<div dir="ltr"><div><div>Hi Markus, thank you for help me.<br><br>When I type the klist command, the result is:<br><br>Ticket cache: FILE:/tmp/krb5cc_0<br>Default principal: <a href="mailto:robert@CMS.ENSINO.BR">robert@CMS.ENSINO.BR</a><br>Valid starting Expires Service principal<br>28-08-2016 22:40:53 29-08-2016 08:40:53 krbtgt/<a href="mailto:CMS.ENSINO.BR@CMS.ENSINO.BR">CMS.ENSINO.BR@CMS.ENSINO.BR</a><br> renew until 29-08-2016 22:40:41<br><br>But, I have the following result to command bellow:<br>/usr/lib64/squid/negotiate_kerberos_auth_test <a href="http://proxy.cms.ensino.br">proxy.cms.ensino.br</a>| awk '{sub(/Token:/,"YR"); print $0}END{print "QQ"}' | /usr/lib64/squid/negotiate_kerberos_auth -r -s HTTP/<a href="http://proxy.cms.ensino.br">proxy.cms.ensino.br</a> <br><br>Result:<br>TT oYGbMIGYoAMKAQGhCAYGKwYBBQIFooGGBIGDBQEwFKESBBBDTUIuRU5TSU5PLkVCLkJSfmkwZ6ADAgEFoQMCAR6iERgPMjAxNjA4MjkwMTM2MDVaowUCAwK7P6QRGA8yMDE2MDgyOTAxMzYwNVqlBQIDBhpppgMCAQepFRsTPHVuc3BlY2lmaWVkIHJlYWxtPqoLMAmgAwIBAKECMAA=<br>BH quit command<br><br><br>The HTTP/<a href="http://proxy.cms.ensino.br">proxy.cms.ensino.br</a> is in keytab files<br><br>I don't have the "test_negotiate_auth.sh" file in src/auth/negotiate/kerberos, but I have /usr/lib64/squid/negotiate_kerberos_auth_test, thus I'm using it.<br><br>My Linux distribution is CentOS 7<br><br></div>Regards,<br><br></div>Márcio<br><div><div><br><br><br></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-08-28 15:24 GMT-03:00 Markus Moeller <span dir="ltr"><<a href="mailto:huaraz@moeller.plus.com" target="_blank">huaraz@moeller.plus.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div dir="ltr">
<div style="FONT-SIZE:10pt;FONT-FAMILY:'Arial';COLOR:#000000">
<div> </div>
<div>HI Marcio,</div>
<div> </div>
<div> The helper need a Kerberos token as input. Please have a look
at test_negotiate_auth.sh which is in src/auth/negotiate/kerberos of the
trunk version. The squid hostname must match the entry in your keytab and you
must have done kinit to authenticate against a Kerberos server (e.g. AD) as user
first.</div>
<div> </div>
<div>Regards</div>
<div>Markus </div>
<div> </div>
<div> </div>
<div style="BORDER-TOP-COLOR:#000000;BORDER-BOTTOM-COLOR:#000000;PADDING-LEFT:5px;MARGIN-LEFT:5px;BORDER-LEFT:#000000 4px solid;BORDER-RIGHT-COLOR:#000000">
<div style="FONT-SIZE:small;TEXT-DECORATION:none;FONT-FAMILY:"Calibri";FONT-WEIGHT:normal;COLOR:#000000;FONT-STYLE:normal;DISPLAY:inline">
<div>"Marcio Demetrio Bacci" <<a href="mailto:marciobacci@gmail.com" target="_blank">marciobacci@gmail.com</a>> wrote in message
news:CA+<wbr>0TdyqEAt4L5KO4zrJNJ1aUe64mY2Re<wbr>7z95KFdqW7Y8SV_qbg@mail.gmail.<wbr>com...</div></div></div>
