Re: [squid-users] Squid authentication issues
I use this : You need this in smb.conf # Added for freeradius or squid proxy support # Obligated to set on both AD-DC and Member server. ntlm auth = mschapv2-and-ntlmv2-only And this or something like that, i have more working auth setups for squid, But i use this primarly. auth_param negotiate program /usr/lib/squid/negotiate_wrapper_auth \ --kerberos /usr/lib/squid/negotiate_kerberos_auth -k /etc/squid/HTTP.keytab \ -s HTTP/proxy1.internal.domain.tld@REALM \ --ntlm /usr/bin/ntlm_auth --helper-protocol=gss-spnego --domain=NTDOM Still not working try/change above line to : --ntlm /usr/bin/ntlm_auth --allow-mschapv2 --helper-protocol=gss-spnego --domain=NTDOM But should not be needed. And dont forget to add the HTTP spn on the member server. net ads keytab add_update_ads HTTP/proxy1.internal.domain.tld -UAdministrator Also, A+PTR records are a must for the proxy with kerberos auth, And do remove from smb.conf : > winbind enum users = yes > winbind enum groups = yes Or set these to no. I use that on Debian 10 with now squid 4.12. (ssl enabled) (since debian 8 and squid 3.x ) There are more options here, but start with above. My setup does, in this order. Negotiated Kerberos/NTLM auth with LDAP auth as fall back. Beside these few small point, your setup looks great to me. Greetz, Louis Van: squid-users [mailto:squid-users-boun...@lists.squid-cache.org] Namens Marcio Demetrio Bacci Verzonden: donderdag 30 juli 2020 19:37 Aan: Squid Users Onderwerp: [squid-users] Squid authentication issues Hi, I set up Squid 4.6 on Debian 10 and I'm having problems with browser authentication on a Windows station. I did the tests on the command line and apparently it's OK. root@proxy:/etc/squid/acls# /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic Registered MSG_REQ_POOL_USAGE Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED lp_load_ex: refreshing parameters Initialising global parameters rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384) Processing section "[global]" EMPRESA+mane X NT_STATUS_OK: The operation completed successfully. (0x0) OK Here are my configuration files: #/ETC/SAMBA/SMB.CONF [global] netbios name = PROXY workgroup = EMPRESA security = ADS realm = EMPRESA.COM.BR encrypt passwords = yes username map = /etc/samba/user.map log file = /var/log/samba/%m.log log level = 3 passdb:5 auth:5 idmap config * : backend = tdb idmap config * : range = 3000-7999 idmap config EMPRESA:backend = ad idmap config EMPRESA:schema_mode = rfc2307 idmap config EMPRESA:range = 1-99 idmap config EMPRESA:unix_nss_info = yes idmap config EMPRESA:unix_primary_group = yes winbind refresh tickets = Yes winbind use default domain = yes winbind separator = + winbind enum users = yes winbind enum groups = yes vfs objects = acl_xattr map acl inherit = yes store dos attributes = yes template shell = /bin/bash template homedir = /home/%U dedicated keytab file = /etc/krb5.keytab kerberos method = secrets and keytab load printers = no printing = bsd printcap name = /dev/null disable spoolss = yes #ETC/NSSWITCH.CONF # /etc/nsswitch.conf # # Example configuration of GNU Name Service Switch functionality. # If you have the `glibc-doc-reference' and `info' packages installed, try: # `info libc "Name Service Switch"' for information about this file. passwd: compat winbind group: compat winbind shadow: compat gshadow:files hosts: files dns networks: files protocols: db files services: db files ethers: db files rpc:db files netgroup: nis #/ETC/KRB5.CONF [libdefaults] dns_lookup_realm = false dns_lookup_kdc = true default_realm = EMPRESA.COM.BR #/ETC/SQUID/SQUID.CONF http_port 3128 cache_mem 512 MB cache_swap_low 80 cache_swap_high 90 maximum_object_size 512 MB minimum_object_size 0 KB maximum_obj
[squid-users] Squid authentication issues
