[squid-users] Squid 4.15 on FreeBSD 12.2 Stable - Kerberos helper issues

[Suporte - Konntrol]

Hello everyone,

Greetings.

 

I got a strange situation with my SQUID 4.1 (FreeBSD 12.2 Stable
environment).

Everything was working fine with Kerberos configuration and suddenly it
stopped with the following error:

 

==> /var/squid/logs/cache.log <==

negotiate_kerberos_auth.cc(182): pid=85679 :2022/05/20 13:35:43|
negotiate_kerberos_auth: ERROR: gss_acquire_cred() failed: No credentials
were supplied, or the credentials were unavailable or inaccessible. No
principal in keytab matches desired name

2022/05/20 13:35:43| negotiate_kerberos_auth: INFO: User not authenticated

 

Judging by the "No principal in keytab matches desired name" message, I went
immediately to the AD object to check if it was really missing the Principal
entry.

To my surprise, everything is there. (talking about the HTTP/fqdn at REALM
entry).

Also, I checked the contents of my keytab, which looks OK, as it contains
the HTTP/server01.mydomain.corp at MYDOMAIN.CORP entry as well.

Additionally, I checked the DNS configuration for the PTR and Reverse
entries. It looks OK as well.

 

I have used "net ads join
createupn=HTTP/server01.mydomain.corp at MYDOMAIN.CORP -k" commands to Join the
Squid machine to Domain, and "net ads keytab create -k" to create a keytab.

Also, used the command "net ads keytab add HTTP" to add the HTTP entry to
the keytab.

 

This is the config used on SQUID for Kerberos:

 

auth_param negotiate program
/usr/local/libexec/squid/negotiate_kerberos_auth -d -i -s
HTTP/server01.mydomain.corp at MYDOMAIN.CORP
<mailto:HTTP/server01.mydomain.corp at MYDOMAIN.CORP>  

auth_param negotiate children 20 startup=10 idle=5

auth_param negotiate keep_alive off

 

As I mentioned, that was working for months, then stopped.

 

Are you guys aware of any Windows Update who may broke the Kerberos
integration?

 

I have "Windows Server 2022 AD" and "WINDOWS 11" clients, working with
"FreeBSD + SQUID + Kerberos Auth helper"

 

Any help is very welcome!

 

Thanks!

 

Fabricio.

 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20220520/253f7d77/attachment.htm>