<div class="markdown">
<p dir="auto">Hi Dan,</p>
<p dir="auto">Well now I feel incredibly stupid!!! Just checked and it seems something must've changed the permissions on my keytab file (I did mention it was working at one time). For some odd reason, although squid user and group both owned the key tab file, only user had read permissions. I haven't yet figured out what might have changed those permissions (maybe some troubleshooting I did earlier), but fixing the permissions seems to have sorted the problem.</p>
<p dir="auto">Thanks everybody for your help. Have a great weekend!</p>
<p dir="auto">Cheers,<br>
Pedro</p>
<p dir="auto">Monday I'll do a little more testing with the pilot group, but at least </p>
<p dir="auto">On 25 Oct 2014, at 10:41, Dan Charlesworth wrote:</p>
<blockquote>
<p dir="auto">I was recently receiving this (incredibly vague) error. Turns out my squid user didn’t have permission to read the keytab.</p>
<p dir="auto">On Sat, Oct 25, 2014 at 8:37 PM, Pedro Lobo <a href="mailto:palobo@gmail.com">palobo@gmail.com</a> wrote:</p>
<blockquote>
<p dir="auto">Hi Markus,<br>
I used msktutil to create the keytab.<br>
msktutil -c -s HTTP/proxy01tst.fake.net -h proxy01tst.fake.net -k<br>
/etc/squid3/PROXY.keytab --computer-name proxy01-tst --upn<br>
HTTP/proxy01tst.fake.net --server srv01.fake.net --verbose<br>
Output of klist -ekt:<br>
2 10/24/2014 22:59:50 proxy01-tst$@FAKE.NET (arcfour-hmac)<br>
2 10/24/2014 22:59:50 proxy01-tst$@FAKE.NET<br>
(aes128-cts-hmac-sha1-96)<br>
2 10/24/2014 22:59:50 proxy01-tst$@FAKE.NET<br>
(aes256-cts-hmac-sha1-96)<br>
2 10/24/2014 22:59:50 HTTP/<a href="mailto:proxy01tst.FAKE.net@FAKE.NET">proxy01tst.FAKE.net@FAKE.NET</a><br>
(arcfour-hmac)<br>
2 10/24/2014 22:59:50 HTTP/<a href="mailto:proxy01tst.FAKE.net@FAKE.NET">proxy01tst.FAKE.net@FAKE.NET</a><br>
(aes128-cts-hmac-sha1-96)<br>
2 10/24/2014 22:59:50 HTTP/<a href="mailto:proxy01tst.FAKE.net@FAKE.NET">proxy01tst.FAKE.net@FAKE.NET</a><br>
(aes256-cts-hmac-sha1-96)<br>
2 10/24/2014 22:59:50 host/<a href="mailto:proxy01tst.FAKE.net@FAKE.NET">proxy01tst.FAKE.net@FAKE.NET</a><br>
(arcfour-hmac)<br>
2 10/24/2014 22:59:50 host/<a href="mailto:proxy01tst.FAKE.net@FAKE.NET">proxy01tst.FAKE.net@FAKE.NET</a><br>
(aes128-cts-hmac-sha1-96)<br>
2 10/24/2014 22:59:50 host/<a href="mailto:proxy01tst.FAKE.net@FAKE.NET">proxy01tst.FAKE.net@FAKE.NET</a><br>
(aes256-cts-hmac-sha1-96)<br>
Yep, using MIT Kerberos<br>
Thanks in advance for any help.<br>
Cheers,<br>
Pedro<br>
On 25 Oct 2014, at 1:26, Markus Moeller wrote:</p>
<blockquote>
<p dir="auto">Hi Pedro,</p>
<p dir="auto">How did you create your keytab ? What does klist –ekt<br>
<squid.keytab> show ( I assume you use MIT Kerberos) ?</p>
<p dir="auto">Markus</p>
<p dir="auto">"Pedro Lobo" <a href="mailto:palobo@gmail.com">palobo@gmail.com</a> wrote in message<br>
news:40E1E0E7-50C6-4117-94AA-50B06573430A@gmail.com...<br>
Hi Squid Gurus,</p>
<p dir="auto">I'm at my wit's end and in dire need of some squid expertise.</p>
<p dir="auto">We've got a production environment with a couple of squid 2.7 servers<br>
