<HTML><HEAD></HEAD>
<BODY dir=ltr>
<DIV dir=ltr>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000">
<DIV>Hi Pedro,</DIV>
<DIV> </DIV>
<DIV> Good to know you solved it. From your post it sounded
like XP worked and Win 7 didn’t</DIV>
<DIV> </DIV>
<DIV>Markus </DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV
style="BORDER-TOP-COLOR: #000000; BORDER-BOTTOM-COLOR: #000000; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 4px solid; BORDER-RIGHT-COLOR: #000000">
<DIV
style="FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: inline">
<DIV>"Pedro Lobo" <palobo@gmail.com> wrote in message
news:75991CAE-5F10-4635-B012-D372C27F8AC4@gmail.com...</DIV></DIV></DIV>
<DIV
style="BORDER-TOP-COLOR: #000000; BORDER-BOTTOM-COLOR: #000000; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 4px solid; BORDER-RIGHT-COLOR: #000000">
<DIV
style="FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: inline">
<DIV class=markdown>
<P>Hi Markus,</P>
<P>I initially had it configured as such and changed it to <CODE>auth_param
negotiate program /usr/lib/squid3/negotiate_kerberos_auth -d -r -s
HTTP/proxy01tst.fake.net</CODE> as a troubleshooting step. I've since then
changed it back. Dan pointed out earlier that it could be a permissions problem,
and sure enough, permissions on /etc/squid3/PROXY.keytab were wrong (group had
no read permissions). Fixing that seems to have sorted out the problem. I'll be
doing more extensive testes on Monday when the test group start surfing the
web.</P>
<P>Thanks for all the help!</P>
<P>On 25 Oct 2014, at 14:13, Markus Moeller wrote:</P>
<BLOCKQUOTE>
<P>Hi Pedro,</P>
<P>I wonder if he upper case in the name is a problem. Can you try</P>
<P>auth_param negotiate program /usr/lib/squid3/negotiate_kerberos_auth -d -r
-s GSS_C_NO_NAME</P>
<P>instead of</P>
<P>auth_param negotiate program /usr/lib/squid3/negotiate_kerberos_auth -d -r
-s HTTP/proxy01tst.fake.net</P>
<P>Markus</P>
<P>"Pedro Lobo" <A href="mailto:palobo@gmail.com">palobo@gmail.com</A> wrote
in message news:FD6832B9-3F1F-48C6-A76F-47A224F1697B@gmail.com...<BR>Hi
Markus,</P>
<P>I used msktutil to create the keytab.</P>
<P>msktutil -c -s HTTP/proxy01tst.fake.net -h proxy01tst.fake.net -k
/etc/squid3/PROXY.keytab --computer-name proxy01-tst --upn
HTTP/proxy01tst.fake.net --server srv01.fake.net --verbose<BR>Output of klist
-ekt:</P>
<P>2 10/24/2014 22:59:50 proxy01-tst$@FAKE.NET (arcfour-hmac)<BR>2 10/24/2014
22:59:50 proxy01-tst$@FAKE.NET (aes128-cts-hmac-sha1-96)<BR>2 10/24/2014
22:59:50 proxy01-tst$@FAKE.NET (aes256-cts-hmac-sha1-96)<BR>2 10/24/2014
22:59:50 HTTP/<A
href="mailto:proxy01tst.FAKE.net@FAKE.NET">proxy01tst.FAKE.net@FAKE.NET</A>
(arcfour-hmac)<BR>2 10/24/2014 22:59:50 HTTP/<A
href="mailto:proxy01tst.FAKE.net@FAKE.NET">proxy01tst.FAKE.net@FAKE.NET</A>
(aes128-cts-hmac-sha1-96)<BR>2 10/24/2014 22:59:50 HTTP/<A
href="mailto:proxy01tst.FAKE.net@FAKE.NET">proxy01tst.FAKE.net@FAKE.NET</A>
(aes256-cts-hmac-sha1-96)<BR>2 10/24/2014 22:59:50 host/<A
href="mailto:proxy01tst.FAKE.net@FAKE.NET">proxy01tst.FAKE.net@FAKE.NET</A>
(arcfour-hmac)<BR>2 10/24/2014 22:59:50 host/<A
href="mailto:proxy01tst.FAKE.net@FAKE.NET">proxy01tst.FAKE.net@FAKE.NET</A>
(aes128-cts-hmac-sha1-96)<BR>2 10/24/2014 22:59:50 host/<A
href="mailto:proxy01tst.FAKE.net@FAKE.NET">proxy01tst.FAKE.net@FAKE.NET</A>
(aes256-cts-hmac-sha1-96)<BR>Yep, using MIT Kerberos</P>
<P>Thanks in advance for any help.</P>
<P>Cheers,<BR>Pedro</P>
<P>On 25 Oct 2014, at 1:26, Markus Moeller wrote:</P>
<P>Hi Pedro,</P>
<P>How did you create your keytab ? What does klist –ekt <squid.keytab>
show ( I assume you use MIT Kerberos) ?</P>
<P>Markus</P>
<P>"Pedro Lobo" <A href="mailto:palobo@gmail.com">palobo@gmail.com</A> wrote
in message news:40E1E0E7-50C6-4117-94AA-50B06573430A@gmail.com...<BR>Hi Squid
Gurus,</P>
<P>I'm at my wit's end and in dire need of some squid expertise.</P>
<P>We've got a production environment with a couple of squid 2.7 servers using
NTLM and basic authentication. Recently though, we decided to upgrade and I'm
now setting up squid 3.3 with Kerberos and NTLM Fallback. I've followed just
about every guide I could find and in my testing environment, things were
working great. Now that I've hooked it up to the main domain, things are
awry.</P>
<P>If I use a machine that's not part of the domain, NTLM kicks in and I can
surf the web fine. If I use a Windows XP or Windows Server 2003, kerberos
works just fine, however, if I use a machine Windows 7, 8 or 2008 server, I
keep getting a popup asking me to authenticate and even then, it's and endless
loop until it fails. My cache.log is littered with:</P>
<P>negotiate_kerberos_auth.cc(200): pid=1607 :2014/10/24 23:03:01|
negotiate_kerberos_auth: ERROR: gss_accept_sec_context() failed: Unspecified
GSS failure. Minor code may provide more information.<BR>2014/10/24 23:03:01|
ERROR: Negotiate Authentication validating user. Error returned 'BH
gss_accept_sec_context() failed: Unspecified GSS failure. Minor code may
provide more information. '<BR>The odd thing, is that this has worked before.
