<div class="markdown">
<p dir="auto">Hi Carlos,</p>
<p dir="auto">Yeah, the Windows 7 machine is part of the domain. As for basic auth, I'll look into setting that up too, although we were hoping to forgo it entirely.</p>
<p dir="auto">On 25 Oct 2014, at 3:00, Carlos Defoe wrote:</p>
<blockquote>
<p dir="auto">Windows 7 inside the domain?</p>
<p dir="auto">Anyway, you should configure a basic auth scheme as a second fallback.</p>
<p dir="auto">On Fri, Oct 24, 2014 at 9:26 PM, Markus Moeller <a href="mailto:huaraz@moeller.plus.com">huaraz@moeller.plus.com</a><br>
wrote:</p>
<blockquote>
<p dir="auto">Hi Pedro,</p>
<p dir="auto">How did you create your keytab ? What does klist –ekt <squid.keytab> show<br>
( I assume you use MIT Kerberos) ?</p>
<p dir="auto">Markus</p>
<p dir="auto">"Pedro Lobo" <a href="mailto:palobo@gmail.com">palobo@gmail.com</a> wrote in message<br>
news:40E1E0E7-50C6-4117-94AA-50B06573430A@gmail.com...</p>
<p dir="auto">Hi Squid Gurus,</p>
<p dir="auto">I'm at my wit's end and in dire need of some squid expertise.</p>
<p dir="auto">We've got a production environment with a couple of squid 2.7 servers<br>
using NTLM and basic authentication. Recently though, we decided to upgrade<br>
and I'm now setting up squid 3.3 with Kerberos and NTLM Fallback. I've<br>
followed just about every guide I could find and in my testing environment,<br>
things were working great. Now that I've hooked it up to the main domain,<br>
things are awry.</p>
<p dir="auto">If I use a machine that's not part of the domain, NTLM kicks in and I can<br>
surf the web fine. If I use a Windows XP or Windows Server 2003, kerberos<br>
works just fine, however, if I use a machine Windows 7, 8 or 2008 server, I<br>
keep getting a popup asking me to authenticate and even then, it's and<br>
endless loop until it fails. My cache.log is littered with:</p>
<p dir="auto">negotiate_kerberos_auth.cc(200): pid=1607 :2014/10/24 23:03:01| negotiate_kerberos_auth: ERROR: gss_accept_sec_context() failed: Unspecified GSS failure. Minor code may provide more information.<br>
2014/10/24 23:03:01| ERROR: Negotiate Authentication validating user. Error returned 'BH gss_accept_sec_context() failed: Unspecified GSS failure. Minor code may provide more information. '</p>
<p dir="auto">The odd thing, is that this has worked before. Help me Obi Wan... You're<br>
my only hope! :)</p>
<p dir="auto"><em>Current Setup</em><br>
Squid 3.3 running on Ubuntu 14.04 server. It's connected to a 2003 server<br>
with function level 2000 (I know, we're trying to fase out the older<br>
servers).</p>
<p dir="auto"><em>krb5.conf</em></p>
<p dir="auto">[libdefaults]<br>
default_realm = FAKE.NET<br>
dns_lookup_kdc = yes<br>
dns_lookup_realm = yes<br>
ticket_lifetime = 24h<br>
default_keytab_name = /etc/squid3/PROXY.keytab</p>
<p dir="auto">; for Windows 2003<br>
default_tgs_enctypes = rc4-hmac des-cbc-crc des-cbc-md5<br>
default_tkt_enctypes = rc4-hmac des-cbc-crc des-cbc-md5<br>
permitted_enctypes = rc4-hmac des-cbc-crc des-cbc-md5</p>
<p dir="auto">[realms]<br>
FAKE.NET = {<br>
kdc = srv01.fake.net<br>
kdc = srv02.fake.net<br>
kdc = srv03.fake.net<br>
admin_server = srv01.fake.net<br>
default_domain = fake.net<br>
}</p>
<p dir="auto">[domain_realm]<br>
.fake.net = FAKE.NET<br>
fake.net = FAKE.NET</p>
<p dir="auto">[logging]<br>
kdc = FILE:/var/log/kdc.log<br>
admin_server = FILE:/var/log/kadmin.log<br>
default = FILE:/var/log/krb5lib.log</p>
<p dir="auto"><em>squid.conf</em></p>
<p dir="auto">auth_param negotiate program /usr/lib/squid3/negotiate_kerberos_auth -d -r -s HTTP/proxy01tst.fake.net<br>
auth_param negotiate children 20 startup=0 idle=1<br>
auth_param negotiate keep_alive off</p>
<p dir="auto">auth_param ntlm program /usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp --domain=FAKE.NET<br>
auth_param ntlm children 10<br>
auth_param ntlm keep_alive off</p>
<p dir="auto">Cheers,<br>
Pedro</p>
<hr>
<hr>
<p dir="auto">squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></p>
<hr>
<p dir="auto">squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></p>
</blockquote>
<hr>
<p dir="auto">squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></p>
</blockquote>
</div>