<p dir="ltr">Note the lack of a user-agent string. This is likely an app that cannot authenticate.</p>
<p dir="ltr">My standard for Auth Bypass is source IP, user-agent string and destination URL. Generally the source is preferred to be statically assigned otherwise you need to allow the entire dhcp pool or range. Because there is no user-agent you can drop the requirement or force it with some sort of negated logic (!any)</p>
<div class="gmail_quote">On Apr 8, 2015 11:21 AM, "Samuel Anderson" <<a href="mailto:sam@idsdoc.com">sam@idsdoc.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hello all,<div><br></div><div><br></div><div>I'm having a problem where HTTP 1.1 connect requests do not authenticate using NTLM. Browsing the internet works fine in all major browsers, I mostly see this occurring in programs that are installed locally on a users computer. Using wireshark I'm able to follow the TCP stream and I can see that the server returns the error (407 Proxy Authentication Required). I am able to work around this problem by explicitly bypassing a domain from requiring authentication, however I really don't want to do that. Any ideas would be appreciated very much.</div><div><br></div><div>Thanks,</div><div><br></div><div><br></div><div>Below is the content summery of some of the network packets that I'm working with along with my config file</div><div><br></div><div>TCP Stream Content</div><div><br></div><div>####################<br></div><div><div>CONNECT <a href="http://batch.internetpostage.com:443" target="_blank">batch.internetpostage.com:443</a> HTTP/1.1</div><div>Host: <a href="http://batch.internetpostage.com" target="_blank">batch.internetpostage.com</a><br></div><div>Proxy-Connection: Keep-Alive<br></div><div><br></div><div><br></div><div>HTTP/1.1 407 Proxy Authentication Required</div><div>Server: squid/3.3.8<br></div><div>Mime-Version: 1.0<br></div><div>Date: Tue, 07 Apr 2015 21:02:24 GMT<br></div><div>Content-Type: text/html<br></div><div>Content-Length: 3208<br></div><div>X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0<br></div><div>Proxy-Authenticate: Negotiate<br></div><div>Proxy-Authenticate: NTLM<br></div><div>X-Cache: MISS from squid2.****.local<br></div><div>X-Cache-Lookup: NONE from squid2.****.local:3128<br></div><div>Via: 1.1 squid2.****.local (squid/3.3.8)<br></div><div>Connection: close<br></div><div>####################</div></div><div><div><br></div><div>CONFIG File</div><div><br></div><div>####################<br></div><div><br></div><div><div>#Kerberos and NTLM authentication</div><div><br></div><div>auth_param negotiate program /usr/local/bin/negotiate_wrapper --ntlm /usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp --domain=****.LOCAL --kerberos /usr/lib/squid3/negotiate_kerberos_auth -d -s GSS_C_NO_NAME</div><div>auth_param negotiate children 30</div><div>auth_param negotiate keep_alive off</div><div><br></div><div>auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp --domain=****</div><div>auth_param ntlm children 30</div><div>auth_param ntlm keep_alive off</div></div><div><br></div><div><div># AD group membership lookup</div><div><br></div><div>external_acl_type ldap_group ttl=60 children-startup=10 children-max=50 children-idle=2 %LOGIN /usr/lib/squid3/ext_ldap_group_acl -R -K -S -b "DC=****,DC=local" -D "CN=SQUID,OU=**** Service Accounts,DC=****,DC=local" -w "****" -f "(&(objectclass=person) (sAMAccountname=%v)(memberof=CN=%a,OU=PROXY,ou=ALL **** Groups,DC=**** ,DC=local))" -h dc1.****.local,dc2.****.local,dc3.****.local,dc4.****.local</div></div><div><br></div><div># auth required</div><div><br></div><div>acl auth proxy_auth REQUIRED<br></div><div>http_access deny !auth all<br></div><div><br></div><div>####################<br></div><div><br></div>-- <br><div><div dir="ltr"><font face="arial, helvetica, sans-serif">Samuel Anderson | Information Technology Administrator | International Document Services</font><div><font face="arial, helvetica, sans-serif"><br></font></div><div><font face="arial, helvetica, sans-serif">IDS | 11629 South 700 East, Suite 200 | Draper, UT 84020-4607</font></div><div style="text-align:right"><img src="http://nationalmortgageprofessional.com/sites/default/files/images/IDS_Logo_03_12.topstoryimage.jpg" width="96" height="88"><br></div></div></div>
</div></div>
<br>
<div style="font-family:Arial,Helvetica,sans-serif"><font face="Arial, Helvetica, sans-serif" size="4">CONFIDENTIALITY NOTICE:</font></div><div style="font-family:Arial,Helvetica,sans-serif"><font size="4"><font face="Arial, Helvetica, sans-serif" style="font-family:Arial,Helvetica,sans-serif">This e-mail and any attachments are confidential. If you are not an intended recipient, please contact the sender to report the error and delete all copies of this message from your system. </font><font face="Arial, Helvetica, sans-serif">Any unauthorized review, use, disclosure or distribution is prohibited</font><font face="Arial, Helvetica, sans-serif">.</font></font></div><br>_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
<br></blockquote></div>