Re: [squid-users] proxy-auth NTLM stop working

On 11/05/11 05:44, Ricardo Nuno wrote:
> Hi,
>
> I had a working setup with Ubuntu 10.04 LTS x64 with the following versions:
>
> squid 3.0.STABLE19-1ubuntu0.1
> samba 2:3.4.7~dfsg-1ubuntu3.5
>
> We have a AD domain with around 50 clients using Windows 7 and joined
> in the domain.
> For this clients we user squid with kerberos and it's working fine
> with no issues.
>
> We had a second auth method (NTLM basic,ntlmssp) for clients that were
> not joined in the domain.
> For this clients normally a pop-up auth appear in the browser witch
> then the user should provide AD
> credentials in the following manner:
>
> User: MYDOMAIN\user
> Pass: password
>
> Since last week NTLM seams to stop working, but from all the tests i
> run from the proxy shell it seams ok
> Here is what i already did to debug the issue:
>
> root_at_proxy:/# net ads testjoin
> Join is OK
>
> root_at_proxy:/# wbinfo -t
> checking the trust secret via RPC calls succeeded
>
> root_at_proxy:/# wbinfo -a lsquintella%lsquintella
> plaintext password authentication succeeded
> challenge/response password authentication succeeded
>
> wbinfo -u and wbinfo -g both work and list users and groups without the domain.
> I'm using ntml binary from the samba:
>
> root_at_proxy:/# /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
> mydomain+lsquintella lsquintella
> OK
>
> Im running out of ideas to solve this im missing something here?

Okay to Basic auth protocol works. Now what about the other two? you
have Negotiate configured as first option and NTLM configured as second.
  It is *entirely* up to the browser which of the three options it picks
to use.
  - IE is known only to pick the first it can use and not failover.
  - Recent windows OS will not respond to NTLM by default.

Or it could be a simpler failure in the helpers looking up the other
protocols tokens.

> Can someone please point me to the right direction.
>

You can test the other protocols by cut-n-pasting the HTTP header value
received from the logs and pasting it to the helper. Squid just tacks a
"TT " onto the beginning and passes the header line on unchanged to the
helper hoping for an "AF" (success) or "BH" (fail) result.

