<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:PMingLiU;
panose-1:2 2 5 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cordia New";
panose-1:2 11 3 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cordia New";
panose-1:2 11 3 4 2 2 2 2 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@PMingLiU";
panose-1:2 2 5 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-AU" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Pedro,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">This sounds similar to a problem I had a couple of years ago when using Kerberos authentication with Squid (3.1.x) on Ubuntu (10.04 at that stage). (see RE:
[squid-users] Re: Authentication using squid_kerb_auth with Internet Explorer 8 on Windows Server 2008 R2, squid-users group Nov 3 2010)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">What I discovered after debugging the Kerberos authentication process with gdb was the MIT Kerberos version distributed with that version of Ubuntu did not
support one of the encryption types requested by the newer versions of Windows (7, 2008). This was a reported issue with the version of Kerberos used in Ubuntu. I ended up patching the Ubuntu MIT Kerberos source (a trivial patch) and compiling the packages
manually. This corrected the problem.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I am unsure whether this is the root cause of your issue though but thought it might be worth mentioning. I have not kept up with the MIT Kerberos packages
included with Ubuntu 12.04 and 14.04 to know whether the patch is included in the later versions.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Paul
<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> squid-users [mailto:squid-users-bounces@lists.squid-cache.org]
<b>On Behalf Of </b>Pedro Lobo<br>
<b>Sent:</b> Tuesday, 28 October 2014 7:26 AM<br>
<b>To:</b> Markus Moeller<br>
<b>Cc:</b> squid-users@squid-cache.org<br>
<b>Subject:</b> Re: [squid-users] Kerberos Authentication Failing for Windows 7+ with BH gss_accept_sec_context() failed<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hi Markus Moeller,<br>
<br>
<br>
Hi Markus,<br>
<br>
Yeah, I'm currently using that option and permissions are correct too. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
On 27 Oct 2014 19:47, Markus Moeller wrote: <o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">Hi Pedro,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"> Did you try the –s GSS_C_NO_NAME option ?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">Markus<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"> <o:p></o:p></span></p>
</div>
<div style="border:none black 1.0pt;border-left:solid black 3.0pt;padding:0cm 0cm 0cm 4.0pt;margin-left:3.75pt">
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">"Pedro Lobo" <<a href="mailto:palobo@gmail.com">palobo@gmail.com</a>> wrote in message
<a href="news:94F74226-F24B-4910-95B7-B86ACE815995@gmail.com">news:94F74226-F24B-4910-95B7-B86ACE815995@gmail.com</a>...<o:p></o:p></span></p>
</div>
</div>
</div>
<div style="border:none black 1.0pt;border-left:solid black 3.0pt;padding:0cm 0cm 0cm 4.0pt;margin-left:3.75pt">
<div>
<div>
<p><span style="font-family:"Calibri","sans-serif";color:black">Hey Everybody,<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Seems as though I celebrated too soon on Saturday. Today things are back to not working for Windows 7+ machines and XP/2003 machines are working just fine.<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">I've also checked the permissions on the keytab file and they haven't changed since Saturday, so it's not that... ARGH!!!!<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Craving ideas and solutions right now... Pilot users are less than satisfied ;)<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Cheers,<br>
Pedro<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">On 25 Oct 2014, at 14:13, Markus Moeller wrote:<o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p><span style="font-family:"Calibri","sans-serif";color:black">Hi Pedro,<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">I wonder if he upper case in the name is a problem. Can you try<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">auth_param negotiate program /usr/lib/squid3/negotiate_kerberos_auth -d -r -s GSS_C_NO_NAME<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">instead of<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">auth_param negotiate program /usr/lib/squid3/negotiate_kerberos_auth -d -r -s HTTP/proxy01tst.fake.net<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Markus<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">"Pedro Lobo" <a href="mailto:palobo@gmail.com">
