<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office"><head><!--[if gte mso 9]><xml><o:OfficeDocumentSettings><o:AllowPNG/><o:PixelsPerInch>96</o:PixelsPerInch></o:OfficeDocumentSettings></xml><![endif]--></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:10px"><div id="yiv6487818463"><div id="yui_3_16_0_ym19_1_1490097880481_11309"><div style="background-color: rgb(255, 255, 255);" id="yui_3_16_0_ym19_1_1490097880481_11308"><div id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_7501" style="color: rgb(0, 0, 0); font-family: HelveticaNeue, "Helvetica Neue", Helvetica, Arial, "Lucida Grande", sans-serif; font-size: 10px;"><font size="3">Hi,</font></div><div id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_7501" style="color: rgb(0, 0, 0); font-family: HelveticaNeue, "Helvetica Neue", Helvetica, Arial, "Lucida Grande", sans-serif; font-size: 10px;"><font size="3"><br></font></div><div id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_7501" dir="ltr" style="color: rgb(0, 0, 0); font-family: HelveticaNeue, "Helvetica Neue", Helvetica, Arial, "Lucida Grande", sans-serif; font-size: 10px;"><font size="3" id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_8083">I am trying to setup Squid as a local HTTP child proxy to a parent/corporate Cisco Ironport WSA proxy. I need help in setting up authentication(Negotiate) to be done automatically from any client who is trying to access internet through the child proxy. So here is what I did.</font></div><div id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_7501" dir="ltr" style="color: rgb(0, 0, 0); font-family: HelveticaNeue, "Helvetica Neue", Helvetica, Arial, "Lucida Grande", sans-serif; font-size: 10px;"><font size="3"><br></font></div><div id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_7501" dir="ltr"><ul id="yui_3_16_0_ym19_1_1490097880481_12244"><li id="yui_3_16_0_ym19_1_1490097880481_12245"><font size="3" id="yui_3_16_0_ym19_1_1490097880481_12261">Installed Squid on Windows machine with the installable given by Diladele v 3.5.24. Configured the service to run with an account (domain\account1) that has admin rights to that machine.<br></font></li><li id="yui_3_16_0_ym19_1_1490097880481_12243"><font size="3" id="yui_3_16_0_ym19_1_1490097880481_12260">Got a keytab file for the account and host from our AD Admins. Here is the command run to get the keytab file.</font><br></li></ul></div><div dir="ltr" id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_9819" style="color: rgb(0, 0, 0);"><font id="yui_3_16_0_ym19_1_1490097880481_11649"><font size="3"> </font><font face="Courier New, courier, monaco, monospace, sans-serif" size="2" id="yui_3_16_0_ym19_1_1490097880481_12242">ktpass /princ <a rel="nofollow" ymailto="mailto:HTTP/BP1LCSIS015.bp1.ad.bp.com@BP1.AD.BP.COM" target="_blank" href="mailto:HTTP/BP1LCSIS015.bp1.ad.bp.com@BP1.AD.BP.COM" id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_9820">HTTP/server1.subdomain.domain.com@SUBDOMAIN.DOMAIN.COM</a>
/mapuser <span id="yui_3_16_0_ym19_1_1490097880481_11549">domain\account1</span> /crypto all /pass <password_for_account1> /ptype
KRB5_NT_PRINCIPAL /out account.keytab</font></font></div><div dir="ltr" id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_9819" style="color: rgb(0, 0, 0); font-family: HelveticaNeue, "Helvetica Neue", Helvetica, Arial, "Lucida Grande", sans-serif;"><font size="3" id="yui_3_16_0_ym19_1_1490097880481_12171"><br id="yui_3_16_0_ym19_1_1490097880481_12170"></font></div><div dir="ltr" id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_9819"><ul id="yui_3_16_0_ym19_1_1490097880481_12205"><li style="color: rgb(0, 0, 0); font-family: HelveticaNeue, "Helvetica Neue", Helvetica, Arial, "Lucida Grande", sans-serif;" id="yui_3_16_0_ym19_1_1490097880481_12207"><font size="3" id="yui_3_16_0_ym19_1_1490097880481_12394">Copied that keytab file into etc\squid folder of my Windows installation of Squid.<br></font></li><li id="yui_3_16_0_ym19_1_1490097880481_12206"><font size="3"><br></font></li><li id="yui_3_16_0_ym19_1_1490097880481_12204"><font size="3" id="yui_3_16_0_ym19_1_1490097880481_13209">Set the following configuration in squid.conf.