<div style="BORDER-TOP-COLOR:#000000;BORDER-BOTTOM-COLOR:#000000;PADDING-LEFT:5px;MARGIN-LEFT:5px;BORDER-LEFT:#000000 4px solid;BORDER-RIGHT-COLOR:#000000">
<div style="FONT-SIZE:small;TEXT-DECORATION:none;FONT-FAMILY:"Calibri";FONT-WEIGHT:normal;COLOR:#000000;FONT-STYLE:normal;DISPLAY:inline"><div><div class="h5">
<div dir="ltr">
<div>
<div>I have trouble to authenticate Squid3 with kerberos in Samba4 domain. I'm
using CentOS 7 and Squid 3.3.8 (yum install squid)<br><br></div>
<div>When I type the bellow command in terminal:
<br>/usr/lib64/squid/negotiate_<wbr>kerberos_auth -d -i -s
HTTP/<a>proxy.cms.ensino.br@CMS.<wbr>ENSINO.BR</a><br>john xyz@12345<br><br>I have
the following error:<br>negotiate_kerberos_auth.cc(<wbr>315): pid=6364 :2016/08/27
10:44:33| negotiate_kerberos_auth: DEBUG: Got 'john xyz@12345' from squid
(length: 14).<br>negotiate_kerberos_auth.cc(<wbr>362): pid=6364 :2016/08/27 10:44:33|
negotiate_kerberos_auth: ERROR: Invalid request [john xyz@12345]<br>BH invalid
request <br><br><br>Here are my files
configuration:<br><br>/etc/krb5.conf<br>[libdefaults]<br>
default_realm = <a href="http://CMS.ENSINO.BR" target="_blank">CMS.ENSINO.BR</a><br>[realms]<br>
<a href="http://CMS.ENSINO.BR" target="_blank">CMS.ENSINO.BR</a> = {<br> kdc =
<a href="http://dc1.cms.ensino.br:88" target="_blank">dc1.cms.ensino.br:88</a><br>
admin_server = <a href="http://dc1.cms.ensino.br" target="_blank">dc1.cms.ensino.br</a><br>
default_domain = <a href="http://CMS.ENSINO.BR" target="_blank">CMS.ENSINO.BR</a>
<br> }<br>[domain_realm]<br> .<a href="http://cms.ensino.br" target="_blank">cms.ensino.br</a> = <a href="http://CMS.ENSINO.BR" target="_blank">CMS.ENSINO.BR</a><br> <a href="http://cms.ensino.br" target="_blank">cms.ensino.br</a> = <a href="http://CMS.ENSINO.BR" target="_blank">CMS.ENSINO.BR</a><br><br><br><br>Keytab name:
FILE:/etc/krb5.keytab<br>KVNO Principal<br>----
------------------------------<wbr>------------------------------<wbr>--------------<br>
1 proxy-k$@<a href="http://CMS.ENSINO.BR" target="_blank">CMS.ENSINO.BR</a><br> 1
proxy-k$@<a href="http://CMS.ENSINO.BR" target="_blank">CMS.ENSINO.BR</a><br> 1
proxy-k$@<a href="http://CMS.ENSINO.BR" target="_blank">CMS.ENSINO.BR</a><br> 1
HTTP/<a>proxy.cms.ensino.br@CMS.<wbr>ENSINO.BR</a><br> 1
HTTP/<a>proxy.cms.ensino.br@CMS.<wbr>ENSINO.BR</a><br> 1
HTTP/<a>proxy.cms.ensino.br@CMS.<wbr>ENSINO.BR</a><br> 1
host/<a>proxy.cms.ensino.br@CMS.<wbr>ENSINO.BR</a><br> 1
host/<a>proxy.cms.ensino.br@CMS.<wbr>ENSINO.BR</a><br> 1
host/<a>proxy.cms.ensino.br@CMS.<wbr>ENSINO.BR</a><br> 1
host/<a>proxy.cms.ensino.br@CMS.<wbr>ENSINO.BR</a><br> 1
host/<a>proxy.cms.ensino.br@CMS.<wbr>ENSINO.BR</a><br> 1
host/<a>PROXY@CMS.ENSINO.BR</a><br> 1
host/<a>PROXY@CMS.ENSINO.BR</a><br> 1
host/<a>PROXY@CMS.ENSINO.BR</a><br> 1