Help me Obi Wan... You're my only hope! :)</P>
<P>Current Setup<BR>Squid 3.3 running on Ubuntu 14.04 server. It's connected
to a 2003 server with function level 2000 (I know, we're trying to fase out
the older servers).</P>
<P>krb5.conf</P>
<P>[libdefaults]<BR>default_realm = FAKE.NET<BR>dns_lookup_kdc =
yes<BR>dns_lookup_realm = yes<BR>ticket_lifetime = 24h<BR>default_keytab_name
= /etc/squid3/PROXY.keytab</P>
<P>; for Windows 2003<BR>default_tgs_enctypes = rc4-hmac des-cbc-crc
des-cbc-md5<BR>default_tkt_enctypes = rc4-hmac des-cbc-crc
des-cbc-md5<BR>permitted_enctypes = rc4-hmac des-cbc-crc des-cbc-md5</P>
<P>[realms]<BR>FAKE.NET = {<BR>kdc = srv01.fake.net<BR>kdc =
srv02.fake.net<BR>kdc = srv03.fake.net<BR>admin_server =
srv01.fake.net<BR>default_domain = fake.net<BR>}</P>
<P>[domain_realm]<BR>.fake.net = FAKE.NET<BR>fake.net = FAKE.NET</P>
<P>[logging]<BR>kdc = FILE:/var/log/kdc.log<BR>admin_server =
FILE:/var/log/kadmin.log<BR>default =
FILE:/var/log/krb5lib.log<BR>squid.conf</P>
<P>auth_param negotiate program /usr/lib/squid3/negotiate_kerberos_auth -d -r
-s HTTP/proxy01tst.fake.net<BR>auth_param negotiate children 20 startup=0
idle=1<BR>auth_param negotiate keep_alive off</P>
<P>auth_param ntlm program /usr/bin/ntlm_auth --diagnostics
--helper-protocol=squid-2.5-ntlmssp --domain=FAKE.NET<BR>auth_param ntlm
children 10<BR>auth_param ntlm keep_alive off<BR>Cheers,<BR>Pedro</P>
<P>Cumprimentos<BR>Pedro Lobo<BR>Solutions Architect | System Engineer</P>
<P><A
href="mailto:pedro.lobo@pt.clara.net">pedro.lobo@pt.clara.net</A><BR>Tlm.:
+351 939 528 827 | Tel.: +351 214 127 314</P>
<P>Claranet Portugal<BR>Ed. Parque Expo<BR>Av. D. João II, 1.07-2.1, 4º
Piso<BR>1998-014 Lisboa<BR><A
href="http://www.claranet.pt">www.claranet.pt</A></P>
<P>Empresa certificada ISO 9001, ISO 20000 e ISO 27001</P>
<HR>
<HR>
<P>squid-users mailing list<BR><A
href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</A><BR><A
href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</A></P>
<HR>
<P>squid-users mailing list<BR><A
href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</A><BR><A
href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</A></P>
<P>Cumprimentos<BR>Pedro Lobo<BR>Solutions Architect | System Engineer</P>
<P><A
href="mailto:pedro.lobo@pt.clara.net">pedro.lobo@pt.clara.net</A><BR>Tlm.:
+351 939 528 827 | Tel.: +351 214 127 314</P>
<P>Claranet Portugal<BR>Ed. Parque Expo<BR>Av. D. João II, 1.07-2.1, 4º
Piso<BR>1998-014 Lisboa<BR><A
href="http://www.claranet.pt">www.claranet.pt</A></P>
<P>Empresa certificada ISO 9001, ISO 20000 e ISO 27001</P>
<HR>
<HR>
<P>squid-users mailing list<BR><A
href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</A><BR><A
href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</A></P>
<HR>
<P>squid-users mailing list<BR><A
href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</A><BR><A
href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</A></P></BLOCKQUOTE></DIV>
<P>
<HR>
_______________________________________________<BR>squid-users mailing
list<BR>squid-users@lists.squid-cache.org<BR>http://lists.squid-cache.org/listinfo/squid-users<BR></DIV></DIV></DIV></DIV></BODY></HTML>