From 0f8251fe64dd8d799713e0f42cc01785f5ce2bc9 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Peter=20M=C3=BCller?= Date: Sun, 21 Jun 2020 10:57:29 +0000 Subject: [PATCH] Revert "proxy: Remove AUTH_IPCACHE_TTL" MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit This reverts commit dc637f087fe07ab26ae1dee00133da69bab5e6a1. Rationale: "authenticate_ip_ttl" can be safely used as it does not introduces an authentication bypass, but saves relationships between successfully authenticated users and their IP addresses. "max_user_ip" depends on such an authentication cache, so credential sharing between several IPs (on purpose or by chance) can be detected properly. This is useful in case of crompromised machines and/or attackers in internal networks having stolen proxy authentication credentials. Quoted from squid.conf.documented or man 5 squid.conf: > acl aclname max_user_ip [-s] number > # This will be matched when the user attempts to log in from more > # than different ip addresses. The authenticate_ip_ttl > # parameter controls the timeout on the ip entries. [fast] > # If -s is specified the limit is strict, denying browsing > # from any further IP addresses until the ttl has expired. Without > # -s Squid will just annoy the user by "randomly" denying requests. > # (the counter is reset each time the limit is reached and a > # request is denied) > # NOTE: in acceleration mode or where there is mesh of child proxies, > # clients may appear to come from multiple addresses if they are > # going through proxy farms, so a limit of 1 may cause user problems. Fixes: #11994 Cc: Michael Tremer Signed-off-by: Peter Müller Signed-off-by: Arne Fitzenreiter --- doc/language_issues.de | 3 --- doc/language_issues.en | 2 ++ doc/language_issues.es | 7 ++----- doc/language_issues.fr | 3 --- doc/language_issues.it | 3 --- doc/language_issues.nl | 3 --- doc/language_issues.pl | 7 ++----- doc/language_issues.ru | 5 +---- doc/language_issues.tr | 3 --- html/cgi-bin/proxy.cgi | 28 +++++++++++++++++++--------- 10 files changed, 26 insertions(+), 38 deletions(-) diff --git a/doc/language_issues.de b/doc/language_issues.de index 2dc986d0a3..f2d628d51b 100644 --- a/doc/language_issues.de +++ b/doc/language_issues.de @@ -48,7 +48,6 @@ WARNING: translation string unused: admin user password has been changed WARNING: translation string unused: administrator user password WARNING: translation string unused: adsl settings WARNING: translation string unused: advproxy AUTH method ntlm -WARNING: translation string unused: advproxy AUTH user IP cache TTL WARNING: translation string unused: advproxy LDAP auth WARNING: translation string unused: advproxy NTLM BDC hostname WARNING: translation string unused: advproxy NTLM PDC hostname @@ -73,8 +72,6 @@ WARNING: translation string unused: advproxy chgwebpwd new password WARNING: translation string unused: advproxy chgwebpwd new password confirm WARNING: translation string unused: advproxy chgwebpwd old password WARNING: translation string unused: advproxy chgwebpwd username -WARNING: translation string unused: advproxy content based throttling -WARNING: translation string unused: advproxy errmsg auth ipcache ttl WARNING: translation string unused: advproxy errmsg change fail WARNING: translation string unused: advproxy errmsg change success WARNING: translation string unused: advproxy errmsg invalid bdc diff --git a/doc/language_issues.en b/doc/language_issues.en index 88fa6ed792..76c4237d48 100644 --- a/doc/language_issues.en +++ b/doc/language_issues.en @@ -128,6 +128,7 @@ WARNING: untranslated string: advproxy AUTH method radius = RADIUS WARNING: untranslated string: advproxy AUTH no auth = Domains without authentication (one per line) WARNING: untranslated string: advproxy AUTH number of auth processes = Number of authentication processes WARNING: untranslated string: advproxy AUTH realm = Authentication realm prompt +WARNING: untranslated string: advproxy AUTH user IP cache TTL = User/IP cache TTL (in minutes) WARNING: untranslated string: advproxy IDENT authorized users = Authorized users (one per line) WARNING: untranslated string: advproxy IDENT aware hosts = Ident aware hosts (one per line) WARNING: untranslated string: advproxy IDENT identd settings = Common identd settings @@ -206,6 +207,7 @@ WARNING: untranslated string: advproxy errmsg acl