<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:10px"><div id="yui_3_16_0_ym19_1_1489080309484_7258"><span id="yui_3_16_0_ym19_1_1489080309484_7331"><font size="3">Here is the conf file.</font></span></div><div id="yui_3_16_0_ym19_1_1489080309484_7258"><span><br></span></div><div id="yui_3_16_0_ym19_1_1489080309484_7415">http_port 3128</div><div id="yui_3_16_0_ym19_1_1489080309484_7416" dir="ltr">cache_peer <corp_proxy_IP> parent <Parent_proxy_port> 0 no-query default proxy-only login=NEGOTIATE </div><div id="yui_3_16_0_ym19_1_1489080309484_7417"><br id="yui_3_16_0_ym19_1_1489080309484_7418"></div><div id="yui_3_16_0_ym19_1_1489080309484_7419">acl manager proto cache_object</div><div id="yui_3_16_0_ym19_1_1489080309484_7420">acl localhost src 127.0.0.1/255.255.255.255</div><div id="yui_3_16_0_ym19_1_1489080309484_7421">acl all src 0.0.0.0/0.0.0.0</div><div id="yui_3_16_0_ym19_1_1489080309484_7422">http_access allow all</div><div id="yui_3_16_0_ym19_1_1489080309484_7423">never_direct allow all</div><div id="yui_3_16_0_ym19_1_1489080309484_7424">icp_access deny all</div><div id="yui_3_16_0_ym19_1_1489080309484_7425"><br id="yui_3_16_0_ym19_1_1489080309484_7426"></div><div id="yui_3_16_0_ym19_1_1489080309484_7427">cache_effective_user squid</div><div id="yui_3_16_0_ym19_1_1489080309484_7428">#cache_effective_group wheel</div><div id="yui_3_16_0_ym19_1_1489080309484_7429"><br id="yui_3_16_0_ym19_1_1489080309484_7430"></div><div id="yui_3_16_0_ym19_1_1489080309484_7258"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1489080309484_7431">max_filedescriptors 3200</div><div></div><div id="yui_3_16_0_ym19_1_1489080309484_7259"> </div><div id="yui_3_16_0_ym19_1_1489080309484_7259" dir="ltr"><font size="3" id="yui_3_16_0_ym19_1_1489080309484_7758">I am not sure what is it that I am missing. I have been wire sharking both the resultant packets when using CNTLM and when using squid, I can see the proxy auth header piece in the Squid packet missing.</font></div><div id="yui_3_16_0_ym19_1_1489080309484_7259" dir="ltr"><br></div><div class="signature" id="yui_3_16_0_ym19_1_1489080309484_7261"><div id="yui_3_16_0_ym19_1_1489080309484_7260"><font face="arial, helvetica, sans-serif">Cheers</font></div><div id="yui_3_16_0_ym19_1_1489080309484_7262"><font face="Arial" id="yui_3_16_0_ym19_1_1489080309484_7272">S.V.Hareesh</font></div><div id="yui_3_16_0_ym19_1_1489080309484_7263"><font face="Arial" id="yui_3_16_0_ym19_1_1489080309484_7271"><a rel="nofollow" target="_blank" href="http://svhareesh.blogspot.com/" id="yui_3_16_0_ym19_1_1489080309484_7270">http://svhareesh.blogspot.com</a></font></div><div id="yui_3_16_0_ym19_1_1489080309484_7264"><em><font face="verdana, helvetica, sans-serif" color="#ff0000"></font></em> </div><div id="yui_3_16_0_ym19_1_1489080309484_7268"><br></div></div> <div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif; font-size: 10px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif; font-size: 16px;"> <div dir="ltr"><font size="2" face="Arial"> On Thursday, 9 March 2017 5:20 PM, Amos Jeffries <squid3@treenet.co.nz> wrote:<br></font></div> <br><br> <div class="y_msg_container">On 10/03/2017 6:00 a.m., S V Hareesh wrote:<br clear="none">> Ok, I tried that but it didnt work. I can put a conf file here. As a<br clear="none">> start I am currently in a scenario trying to replace a simple CNTLM<br clear="none">> HTTP proxy with Squid. I want to configure one account which<br clear="none">> authenticates with parent proxy send the downstream requests with out<br clear="none">> taking any creds.<br clear="none"><br clear="none">If your CNTLM was running on the Squid machine and using the credentials<br clear="none">for the service account you have setup Squid to use now - then the<br clear="none">cache_peer login=NEGOTIATE should make Squid operate as equivalent to<br clear="none">what CNTLM was doing.<br clear="none"><br clear="none">The config file would be useful for anyone who follows up (not just me,<br clear="none">who will be out of time shortly for another few days).<br clear="none"><br clear="none">Also, if you can track what HTTP messages are happening and whether the<br clear="none">Kerberos is working properly for the Squid->parent messages it would be<br clear="none">useful.<br clear="none"><br clear="none">The current Squid can provide HTTP details in cache.log with<br clear="none">"debug_options 11,2". I'm not sure how you would test the Kerberos on a<br clear="none">Windows installation, but the Negotiate auth headers in those messages<br clear="none">might give a few clues anyway.<br clear="none"><br clear="none">HTH<br clear="none">Amos<br clear="none"><br clear="none"><br clear="none">> On Thu, Mar 9, 2017 at 4:50 PM, Amos Jeffrieswrote:<div class="yqt7428556110" id="yqtfd47234"><br clear="none">>> On 10/03/2017 5:19 a.m., S V Hareesh wrote:<br clear="none">>> On top of the conf file from default setup on Windows, I added the following line in the conf. I added the dns servers and allowed localhost.<br clear="none">>><br clear="none">>> cache_peer <corporate_proxy> parent 80 0 default connection-auth=on proxy-only<br clear="none">>><br clear="none">>> never_direct allow all<br clear="none">>><br clear="none">>> When I point my browser to this proxy, it gives me 407, auth required. <br clear="none">>><br clear="none">>> Also, configured squid service on windows to run with a service account that has access to Internet/corp proxy.<br clear="none">> <br clear="none">> Squid cannot authenticate to a cache_peer using NTLM. It can only do<br clear="none">> Nagotiate/Kerberos to the parent proxy, and only when "login=NEGOTIATE"<br clear="none">> is added (with or without a named keytab file).<br clear="none">> <br clear="none">> NOTE: 'connection-auth=on' is about allowing the browser to use NTLM or<br clear="none">> Negotiate/Kerberos through the cache_peer. It needs to also have<br clear="none">> "login=PASSTHRU" if that peer is a proxy (as opposed to a web or<br clear="none">> Exchange server).<br clear="none">> <br clear="none">> See the 'AUTHENTICATION OPTIONS' section of<br clear="none">> <<a shape="rect" href="http://www.squid-cache.org/Doc/config/cache_peer/" target="_blank">http://www.squid-cache.org/Doc/config/cache_peer/</a>><br clear="none">> <br clear="none">> Amos<br clear="none">> <br clear="none">> _______________________________________________<br clear="none">> squid-users mailing list<br clear="none">> <a shape="rect" ymailto="mailto:squid-users@lists.squid-cache.org" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br clear="none">> <a shape="rect" href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br clear="none">> <br clear="none">> <br clear="none"><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>