

<\/font> <\/p>\n

Instalando MYSAR
<\/font><\/strong><\/p>\n

wget <\/font>http:\/\/ufpr.dl.sourceforge.net\/sourceforge\/mysar\/mysar-2.1.4.tar.gz<\/font><\/a>
tar zxvf mysar-2.1.4.tar.gz -C \/usr\/local
cd  \/usr\/local\/mysar <\/font><\/p>\n

Adicionar no \/etc\/apache2\/apache2.conf <\/font><\/strong><\/p>\n

vim \/etc\/apache2\/apache2.conf
———–>>>>    Alias \/mysar \/usr\/local\/mysar\/www <\/font><\/p>\n

               <Directory “\/usr\/local\/mysar\/www”>
        Options Indexes MultiViews
        AllowOverride None
        Order allow,deny
        Allow from all
        <\/Directory> <\/font> <\/p>\n

\/etc\/init.d\/mysql restart
\/etc\/init.d\/apache2 restart <\/font><\/p>\n

cd \/usr\/local\/mysar\/etc\/
cp config.ini.example config.ini
rm -rf \/usr\/local\/mysar\/www\/install
ln -s \/usr\/local\/mysar\/etc\/mysar.cron \/etc\/cron.d\/mysar <\/font><\/p>\n

<\/font><\/strong><\/p>\n

<\/font><\/strong><\/p>\n

Configurando o WEBMIN<\/strong>
<\/font><\/p>\n

Adicionar em \/etc\/apt\/sources.list
vim \/etc\/apt\/sources.list
deb <\/font>http:\/\/download.webmin.com\/download\/repository<\/font><\/a> sarge contrib
cd \/x\/downloads\/
wget <\/font>http:\/\/www.webmin.com\/jcameron-key.asc<\/font><\/a>
apt-key add jcameron-key.asc
apt-get update
apt-get install webmin<\/font><\/p>\n

<\/font><\/p>\n","protected":false},"excerpt":{"rendered":"

Saiba tudo sobre est\u00e1 parceria que est\u00e1 dando o que falar.<\/p>\n

http:\/\/www.moreinterop.com\/<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[9],"tags":[],"_links":{"self":[{"href":"https:\/\/juliomonteiro.net\/index.php?rest_route=\/wp\/v2\/posts\/89"}],"collection":[{"href":"https:\/\/juliomonteiro.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/juliomonteiro.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/juliomonteiro.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/juliomonteiro.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=89"}],"version-history":[{"count":1,"href":"https:\/\/juliomonteiro.net\/index.php?rest_route=\/wp\/v2\/posts\/89\/revisions"}],"predecessor-version":[{"id":90,"href":"https:\/\/juliomonteiro.net\/index.php?rest_route=\/wp\/v2\/posts\/89\/revisions\/90"}],"wp:attachment":[{"href":"https:\/\/juliomonteiro.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=89"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/juliomonteiro.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=89"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/juliomonteiro.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=89"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}