cannot be empty = Access contr WARNING: untranslated string: advproxy errmsg auth cache ttl = Invalid value for authentication cache TTL WARNING: untranslated string: advproxy errmsg auth children = Invalid number of authentication processes WARNING: untranslated string: advproxy errmsg auth ipcache may not be null = Authentication cache TTL may not be 0 when using IP address limits +WARNING: untranslated string: advproxy errmsg auth ipcache ttl = Invalid value for user/IP cache TTL WARNING: untranslated string: advproxy errmsg cache = The RAM cache size is greater than the harddisk cache size: WARNING: untranslated string: advproxy errmsg hdd cache size = Invalid value for harddisk cache size (min 10 MB required) WARNING: untranslated string: advproxy errmsg ident timeout = Invalid ident timeout diff --git a/doc/language_issues.es b/doc/language_issues.es index ef78d6680d..4d74fe91ba 100644 --- a/doc/language_issues.es +++ b/doc/language_issues.es @@ -24,7 +24,6 @@ WARNING: translation string unused: add xtaccess WARNING: translation string unused: add-route WARNING: translation string unused: admin user password has been changed WARNING: translation string unused: administrator user password -WARNING: translation string unused: advproxy AUTH user IP cache TTL WARNING: translation string unused: advproxy LDAP auth WARNING: translation string unused: advproxy NTLM BDC hostname WARNING: translation string unused: advproxy NTLM PDC hostname @@ -49,8 +48,6 @@ WARNING: translation string unused: advproxy chgwebpwd new password WARNING: translation string unused: advproxy chgwebpwd new password confirm WARNING: translation string unused: advproxy chgwebpwd old password WARNING: translation string unused: advproxy chgwebpwd username -WARNING: translation string unused: advproxy content based throttling -WARNING: translation string unused: advproxy errmsg auth ipcache ttl WARNING: translation string unused: advproxy errmsg change fail WARNING: translation string unused: advproxy errmsg change success WARNING: translation string unused: advproxy errmsg invalid bdc @@ -900,7 +897,7 @@ WARNING: untranslated string: fireinfo please enable = Please enable the fireinf WARNING: untranslated string: fireinfo settings = Fireinfo settings WARNING: untranslated string: fireinfo system version = System versions WARNING: untranslated string: fireinfo why descr1 = It is very important for the development of IPFire that you enable this -WARNING: untranslated string: fireinfo why descr2 = service. +WARNING: untranslated string: fireinfo why descr2 = service. WARNING: untranslated string: fireinfo why enable = Why should I enable fireinfo? WARNING: untranslated string: fireinfo why read more = Read more about the reasons. WARNING: untranslated string: fireinfo your profile id = Your profile ID @@ -958,7 +955,7 @@ WARNING: untranslated string: fwdfw err tgt_port = Invalid destination port. WARNING: untranslated string: fwdfw err time = You have to select at least one day. WARNING: untranslated string: fwdfw external port nat = External port (NAT) WARNING: untranslated string: fwdfw hint ip1 = The last generated rule may never match, because source and destination subnets may overlap. -WARNING: untranslated string: fwdfw hint ip2 = Please double-check if this rule makes sense: +WARNING: untranslated string: fwdfw hint ip2 = Please double-check if this rule makes sense: WARNING: untranslated string: fwdfw hint mac = The destination group contains MAC addresses, which will be skipped during rule creation. WARNING: untranslated string: fwdfw iface = Interface WARNING: untranslated string: fwdfw limitconcon = Limit concurrent connections per IP address diff --git a/doc/language_issues.fr b/doc/language_issues.fr index fd10b171e9..c5953d5bac 100644 --- a/doc/language_issues.fr +++ b/doc/language_issues.fr @@ -52,7 +52,6 @@ WARNING: translation string unused: admin user password has been changed WARNING: translation string unused: administrator user password WARNING: translation string unused: adsl settings WARNING: translation string unused: advproxy AUTH method ntlm -WARNING: translation string unused: advproxy AUTH user IP cache TTL WARNING: translation string unused: advproxy LDAP auth WARNING: translation string unused: advproxy NTLM BDC hostname WARNING: translation string unused: advproxy NTLM PDC