palobo@gmail.com</a> wrote in message <a href="news:FD6832B9-3F1F-48C6-A76F-47A224F1697B@gmail.com">
news:FD6832B9-3F1F-48C6-A76F-47A224F1697B@gmail.com</a>...<br>
Hi Markus,<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">I used msktutil to create the keytab.<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">msktutil -c -s HTTP/proxy01tst.fake.net -h proxy01tst.fake.net -k /etc/squid3/PROXY.keytab --computer-name proxy01-tst --upn HTTP/proxy01tst.fake.net --server srv01.fake.net --verbose<br>
Output of klist -ekt:<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">2 10/24/2014 22:59:50
<a href="mailto:proxy01-tst$@FAKE.NET">proxy01-tst$@FAKE.NET</a> (arcfour-hmac)<br>
2 10/24/2014 22:59:50 <a href="mailto:proxy01-tst$@FAKE.NET">proxy01-tst$@FAKE.NET</a> (aes128-cts-hmac-sha1-96)<br>
2 10/24/2014 22:59:50 <a href="mailto:proxy01-tst$@FAKE.NET">proxy01-tst$@FAKE.NET</a> (aes256-cts-hmac-sha1-96)<br>
2 10/24/2014 22:59:50 HTTP/<a href="mailto:proxy01tst.FAKE.net@FAKE.NET">proxy01tst.FAKE.net@FAKE.NET</a> (arcfour-hmac)<br>
2 10/24/2014 22:59:50 HTTP/<a href="mailto:proxy01tst.FAKE.net@FAKE.NET">proxy01tst.FAKE.net@FAKE.NET</a> (aes128-cts-hmac-sha1-96)<br>
2 10/24/2014 22:59:50 HTTP/<a href="mailto:proxy01tst.FAKE.net@FAKE.NET">proxy01tst.FAKE.net@FAKE.NET</a> (aes256-cts-hmac-sha1-96)<br>
2 10/24/2014 22:59:50 host/<a href="mailto:proxy01tst.FAKE.net@FAKE.NET">proxy01tst.FAKE.net@FAKE.NET</a> (arcfour-hmac)<br>
2 10/24/2014 22:59:50 host/<a href="mailto:proxy01tst.FAKE.net@FAKE.NET">proxy01tst.FAKE.net@FAKE.NET</a> (aes128-cts-hmac-sha1-96)<br>
2 10/24/2014 22:59:50 host/<a href="mailto:proxy01tst.FAKE.net@FAKE.NET">proxy01tst.FAKE.net@FAKE.NET</a> (aes256-cts-hmac-sha1-96)<br>
Yep, using MIT Kerberos<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Thanks in advance for any help.<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Cheers,<br>
Pedro<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">On 25 Oct 2014, at 1:26, Markus Moeller wrote:<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Hi Pedro,<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">How did you create your keytab ? What does klist –ekt <squid.keytab> show ( I assume you use MIT Kerberos) ?<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Markus<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">"Pedro Lobo" <a href="mailto:palobo@gmail.com">
palobo@gmail.com</a> wrote in message <a href="news:40E1E0E7-50C6-4117-94AA-50B06573430A@gmail.com">
news:40E1E0E7-50C6-4117-94AA-50B06573430A@gmail.com</a>...<br>
Hi Squid Gurus,<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">I'm at my wit's end and in dire need of some squid expertise.<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">We've got a production environment with a couple of squid 2.7 servers using NTLM and basic authentication. Recently though, we decided to upgrade and I'm now setting up squid 3.3 with Kerberos
and NTLM Fallback. I've followed just about every guide I could find and in my testing environment, things were working great. Now that I've hooked it up to the main domain, things are awry.<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">If I use a machine that's not part of the domain, NTLM kicks in and I can surf the web fine. If I use a Windows XP or Windows Server 2003, kerberos works just fine, however, if I use a machine
Windows 7, 8 or 2008 server, I keep getting a popup asking me to authenticate and even then, it's and endless loop until it fails. My cache.log is littered with:<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">negotiate_kerberos_auth.cc(200): pid=1607 :2014/10/24 23:03:01| negotiate_kerberos_auth: ERROR: gss_accept_sec_context() failed: Unspecified GSS failure. Minor code may provide more information.<br>
2014/10/24 23:03:01| ERROR: Negotiate Authentication validating user. Error returned 'BH gss_accept_sec_context() failed: Unspecified GSS failure. Minor code may provide more information. '<br>
The odd thing, is that this has worked before. Help me Obi Wan... You're my only hope! :)<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Current Setup<br>
Squid 3.3 running on Ubuntu 14.04 server. It's connected to a 2003 server with function level 2000 (I know, we're trying to fase out the older servers).<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">krb5.conf<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">[libdefaults]<br>
default_realm = FAKE.NET<br>
dns_lookup_kdc = yes<br>
dns_lookup_realm = yes<br>
ticket_lifetime = 24h<br>
default_keytab_name = /etc/squid3/PROXY.keytab<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">; for Windows 2003<br>