Hi, I set up Squid 4.6 on Debian 10 and I'm having problems with browser authentication on a Windows station. I did the tests on the command line and apparently it's OK. root@proxy:/etc/squid/acls# /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic Registered MSG_REQ_POOL_USAGE Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED lp_load_ex: refreshing parameters Initialising global parameters rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384) Processing section "[global]" EMPRESA+mane X NT_STATUS_OK: The operation completed successfully. (0x0) OK Here are my configuration files: #/ETC/SAMBA/SMB.CONF [global] netbios name = PROXY workgroup = EMPRESA security = ADS realm = EMPRESA.COM.BR encrypt passwords = yes username map = /etc/samba/user.map log file = /var/log/samba/%m.log log level = 3 passdb:5 auth:5 idmap config * : backend = tdb idmap config * : range = 3000-7999 idmap config EMPRESA:backend = ad idmap config EMPRESA:schema_mode = rfc2307 idmap config EMPRESA:range = 1-99 idmap config EMPRESA:unix_nss_info = yes idmap config EMPRESA:unix_primary_group = yes winbind refresh tickets = Yes winbind use default domain = yes winbind separator = + winbind enum users = yes winbind enum groups = yes vfs objects = acl_xattr map acl inherit = yes store dos attributes = yes template shell = /bin/bash template homedir = /home/%U dedicated keytab file = /etc/krb5.keytab kerberos method = secrets and keytab load printers = no printing = bsd printcap name = /dev/null disable spoolss = yes #ETC/NSSWITCH.CONF # /etc/nsswitch.conf # # Example configuration of GNU Name Service Switch functionality. # If you have the `glibc-doc-reference' and `info' packages installed, try: # `info libc "Name Service Switch"' for information about this file. passwd: compat winbind group: compat winbind shadow: compat gshadow:files hosts: files dns networks: files protocols: db files services: db files ethers: db files rpc:db files netgroup: nis #/ETC/KRB5.CONF [libdefaults] dns_lookup_realm = false dns_lookup_kdc = true default_realm = EMPRESA.COM.BR #/ETC/SQUID/SQUID.CONF http_port 3128 cache_mem 512 MB cache_swap_low 80 cache_swap_high 90 maximum_object_size 512 MB minimum_object_size 0 KB maximum_object_size_in_memory 4096 KB cache_replacement_policy heap LFUDA memory_replacement_policy heap LFUDA quick_abort_min -1 KB detect_broken_pconn on fqdncache_size 1024 refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 access_log /var/log/squid/access.log cache_log /var/log/squid/cache.log cache_dir aufs /var/spool/squid 600 16 256 auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic auth_param ntlm children 20 startup=0 idle=1 auth_param ntlm keep_alive on visible_hostname "Monitoramento de Acesso à Internet" ### acls #acl manager proto cache_object acl localhost src 192.168.1.17/32 acl to_localhost dst 192.168.1.17/32 acl SSL_ports port 22 80 3456 443 563 587 993 2811 3001 3322 7071 8443 9191 1 23000 acl Safe_ports port 21 # ftp acl Safe_ports port 70 # gopher acl Safe_ports port 80 # http acl Safe_ports port 88 # kerberos acl Safe_ports port 123 # ntp acl Safe_ports port 210 # wais acl Safe_ports port 280 # http-mgmt acl Safe_ports port 3456 # Siafi acl Safe_ports port 389 # ldap acl Safe_ports port 443 # https acl Safe_ports port 488 # gss-http acl Safe_ports port 563 # snews acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl Safe_ports port 3001 # imprenssa nacional acl Safe_ports port 8080 # http acl Safe_ports port 8443 # http acl Safe_ports port 1025-65535 # unregistered ports acl purge method PURGE acl CONNECT method CONNECT # Windows Update acl microsoft url_regex "/etc/squid/acls/ms-update" acl atualizacoes dstdomain microsoft.com http_access allow microsoft http_access allow atualizacoes http_access allow localhost http_access allow purge localhost http_access deny purge http_access deny !Safe_ports http_access deny CONNECT !SSL_ports acl autenticados proxy_auth REQUIRED http_access deny !autenticados acl sites_liberados url_regex -i "/etc/squid/acls/sites-permitidos" http_access allow sites_liberados acl extensoes_bloqueadas url_regex -i "/etc/squid/acls/extensoes-proibidas" http_access deny extensoes_bloqueadas ### Bloqueia sites por URL acl sites_bloqueados url_regex -i "/etc/squid/acls/sites-proibidos" http_access deny sites_bloqueados ### Rede LAN # acl rede_usuarios src 192.168.0.0/24 ### Nega acesso de quem nao esta na rede local http_access allow rede_usuarios acl extensoes_bloqueadas url_regex -i "/etc/squid/acls/extensoes-proibidas" acl sites_liberados