hostname @@ -77,8 +76,6 @@ WARNING: translation string unused: advproxy chgwebpwd new password WARNING: translation string unused: advproxy chgwebpwd new password confirm WARNING: translation string unused: advproxy chgwebpwd old password WARNING: translation string unused: advproxy chgwebpwd username -WARNING: translation string unused: advproxy content based throttling -WARNING: translation string unused: advproxy errmsg auth ipcache ttl WARNING: translation string unused: advproxy errmsg change fail WARNING: translation string unused: advproxy errmsg change success WARNING: translation string unused: advproxy errmsg invalid bdc diff --git a/doc/language_issues.it b/doc/language_issues.it index 16ff776b52..059c73a59a 100644 --- a/doc/language_issues.it +++ b/doc/language_issues.it @@ -26,7 +26,6 @@ WARNING: translation string unused: add-route WARNING: translation string unused: admin user password has been changed WARNING: translation string unused: administrator user password WARNING: translation string unused: advproxy AUTH method ntlm -WARNING: translation string unused: advproxy AUTH user IP cache TTL WARNING: translation string unused: advproxy LDAP auth WARNING: translation string unused: advproxy NTLM BDC hostname WARNING: translation string unused: advproxy NTLM PDC hostname @@ -51,8 +50,6 @@ WARNING: translation string unused: advproxy chgwebpwd new password WARNING: translation string unused: advproxy chgwebpwd new password confirm WARNING: translation string unused: advproxy chgwebpwd old password WARNING: translation string unused: advproxy chgwebpwd username -WARNING: translation string unused: advproxy content based throttling -WARNING: translation string unused: advproxy errmsg auth ipcache ttl WARNING: translation string unused: advproxy errmsg change fail WARNING: translation string unused: advproxy errmsg change success WARNING: translation string unused: advproxy errmsg invalid bdc diff --git a/doc/language_issues.nl b/doc/language_issues.nl index 328a8e1f25..8a79baa832 100644 --- a/doc/language_issues.nl +++ b/doc/language_issues.nl @@ -25,7 +25,6 @@ WARNING: translation string unused: add xtaccess WARNING: translation string unused: add-route WARNING: translation string unused: admin user password has been changed WARNING: translation string unused: administrator user password -WARNING: translation string unused: advproxy AUTH user IP cache TTL WARNING: translation string unused: advproxy LDAP auth WARNING: translation string unused: advproxy NTLM BDC hostname WARNING: translation string unused: advproxy NTLM PDC hostname @@ -50,8 +49,6 @@ WARNING: translation string unused: advproxy chgwebpwd new password WARNING: translation string unused: advproxy chgwebpwd new password confirm WARNING: translation string unused: advproxy chgwebpwd old password WARNING: translation string unused: advproxy chgwebpwd username -WARNING: translation string unused: advproxy content based throttling -WARNING: translation string unused: advproxy errmsg auth ipcache ttl WARNING: translation string unused: advproxy errmsg change fail WARNING: translation string unused: advproxy errmsg change success WARNING: translation string unused: advproxy errmsg invalid bdc diff --git a/doc/language_issues.pl b/doc/language_issues.pl index ef78d6680d..4d74fe91ba 100644 --- a/doc/language_issues.pl +++ b/doc/language_issues.pl @@ -24,7 +24,6 @@ WARNING: translation string unused: add xtaccess WARNING: translation string unused: add-route WARNING: translation string unused: admin user password has been changed WARNING: translation string unused: administrator user password -WARNING: translation string unused: advproxy AUTH user IP cache TTL WARNING: translation string unused: advproxy LDAP auth WARNING: translation string unused: advproxy NTLM BDC hostname WARNING: translation string unused: advproxy NTLM PDC hostname @@ -49,8 +48,6 @@ WARNING: translation string unused: advproxy chgwebpwd new password WARNING: translation string unused: advproxy chgwebpwd new password confirm WARNING: translation string unused: advproxy chgwebpwd old password WARNING: translation string unused: advproxy chgwebpwd username -WARNING: translation string unused: advproxy content based throttling -WARNING: translation string unused: advproxy errmsg auth ipcache ttl WARNING: translation string unused: