Authenticated Gateway - iptables + cron + php

Hi,

I want to make linux gateway to authenticate every connection passing
through it... I have an Windows 2003 domain, so user account are
managed by Active Directory. I'm to make a basic authentication using
IPTABLES + CRONTAB + PHP....

it will work like that: I make a new IPTABLES chain like "FullAccess",
and put any machine with FullAccess there, an make a chain
"AuthUsers"... when a new machine without full access try to use
gateway, it checks for source IP at AuthUsers, and if it was not found,
redirects any connection and any ports to a PHP page... even if access
is not an HTTP, users have first to authenticate before any access...
at PHP page, user enter login/password an then a run a script something
like " iptables -I AuthUsers -s 192.168.0.77 -j ACCEPT ", where IP
Address can be retrieved by PHP.... at same transaction, adds a Crontab
registry to remove that authentication after 2 hours, executing
something like "iptables -D AuthUsers -s 192.168.0.77 -j ACCEPT"...

it is very simple, I guess, and if I can do this at a first moment, a
wish to make an Active Directory integration, and maybe make some AD
groups, and add some specific IPTables rules based on that groups, like
FTP Access, Bank sites Access, Messenger Access, etc...

I have this idea, but don't know what the best way to do that securely
and stable...

The way we accomplish this at my old job was to use iptables for the
NAT / firewall and squid for logging / authentication. Squid is
capable of running LDAP queries (which work on Windows 2003 Active
Directory) to check for various things when a user tries to go out to
the internet. You can also setup squid to be transparent, so that you
do not have to setup the "Proxy Server" on each and every client
browser.

The default squid example that I found when trying to set this up shows
a query that checks only that the user is a valid user in the Windows
2003 domain. For the company I worked for, they have an Active
Directory security group called "Internet". The LDAP query that I
ended up writing checks to make sure you are a valid domain user and
you are a member of the "Internet" group before allowing you access to
the internet. I also used ADSIEdit on one of the Domain Controllers,
not to change anything, but just to view where group memberships were
located in the hierarchy.

As far as a page that displays if you fail authentication, I do not
know what options squid has available for that.

HTH,

X