host/<a>PROXY@CMS.ENSINO.BR</a><br> 1
host/<a>PROXY@CMS.ENSINO.BR</a><br> 1 PROXY$@<a href="http://CMS.ENSINO.BR" target="_blank">CMS.ENSINO.BR</a><br> 1 PROXY$@<a href="http://CMS.ENSINO.BR" target="_blank">CMS.ENSINO.BR</a><br> 1 PROXY$@<a href="http://CMS.ENSINO.BR" target="_blank">CMS.ENSINO.BR</a><br> 1 PROXY$@<a href="http://CMS.ENSINO.BR" target="_blank">CMS.ENSINO.BR</a><br> 1 PROXY$@<a href="http://CMS.ENSINO.BR" target="_blank">CMS.ENSINO.BR</a><br> 1 proxy-k$@<a href="http://CMS.ENSINO.BR" target="_blank">CMS.ENSINO.BR</a><br> 1 proxy-k$@<a href="http://CMS.ENSINO.BR" target="_blank">CMS.ENSINO.BR</a><br> 1
HTTP/<a>proxy.cms.ensino.br@CMS.<wbr>ENSINO.BR</a><br> 1
HTTP/<a>proxy.cms.ensino.br@CMS.<wbr>ENSINO.BR</a><br> 1
HTTP/<a>PROXY@CMS.ENSINO.BR</a><br> 1
HTTP/<a>PROXY@CMS.ENSINO.BR</a><br> 1
HTTP/<a>PROXY@CMS.ENSINO.BR</a><br> 1
HTTP/<a>PROXY@CMS.ENSINO.BR</a><br> 1
HTTP/<a>PROXY@CMS.ENSINO.BR</a><br><br><br>Keytab name:
FILE:/etc/squid/PROXY.keytab<br>KVNO Principal<br>----
------------------------------<wbr>------------------------------<wbr>--------------<br>
1 proxy-k$@<a href="http://CMS.ENSINO.BR" target="_blank">CMS.ENSINO.BR</a><br> 1
proxy-k$@<a href="http://CMS.ENSINO.BR" target="_blank">CMS.ENSINO.BR</a><br> 1
proxy-k$@<a href="http://CMS.ENSINO.BR" target="_blank">CMS.ENSINO.BR</a><br> 1
HTTP/<a>proxy.cms.ensino.br@CMS.<wbr>ENSINO.BR</a><br> 1
HTTP/<a>proxy.cms.ensino.br@CMS.<wbr>ENSINO.BR</a><br> 1
HTTP/<a>proxy.cms.ensino.br@CMS.<wbr>ENSINO.BR</a><br> 1
host/<a>proxy.cms.ensino.br@CMS.<wbr>ENSINO.BR</a><br> 1
host/<a>proxy.cms.ensino.br@CMS.<wbr>ENSINO.BR</a><br> 1
host/<a>proxy.cms.ensino.br@CMS.<wbr>ENSINO.BR</a><br><br><br>/etc/sysconfig/squid<br>#
default squid options<br>SQUID_OPTS=""<br># Time to wait for Squid to shut down
when asked. Should not be necessary<br># most of the
time.<br>SQUID_SHUTDOWN_TIMEOUT=100<br># default squid conf
file<br>SQUID_CONF="/etc/squid/squid.<wbr>conf"<br><br>KRB5_KTNAME=/etc/squid/PROXY.<wbr>keytab<br>export
KRB5_KTNAME<br><br><br></div>
<div>kinit and klist commands are OK.<br></div>
<div> </div>Best Regards,<br><br></div>Márcio<br>
<div>
<div>
<div> </div></div></div></div>
</div></div><p>
</p><hr>
______________________________<wbr>_________________<br>squid-users mailing
list<br><a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.<wbr>org</a><br><a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank">http://lists.squid-cache.org/<wbr>listinfo/squid-users</a><br><p></p></div></div></div></div></div>
<br>______________________________<wbr>_________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.<wbr>org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/<wbr>listinfo/squid-users</a><br>
<br></blockquote></div><br></div>