advproxy errmsg change fail WARNING: translation string unused: advproxy errmsg change success WARNING: translation string unused: advproxy errmsg invalid bdc @@ -900,7 +897,7 @@ WARNING: untranslated string: fireinfo please enable = Please enable the fireinf WARNING: untranslated string: fireinfo settings = Fireinfo settings WARNING: untranslated string: fireinfo system version = System versions WARNING: untranslated string: fireinfo why descr1 = It is very important for the development of IPFire that you enable this -WARNING: untranslated string: fireinfo why descr2 = service. +WARNING: untranslated string: fireinfo why descr2 = service. WARNING: untranslated string: fireinfo why enable = Why should I enable fireinfo? WARNING: untranslated string: fireinfo why read more = Read more about the reasons. WARNING: untranslated string: fireinfo your profile id = Your profile ID @@ -958,7 +955,7 @@ WARNING: untranslated string: fwdfw err tgt_port = Invalid destination port. WARNING: untranslated string: fwdfw err time = You have to select at least one day. WARNING: untranslated string: fwdfw external port nat = External port (NAT) WARNING: untranslated string: fwdfw hint ip1 = The last generated rule may never match, because source and destination subnets may overlap. -WARNING: untranslated string: fwdfw hint ip2 = Please double-check if this rule makes sense: +WARNING: untranslated string: fwdfw hint ip2 = Please double-check if this rule makes sense: WARNING: untranslated string: fwdfw hint mac = The destination group contains MAC addresses, which will be skipped during rule creation. WARNING: untranslated string: fwdfw iface = Interface WARNING: untranslated string: fwdfw limitconcon = Limit concurrent connections per IP address diff --git a/doc/language_issues.ru b/doc/language_issues.ru index 0a579d4063..d435f04373 100644 --- a/doc/language_issues.ru +++ b/doc/language_issues.ru @@ -25,7 +25,6 @@ WARNING: translation string unused: add xtaccess WARNING: translation string unused: add-route WARNING: translation string unused: admin user password has been changed WARNING: translation string unused: administrator user password -WARNING: translation string unused: advproxy AUTH user IP cache TTL WARNING: translation string unused: advproxy LDAP auth WARNING: translation string unused: advproxy NTLM BDC hostname WARNING: translation string unused: advproxy NTLM PDC hostname @@ -50,8 +49,6 @@ WARNING: translation string unused: advproxy chgwebpwd new password WARNING: translation string unused: advproxy chgwebpwd new password confirm WARNING: translation string unused: advproxy chgwebpwd old password WARNING: translation string unused: advproxy chgwebpwd username -WARNING: translation string unused: advproxy content based throttling -WARNING: translation string unused: advproxy errmsg auth ipcache ttl WARNING: translation string unused: advproxy errmsg change fail WARNING: translation string unused: advproxy errmsg change success WARNING: translation string unused: advproxy errmsg invalid bdc @@ -952,7 +949,7 @@ WARNING: untranslated string: fwdfw err tgt_port = Invalid destination port. WARNING: untranslated string: fwdfw err time = You have to select at least one day. WARNING: untranslated string: fwdfw external port nat = External port (NAT) WARNING: untranslated string: fwdfw hint ip1 = The last generated rule may never match, because source and destination subnets may overlap. -WARNING: untranslated string: fwdfw hint ip2 = Please double-check if this rule makes sense: +WARNING: untranslated string: fwdfw hint ip2 = Please double-check if this rule makes sense: WARNING: untranslated string: fwdfw hint mac = The destination group contains MAC addresses, which will be skipped during rule creation. WARNING: untranslated string: fwdfw iface = Interface WARNING: untranslated string: fwdfw limitconcon = Limit concurrent connections per IP address diff --git a/doc/language_issues.tr b/doc/language_issues.tr index d04c993052..d4cbbac2d3 100644 --- a/doc/language_issues.tr +++ b/doc/language_issues.tr @@ -48,7 +48,6 @@ WARNING: translation string unused: admin user password has been changed WARNING: translation string unused: administrator user password WARNING: translation string unused: adsl settings WARNING: translation string unused: advproxy AUTH method ntlm -WARNING: translation