default_tgs_enctypes = rc4-hmac des-cbc-crc des-cbc-md5<br>
default_tkt_enctypes = rc4-hmac des-cbc-crc des-cbc-md5<br>
permitted_enctypes = rc4-hmac des-cbc-crc des-cbc-md5<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">[realms]<br>
FAKE.NET = {<br>
kdc = srv01.fake.net<br>
kdc = srv02.fake.net<br>
kdc = srv03.fake.net<br>
admin_server = srv01.fake.net<br>
default_domain = fake.net<br>
}<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">[domain_realm]<br>
.fake.net = FAKE.NET<br>
fake.net = FAKE.NET<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">[logging]<br>
kdc = FILE:/var/log/kdc.log<br>
admin_server = FILE:/var/log/kadmin.log<br>
default = FILE:/var/log/krb5lib.log<br>
squid.conf<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">auth_param negotiate program /usr/lib/squid3/negotiate_kerberos_auth -d -r -s HTTP/proxy01tst.fake.net<br>
auth_param negotiate children 20 startup=0 idle=1<br>
auth_param negotiate keep_alive off<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">auth_param ntlm program /usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp --domain=FAKE.NET<br>
auth_param ntlm children 10<br>
auth_param ntlm keep_alive off<br>
Cheers,<br>
Pedro<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Cumprimentos<br>
Pedro Lobo<br>
Solutions Architect | System Engineer<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black"><a href="mailto:pedro.lobo@pt.clara.net">pedro.lobo@pt.clara.net</a><br>
Tlm.: +351 939 528 827 | Tel.: +351 214 127 314<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Claranet Portugal<br>
Ed. Parque Expo<br>
Av. D. João II, 1.07-2.1, 4º Piso<br>
1998-014 Lisboa<br>
<a href="http://www.claranet.pt">www.claranet.pt</a><o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Empresa certificada ISO 9001, ISO 20000 e ISO 27001<o:p></o:p></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-family:"Calibri","sans-serif";color:black">
<hr size="2" width="100%" align="center">
</span></div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-family:"Calibri","sans-serif";color:black">
<hr size="2" width="100%" align="center">
</span></div>
<p><span style="font-family:"Calibri","sans-serif";color:black">squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><o:p></o:p></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-family:"Calibri","sans-serif";color:black">
<hr size="2" width="100%" align="center">
</span></div>
<p><span style="font-family:"Calibri","sans-serif";color:black">squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Cumprimentos<br>
Pedro Lobo<br>
Solutions Architect | System Engineer<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black"><a href="mailto:pedro.lobo@pt.clara.net">pedro.lobo@pt.clara.net</a><br>
Tlm.: +351 939 528 827 | Tel.: +351 214 127 314<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Claranet Portugal<br>
Ed. Parque Expo<br>
Av. D. João II, 1.07-2.1, 4º Piso<br>
1998-014 Lisboa<br>
<a href="http://www.claranet.pt">www.claranet.pt</a><o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Empresa certificada ISO 9001, ISO 20000 e ISO 27001<o:p></o:p></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-family:"Calibri","sans-serif";color:black">
<hr size="2" width="100%" align="center">
</span></div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-family:"Calibri","sans-serif";color:black">
<hr size="2" width="100%" align="center">
</span></div>
<p><span style="font-family:"Calibri","sans-serif";color:black">squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><o:p></o:p></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-family:"Calibri","sans-serif";color:black">
<hr size="2" width="100%" align="center">
</span></div>
<p><span style="font-family:"Calibri","sans-serif";color:black">squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><o:p></o:p></span></p>
</blockquote>
</div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-family:"Calibri","sans-serif";color:black">
<hr size="2" width="100%" align="center">
</span></div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><br>
<br>
__________ Information from ESET Smart Security, version of virus signature database 10628 (20141027) __________<br>
<br>
The message was checked by ESET Smart Security.<br>
<br>
<a href="http://www.eset.com">http://www.eset.com</a><o:p></o:p></p>
</div>
</blockquote>
</div>
</div>
<br>
<br>
__________ Information from ESET Smart Security, version of virus signature database 10628 (20141027) __________<br>
<br>
The message was checked by ESET Smart Security.<br>
<br>
<a href="http://www.eset.com">http://www.eset.com</a><br>
</body>
</html>