<br></font></li></ul></div><div dir="ltr" id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_9819" style="color: rgb(0, 0, 0); font-family: HelveticaNeue, "Helvetica Neue", Helvetica, Arial, "Lucida Grande", sans-serif;"><font size="3"><br></font></div><div dir="ltr" id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_9819"><font id="yui_3_16_0_ym19_1_1490097880481_11824" face="Courier New, courier, monaco, monospace, sans-serif" size="2"><div dir="ltr" id="yui_3_16_0_ym19_1_1490097880481_11825">http_port 3128</div><div dir="ltr" id="yui_3_16_0_ym19_1_1490097880481_11833">cache_peer <parent_proxy_Ip> parent 80 0 no-query default proxy-only login=NEGOTIATE</div><div dir="ltr" id="yui_3_16_0_ym19_1_1490097880481_11834"><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1490097880481_11839">http_access allow all</div><div dir="ltr" id="yui_3_16_0_ym19_1_1490097880481_11840">never_direct allow all</div><div dir="ltr" id="yui_3_16_0_ym19_1_1490097880481_11841">icp_access deny all</div><div dir="ltr" id="yui_3_16_0_ym19_1_1490097880481_11842"><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1490097880481_11882">dns_nameservers <DNS_IP1> <DNS_IP2> 127.0.0.1</div></font></div><div id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_7501" dir="ltr" style="color: rgb(0, 0, 0); font-family: HelveticaNeue, "Helvetica Neue", Helvetica, Arial, "Lucida Grande", sans-serif; font-size: 10px;"><font size="3"><br></font></div><div id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_7501" dir="ltr" style="color: rgb(0, 0, 0); font-family: HelveticaNeue, "Helvetica Neue", Helvetica, Arial, "Lucida Grande", sans-serif;"><font size="3" id="yui_3_16_0_ym19_1_1490097880481_12339">My objective is **any allowed client** irrespective of Unix/Windows/domain/non-domain users should be able to reach to internet. I will set up ACL to specify the IP addresses to use this proxy later. But for now, I am getting a 407 error from any machine trying to use this proxy. I am not sure what is going wrong. Please advise.</font></div><div id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_7501" dir="ltr" style="color: rgb(0, 0, 0); font-family: HelveticaNeue, "Helvetica Neue", Helvetica, Arial, "Lucida Grande", sans-serif;"><font size="3"><br></font></div><div id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_7501" dir="ltr" style="color: rgb(0, 0, 0); font-family: HelveticaNeue, "Helvetica Neue", Helvetica, Arial, "Lucida Grande", sans-serif;"><font size="3" id="yui_3_16_0_ym19_1_1490097880481_13345">I was looking at this link as well.</font></div><div id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_7501" dir="ltr" style="color: rgb(0, 0, 0); font-family: HelveticaNeue, "Helvetica Neue", Helvetica, Arial, "Lucida Grande", sans-serif;"><font size="3"><br></font></div><div id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_7501" dir="ltr"><font size="3" id="yui_3_16_0_ym19_1_1490097880481_13169"><a href="http://squid-web-proxy-cache.1019090.n4.nabble.com/Parent-proxy-with-authentication-td4665689.html" class="enhancr2_176fcf1c-b910-38c5-6dea-d62e7dd466a8" id="yui_3_16_0_ym19_1_1490097880481_13168">Squid - Users - Parent proxy with authentication</a><br></font></div><div id="yui_3_16_0_ym19_1_1490097880481_13189"><br></div><div id="enhancr2_176fcf1c-b910-38c5-6dea-d62e7dd466a8" class="yahoo-link-enhancr-card ymail-preserve-class ymail-preserve-style" style="max-width:400px;font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;" contenteditable="false" data-url="http://squid-web-proxy-cache.1019090.n4.nabble.com/Parent-proxy-with-authentication-td4665689.html" data-type="yenhancr" data-category="article" data-embed-url="" data-size="medium" dir="ltr"> <a href="http://squid-web-proxy-cache.1019090.n4.nabble.com/Parent-proxy-with-authentication-td4665689.html" style="text-decoration:none !important; color: #000 !important;" class="yahoo-enhancr-cardlink" target="_blank" rel="noreferrer" id="yui_3_16_0_ym19_1_1490097880481_13226"> <table class="card-wrapper yahoo-ignore-table" cellpadding="0" cellspacing="0" border="0" style="max-width:400px;" id="yui_3_16_0_ym19_1_1490097880481_13225"> <tbody id="yui_3_16_0_ym19_1_1490097880481_13224"><tr id="yui_3_16_0_ym19_1_1490097880481_13223"> <td width="400" id="yui_3_16_0_ym19_1_1490097880481_13222"> <table class="card yahoo-ignore-table" cellpadding="0" cellspacing="0" border="0" width="100%" style="max-width:400px;" id="yui_3_16_0_ym19_1_1490097880481_13221"> <tbody id="yui_3_16_0_ym19_1_1490097880481_13220"><tr id="yui_3_16_0_ym19_1_1490097880481_13219"> <td class="card-primary-image-cell" style="background:#000 url('https://s.yimg.com/vv//api/res/1.2/NnvY92CuAz7_canf5skKag--/YXBwaWQ9bWFpbDtmaT1maWxsO2g9MjAwO3c9NDAw/http://www.gravatar.com/avatar/9c6ca8a4c053d49efad32d1cd2467098?s=100&r=pg&d=http%3A%2F%2Fn4.nabble.com%2Fimages%2Favatar100.png.cf.jpg') no-repeat center center;background-size:cover;height:200px;position:relative;" background="https://s.yimg.com/vv//api/res/1.2/NnvY92CuAz7_canf5skKag--/YXBwaWQ9bWFpbDtmaT1maWxsO2g9MjAwO3c9NDAw/http://www.gravatar.com/avatar/9c6ca8a4c053d49efad32d1cd2467098?s=100&r=pg&d=http%3A%2F%2Fn4.nabble.com%2Fimages%2Favatar100.png.cf.jpg" bgcolor="#000000" valign="top" id="yui_3_16_0_ym19_1_1490097880481_13218"> <!