> /etc/squid3/squid.conf
>
> visible_hostname proxy1.mydomain.lan
> http_port 3128
>
> hierarchy_stoplist cgi-bin ?
>
> cache_mem 1024 MB
> maximum_object_size 8096 KB
>
> cache_dir aufs /var/spool/squid3 50000 16 256
> cache_access_log /var/log/squid3/access.log
> cache_log /var/log/squid3/cache.log squid
> cache_store_log none
>
> #Suggested default:
> refresh_pattern ^ftp: 1440 20% 10080
> refresh_pattern ^gopher: 1440 0% 1440
> refresh_pattern . 0 20% 4320
> refresh_pattern -i (cgi-bin|\?) 0
> 0% 0
> refresh_pattern -i \.index.(html|htm)$ 0 40%
> 10080
> refresh_pattern -i \.(html|htm|css|js)$ 1440 40% 40320
>
> auth_param negotiate program /usr/lib/squid3/squid_kerb_auth -s
> HTTP/ldapbind_at_MYDOMAIN.LAN
> auth_param negotiate children 20
> auth_param negotiate keep_alive on
>
> auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
> auth_param ntlm children 10
> auth_param ntlm keep_alive on
>
> auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
> auth_param basic children 10
> auth_param basic realm Mydomain Log
> auth_param basic credentialsttl 2 hours
> auth_param basic casesensitive off
>
> external_acl_type FaGroup ttl=900 %LOGIN
> /usr/lib/squid3/squid_ldap_group -R -b "dc=mydomain,dc=lan" -D
> "cn=ldapbind,cn=users,dc=mydomain,dc=lan" -W "/etc$
>
> authenticate_ttl 1 hour
> authenticate_cache_garbage_interval 1 hour
>
> acl manager proto cache_object
> acl localhost src 127.0.0.1
> acl to_localhost dst 127.0.0.0/8
> acl SSL_ports port 443 563 8443 # https
>
> acl Safe_ports port 80 # http
> acl Safe_ports port 21 # ftp
> acl Safe_ports port 443 563 # https
> acl Safe_ports port 70 # gopher
> acl Safe_ports port 210 # wais
> acl Safe_ports port 1025-65535 # unregistered ports
> acl Safe_ports port 280 # http-mgmt
> acl Safe_ports port 488 # gss-http
> acl Safe_ports port 591 # filemaker
> acl Safe_ports port 777 # multiling http
> acl Safe_ports port 631 # cups
> acl Safe_ports port 873 # rsync
> acl Safe_ports port 901 # SWAT
> acl purge method PURGE
> acl CONNECT method CONNECT
>
> http_access allow manager localhost
> http_access deny manager
> http_access allow purge localhost
> http_access deny purge
>
>
> http_access deny !Safe_ports
> http_access deny CONNECT !SSL_ports
>
> acl rede_interna src 192.168.20.0/24
> acl rede_servidores src 192.168.10.0/24
> acl h_trabalho_manha time MTWHF 09:00-13:00
> acl h_trabalho_tarde time MTWHF 14:30-18:00
> acl FullAccess external FaGroup InetFA
>
> acl sites_internos_nocache dst 192.168.10.0/24
> cache deny sites_internos_nocache
>
> acl Publicidade url_regex "/etc/squid3/list/publicidade.acl"
> acl BlockFiles urlpath_regex -i "/etc/squid3/list/block-files.acl"
> acl BlockSites dstdomain "/etc/squid3/list/block-sites.acl"
> acl TimeBasedSites dstdomain "/etc/squid3/list/timebased-sites.acl"
> acl DenyFun dstdomain "/etc/squid3/list/block-sites-fun.acl"
> deny_info ERR_MYDOMAIN_TBSITES_DENY TimeBasedSites
> deny_info ERR_MYDOMAIN_FUN_DENY DenyFun
>
> acl windowsupdate dstdomain windowsupdate.microsoft.com
> acl windowsupdate dstdomain .update.microsoft.com
> acl windowsupdate dstdomain download.windowsupdate.com
> acl windowsupdate dstdomain redir.metaservices.microsoft.com
> acl windowsupdate dstdomain images.metaservices.microsoft.com
> acl windowsupdate dstdomain c.microsoft.com
> acl windowsupdate dstdomain www.download.windowsupdate.com
> acl windowsupdate dstdomain wustat.windows.com
> acl windowsupdate dstdomain crl.microsoft.com
> acl windowsupdate dstdomain sls.microsoft.com
> acl windowsupdate dstdomain productactivation.one.microsoft.com
> acl windowsupdate dstdomain ntservicepack.microsoft.com
>
> acl CONNECT method CONNECT
> acl wuCONNECT dstdomain www.update.microsoft.com
> acl wuCONNECT dstdomain sls.microsoft.com
> acl wuCONNECT dstdomain .dropbox.com
>
> http_access allow CONNECT wuCONNECT rede_interna
> http_access allow CONNECT wuCONNECT localhost
> http_access allow windowsupdate rede_interna
> http_access allow windowsupdate localhost
>
> acl msn url_regex -i gateway.dll
> acl msnd dstdomain messenger.msn.com gateway.messenger.hotmail.com
> acl msn1 req_mime_type ^application/x-msn-messenger$
>
> http_access deny msnd
> http_access deny msn
> http_access deny msn1
>
> http_access deny !FullAccess Publicidade

"FullAccess" requires auth to be known in order to use.... these lines
all contradict "http_access allow all NoAuthNeeded" below.

> http_access deny !FullAccess BlockFiles
> http_access deny !FullAccess BlockSites
> http_access deny !FullAccess DenyFun
> http_access deny rede_interna h_trabalho_manha !FullAccess TimeBasedSites
> http_access deny rede_interna h_trabalho_tarde !FullAccess TimeBasedSites
>
> acl NoAuthNeeded dstdomain .avg.com backup.avg.cz .dropbox.com
> .google.com .openoffice.org
> http_access allow all NoAuthNeeded
>
> acl AuthorizedUsers proxy_auth REQUIRED
> http_access allow AuthorizedUsers
>
> # And finally deny all other access to this proxy
> http_access deny all
> http_reply_access allow all
>
> cache_mgr sys_at_mydomain.lan
> logfile_rotate 10
> error_directory /etc/squid3/error
> coredump_dir /var/spool/squid3
>
> --
> Ricardo Nuno

Amos

-- 
Please be using
   Current Stable Squid 2.7.STABLE9 or 3.1.12
   Beta testers wanted for 3.2.0.7 and 3.1.12.1