using NTLM and basic authentication. Recently though, we decided to<br>
upgrade and I'm now setting up squid 3.3 with Kerberos and NTLM<br>
Fallback. I've followed just about every guide I could find and in my<br>
testing environment, things were working great. Now that I've hooked<br>
it up to the main domain, things are awry.</p>
<p dir="auto">If I use a machine that's not part of the domain, NTLM kicks in and I<br>
can surf the web fine. If I use a Windows XP or Windows Server 2003,<br>
kerberos works just fine, however, if I use a machine Windows 7, 8 or<br>
2008 server, I keep getting a popup asking me to authenticate and even<br>
then, it's and endless loop until it fails. My cache.log is littered<br>
with:</p>
<p dir="auto">negotiate_kerberos_auth.cc(200): pid=1607 :2014/10/24 23:03:01|<br>
negotiate_kerberos_auth: ERROR: gss_accept_sec_context() failed:<br>
Unspecified GSS failure. Minor code may provide more information.<br>
2014/10/24 23:03:01| ERROR: Negotiate Authentication validating user.<br>
Error returned 'BH gss_accept_sec_context() failed: Unspecified GSS<br>
failure. Minor code may provide more information. '<br>
The odd thing, is that this has worked before. Help me Obi Wan...<br>
You're my only hope! :)</p>
<p dir="auto">Current Setup<br>
Squid 3.3 running on Ubuntu 14.04 server. It's connected to a 2003<br>
server with function level 2000 (I know, we're trying to fase out the<br>
older servers).</p>
<p dir="auto">krb5.conf</p>
<p dir="auto">[libdefaults]<br>
default_realm = FAKE.NET<br>
dns_lookup_kdc = yes<br>
dns_lookup_realm = yes<br>
ticket_lifetime = 24h<br>
default_keytab_name = /etc/squid3/PROXY.keytab</p>
<p dir="auto">; for Windows 2003<br>
default_tgs_enctypes = rc4-hmac des-cbc-crc des-cbc-md5<br>
default_tkt_enctypes = rc4-hmac des-cbc-crc des-cbc-md5<br>
permitted_enctypes = rc4-hmac des-cbc-crc des-cbc-md5</p>
<p dir="auto">[realms]<br>
FAKE.NET = {<br>
kdc = srv01.fake.net<br>
kdc = srv02.fake.net<br>
kdc = srv03.fake.net<br>
admin_server = srv01.fake.net<br>
default_domain = fake.net<br>
}</p>
<p dir="auto">[domain_realm]<br>
.fake.net = FAKE.NET<br>
fake.net = FAKE.NET</p>
<p dir="auto">[logging]<br>
kdc = FILE:/var/log/kdc.log<br>
admin_server = FILE:/var/log/kadmin.log<br>
default = FILE:/var/log/krb5lib.log<br>
squid.conf</p>
<p dir="auto">auth_param negotiate program /usr/lib/squid3/negotiate_kerberos_auth<br>
-d -r -s HTTP/proxy01tst.fake.net<br>
auth_param negotiate children 20 startup=0 idle=1<br>
auth_param negotiate keep_alive off</p>
<p dir="auto">auth_param ntlm program /usr/bin/ntlm_auth --diagnostics<br>
--helper-protocol=squid-2.5-ntlmssp --domain=FAKE.NET<br>
auth_param ntlm children 10<br>
auth_param ntlm keep_alive off<br>
Cheers,<br>
Pedro</p>
<hr>
<hr>
<p dir="auto">squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></p>
<hr>
<p dir="auto">squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></p>
</blockquote>
</blockquote>
<p dir="auto">squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></p>
</blockquote>
</div>