--[if gte mso 9]><v:rect fill="true" stroke="false" style="width:400px;height:218px;position:absolute;top:0;left:0;"><v:fill type="frame" color="#000000" src="https://s.yimg.com/vv//api/res/1.2/NnvY92CuAz7_canf5skKag--/YXBwaWQ9bWFpbDtmaT1maWxsO2g9MjAwO3c9NDAw/http://www.gravatar.com/avatar/9c6ca8a4c053d49efad32d1cd2467098?s=100&r=pg&d=http%3A%2F%2Fn4.nabble.com%2Fimages%2Favatar100.png.cf.jpg"/></v:rect><![endif]--> <table class="yahoo-ignore-table" cellpadding="0" cellspacing="0" border="0" valign="top" style="width:100%;" id="yui_3_16_0_ym19_1_1490097880481_13217"> <tbody id="yui_3_16_0_ym19_1_1490097880481_13216"><tr id="yui_3_16_0_ym19_1_1490097880481_13215"> <td style="background:transparent url('https://s.yimg.com/nq/storm/assets/enhancrV2/12/overlay-tile.png') repeat left top;height:200px;" background="https://s.yimg.com/nq/storm/assets/enhancrV2/12/overlay-tile.png" bgcolor="transparent" valign="top" id="yui_3_16_0_ym19_1_1490097880481_13214"> <!--[if gte mso 9]><v:rect fill="true" stroke="false" style="width:400px;height:218px;position:absolute;top:-18px;left:0;"><v:fill type="pattern" color="#000000" src="https://s.yimg.com/nq/storm/assets/enhancrV2/12/overlay-tile.png"/><v:textbox inset="0,0,20px,0"><![endif]--> <table class="yahoo-ignore-table" height="185" style="width:100%;height:185px;min-height:185px;" id="yui_3_16_0_ym19_1_1490097880481_13213"> <tbody id="yui_3_16_0_ym19_1_1490097880481_13212"><tr id="yui_3_16_0_ym19_1_1490097880481_13211"> <td class="card-richInfo2" style="text-align:left;text-align:left;padding:15px 0 0 15px;vertical-align:top;" id="yui_3_16_0_ym19_1_1490097880481_13210"> </td> <td class="card-actions" style="text-align:right;padding:15px 15px 0 0;vertical-align:top;"> <div class="card-share-container"></div> </td> </tr> </tbody></table> <!--[if gte mso 9]></v:textbox></v:rect><![endif]--> </td> </tr> </tbody></table> </td> </tr> <tr id="yui_3_16_0_ym19_1_1490097880481_13291"> <td id="yui_3_16_0_ym19_1_1490097880481_13290"> <table class="card-info yahoo-ignore-table" align="center" cellpadding="0" cellspacing="0" border="0" style="background:#fff;position:relative;z-index:2;width:95%;max-width:380px;border:1px solid #e0e4e9;border-bottom:3px solid #000000;margin-top:-40px;margin-left:auto;margin-right:auto;" id="yui_3_16_0_ym19_1_1490097880481_13297"> <tbody><tr> <td style="background-color:#ffffff;padding:16px 0 16px 12px;vertical-align:top;"> </td> <td style="vertical-align:middle;padding:16px 12px;width:99%;"> <h2 class="card-title" style="font-size: 16px; line-height:19px; margin:0 0 4px 0;font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;word-break:break-word;">Squid - Users - Parent proxy with authentication</h2> <div class="card-description" style="font-size:11px;line-height:15px;color:#999;word-break:break-word;">Parent proxy with authentication. Hello, can someone please tell me, what my my cache_peer line must look like, ...</div> </td> <td style="text-align:right;padding:16px 12px 16px 0;"> </td> </tr> </tbody></table> </td> </tr> </tbody></table> </td> </tr> </tbody></table> </a></div><div id="yui_3_16_0_ym19_1_1490097880481_13182"><br></div><div id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_7501" dir="ltr" style="color: rgb(0, 0, 0); font-family: HelveticaNeue, "Helvetica Neue", Helvetica, Arial, "Lucida Grande", sans-serif;"><br></div><div id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_7501" dir="ltr" style="color: rgb(0, 0, 0); font-family: HelveticaNeue, "Helvetica Neue", Helvetica, Arial, "Lucida Grande", sans-serif;"><font size="3" id="yui_3_16_0_ym19_1_1490097880481_13296">TIA</font></div><div id="yiv6487818463yui_3_16_0_ym19_1_1490097880481_7501" dir="ltr" style="color: rgb(0, 0, 0); font-family: HelveticaNeue, "Helvetica Neue", Helvetica, Arial, "Lucida Grande", sans-serif;"><br></div></div></div></div></div></body></html>