<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>
<div>Dear Amos,</div>
<div> </div>
<div>i found the problem.</div>
<div>It was a samba issue caused by badlock patch implementation.</div>
<div>Thanks for your assistance and sorry for my wrong mailing-list post, i should have check better the samba logs.</div>
<div> </div>
<div>Giulius.</div>
<div>
<div name="quote" style="margin:10px 5px 5px 10px; padding: 10px 0 10px 10px; border-left:2px solid #C3D9E5; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="margin:0 0 10px 0;"><b>Sent:</b> Saturday, September 03, 2016 at 4:43 AM<br/>
<b>From:</b> "Amos Jeffries" <squid3@treenet.co.nz><br/>
<b>To:</b> "akn ab" <drcimino@mail.com>, squid-users@lists.squid-cache.org<br/>
<b>Subject:</b> Re: [squid-users] Debugging NTLM problem</div>
<div name="quoted-content">On 3/09/2016 3:06 a.m., akn ab wrote:<br/>
> Hello Amos,<br/>
> auth_param ntlm keep_alive off<br/>
> unfortunately does not solve the problem.<br/>
> I did more investigation about the problem and i found informations.<br/>
> Every time a user get the browser popup requesting credentials, i found on squid<br/>
> log this event:<br/>
> Login for user [DOMAIN]\[user]@[PC_XXXX] failed due to [Access denied]<br/>
> NTLMSSP BH: NT_STATUS_ACCESS_DENIED<br/>
> 2016/09/02 16:56:13 kid1| ERROR: NTLM Authentication validating user. Result:<br/>
> {result=BH, notes={message: NT_STATUS_ACCESS_DENIED; }}<br/>
<br/>
That is ntlm_auth (on behalf of AD) telling Squid the user credentials<br/>
are not correct. There is no NTLM protocol problem.<br/>
<br/>
Consider this NT_STATUS_ACCESS_DENIED as if a user entered the wrong<br/>
password. Why do you want to allow them access in that case?<br/>
<br/>
<br/>
> It's not easy to do more debug because i have 9000 concurrent connections, but<br/>
> if you think that can help me, i try to set debug_option to something like 29,5<br/>
> Sometimes users left the office letting the browser open.<br/>
> After 1 hour (more or less), they return to the pc and popup show as soos as<br/>
> mouse point to a new link on the open browser.<br/>
> It's probably because something cached expire, but i cannot demostrate it so<br/>
> easily beceuse, as you said, ntlm never cache.<br/>
> On my samba/winbind logs i see many<br/>
> rpccli_netlogon_sam_network_logon: credentials chain check failed<br/>
> So it's very strange to understand if some problem occur beetween squid and<br/>
> browser or samba and Active Directory.<br/>
> What do you think about?<br/>
> Thanks.<br/>
> Giulius.<br/>
><br/>
> On 1/09/2016 12:37 a.m., akn ab wrote:<br/>
> > Dear all,<br/>
> > i'm facing a strange problem using squid 3.5.20 with ntlm transparent<br/>
> > authentication.<br/>
> > I cannot use kerberos auth because i need to pass DOMAIN\user to my parent proxy<br/>
> > with x-authenticated-user header, and the form USERNAME@DOMAIN is not supported.<br/>
<br/>
I suggest you use an external_acl_type helper that takes the %LOGIN<br/>
format parameter and sends 'OK upstream_user_="..." ' back to Squid. Use<br/>
the %note{upstream_user_} in your request_header_add directive to send<br/>
the right header value upstream.<br/>
<br/>
That will allow you to at least keep your part of the proxy chain using<br/>
secure Negotiate authentication even though the parent proxy allows<br/>
anyone to inject traffic spoofing your user accounts.<br/>
<br/>
Amos<br/>
</div>
</div>
</div>
</div></div></body></html>