string unused: advproxy AUTH user IP cache TTL WARNING: translation string unused: advproxy LDAP auth WARNING: translation string unused: advproxy NTLM BDC hostname WARNING: translation string unused: advproxy NTLM PDC hostname @@ -73,8 +72,6 @@ WARNING: translation string unused: advproxy chgwebpwd new password WARNING: translation string unused: advproxy chgwebpwd new password confirm WARNING: translation string unused: advproxy chgwebpwd old password WARNING: translation string unused: advproxy chgwebpwd username -WARNING: translation string unused: advproxy content based throttling -WARNING: translation string unused: advproxy errmsg auth ipcache ttl WARNING: translation string unused: advproxy errmsg change fail WARNING: translation string unused: advproxy errmsg change success WARNING: translation string unused: advproxy errmsg invalid bdc diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi index d1de4522d8..fdf9bddaf1 100644 --- a/html/cgi-bin/proxy.cgi +++ b/html/cgi-bin/proxy.cgi @@ -232,6 +232,7 @@ $proxysettings{'AUTH_METHOD'} = 'none'; $proxysettings{'AUTH_REALM'} = ''; $proxysettings{'AUTH_MAX_USERIP'} = ''; $proxysettings{'AUTH_CACHE_TTL'} = '60'; +$proxysettings{'AUTH_IPCACHE_TTL'} = '0'; $proxysettings{'AUTH_CHILDREN'} = '5'; $proxysettings{'NCSA_MIN_PASS_LEN'} = '6'; $proxysettings{'NCSA_BYPASS_REDIR'} = 'off'; @@ -437,18 +438,23 @@ if (($proxysettings{'ACTION'} eq $Lang::tr{'save'}) || ($proxysettings{'ACTION'} } } } + if ((!($proxysettings{'AUTH_MAX_USERIP'} eq '')) && + ((!($proxysettings{'AUTH_MAX_USERIP'} =~ /^\d+/)) || ($proxysettings{'AUTH_MAX_USERIP'} < 1) || ($proxysettings{'AUTH_MAX_USERIP'} > 255))) + { + $errormessage = $Lang::tr{'advproxy errmsg max userip'}; + goto ERROR; + } if (!($proxysettings{'AUTH_CACHE_TTL'} =~ /^\d+/)) { $errormessage = $Lang::tr{'advproxy errmsg auth cache ttl'}; goto ERROR; } - if ((!($proxysettings{'AUTH_MAX_USERIP'} eq '')) && - ((!($proxysettings{'AUTH_MAX_USERIP'} =~ /^\d+/)) || ($proxysettings{'AUTH_MAX_USERIP'} < 1) || ($proxysettings{'AUTH_MAX_USERIP'} > 255))) + if (!($proxysettings{'AUTH_IPCACHE_TTL'} =~ /^\d+/)) { - $errormessage = $Lang::tr{'advproxy errmsg max userip'}; + $errormessage = $Lang::tr{'advproxy errmsg auth ipcache ttl'}; goto ERROR; } - if (!($proxysettings{'AUTH_MAX_USERIP'} eq '')) + if ((!($proxysettings{'AUTH_MAX_USERIP'} eq '')) && ($proxysettings{'AUTH_IPCACHE_TTL'} eq '0')) { $errormessage = $Lang::tr{'advproxy errmsg auth ipcache may not be null'}; goto ERROR; @@ -1735,6 +1741,10 @@ print <$Lang::tr{'advproxy AUTH limit of IP addresses'}: + + $Lang::tr{'advproxy AUTH user IP cache TTL'}: + + $Lang::tr{'advproxy AUTH always required'}: @@ -2031,6 +2041,7 @@ print < + @@ -2042,6 +2053,7 @@ print < + END ; } @@ -3255,11 +3267,6 @@ END } print FILE "\n"; - # If we use authentication, users must always authenticate - unless ($proxysettings{"AUTH_METHOD"} eq "") { - print FILE "authenticate_ip_ttl 0\n\n"; - } - if ((!($proxysettings{'AUTH_METHOD'} eq 'none')) && (!($proxysettings{'AUTH_METHOD'} eq 'ident'))) { if ($proxysettings{'AUTH_METHOD'} eq 'ncsa') @@ -3268,6 +3275,7 @@ END print FILE "auth_param basic children $proxysettings{'AUTH_CHILDREN'}\n"; print FILE "auth_param basic realm $authrealm\n"; print FILE "auth_param basic credentialsttl $proxysettings{'AUTH_CACHE_TTL'} minutes\n"; + if (!($proxysettings{'AUTH_IPCACHE_TTL'} eq '0')) { print FILE "\nauthenticate_ip_ttl $proxysettings{'AUTH_IPCACHE_TTL'} minutes\n"; } } if ($proxysettings{'AUTH_METHOD'} eq 'ldap') @@ -3312,6 +3320,7 @@ END print FILE "auth_param basic children $proxysettings{'AUTH_CHILDREN'}\n"; print FILE "auth_param basic realm $authrealm\n"; print FILE "auth_param basic credentialsttl $proxysettings{'AUTH_CACHE_TTL'} minutes\n"; + if (!($proxysettings{'AUTH_IPCACHE_TTL'} eq '0')) { print FILE "\nauthenticate_ip_ttl $proxysettings{'AUTH_IPCACHE_TTL'} minutes\n"; } } if ($proxysettings{'AUTH_METHOD'} eq 'ntlm-auth') @@ -3352,6 +3361,7 @@ END print FILE "auth_param basic children $proxysettings{'AUTH_CHILDREN'}\n"; print FILE "auth_param basic realm $authrealm\n"; print FILE "auth_param basic credentialsttl $proxysettings{'AUTH_CACHE_TTL'} minutes\n"; + if (!($proxysettings{'AUTH_IPCACHE_TTL'} eq '0')) { print FILE "\nauthenticate_ip_ttl $proxysettings{'AUTH_IPCACHE_TTL'} minutes\n"; } } print FILE "\n"; -- 2.39.2