<div dir="ltr">Hi, everybody.<br>I have a SQUID 4.11 compiled on Debian 9.8 with kerberos integration authenticating and browsing without problems:<br>cache.log<br>squid_kerb_auth: User some.user authenticated<br>access.log<br>10.10.10.203 TCP_TUNNEL/200 5264 CONNECT <a href="http://update.googleapis.com:443">update.googleapis.com:443</a> some.user HIER_DIRECT/<a href="http://172.217.162.3">172.217.162.3</a> -<br><br>The problem starts when I try to configure a HAProxy 1.8 load balancer to which by redundancy I configured a virtual IP with the keepalived service. When I point my browser to the DNS A record (balancer.mydomain.local) which in turn points to the keepalived virtual IP, the authentication stops working:<br>cache.log<div>no records<br>access.log<br>10.10.8.207 TCP_DENIED/407 4142 CONNECT <a href="http://update.googleapis.com:443">update.googleapis.com:443</a> - HIER_NONE/- text/</div><div><br></div><div>In the client browser a prompt appears requesting authentication.<br><br>I find it strange that the IP registered by SQUID is 10.10.8.207, which is the physical IP of my VM, instead of the virtual IP configured in HAProxy, which is the IP 10.10.8.213.<br><br>I send you all the configurations that I have made to see if you can help me to find where my configuration error is.<br><br>keepalived.conf<div> global_defs {<br> notification_email {<br> some.user@mydomain.local<br> }<br> notification_email_from balancer1@mydomain.local<br> smtp_server smtp.
mydomain.local
<br> smtp_connect_timeout 60<br> }<br><br> vrrp_instance VI_1 {<br> state MASTER<br> interface eth0<br> virtual_router_id 101<br> priority 101<br> advert_int 1<br> authentication {<br> auth_type PASS<br> auth_pass somepass123<br> }<br> virtual_ipaddress {<br> 10.10.8.213<br> }<br> }<br><br></div><div><br></div><div>haproxy.conf</div><div>global<br> log /dev/log local0<br> log /dev/log local1 notice<br> chroot /var/lib/haproxy<br> stats socket /run/haproxy/admin.sock mode 660 level admin<br> stats timeout 30s<br> user haproxy<br> group haproxy<br> daemon<br> maxconn 4000<br>ca-base /etc/ssl/certs<br> crt-base /etc/ssl/private<br>server=haproxy<br> ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS<br> ssl-default-bind-options no-sslv3<br><br>defaults<br> balance source<br> log global<br> mode http<br> option httplog<br> option dontlognull<br> option http-server-close<br>option forwardfor except <a href="http://127.0.0.0/8">127.0.0.0/8</a><br> timeout connect 5000<br> timeout client 50000<br> timeout server 50000<br><br> errorfile 400 /etc/haproxy/errors/400.http<br> errorfile 403 /etc/haproxy/errors/403.http<br> errorfile 408 /etc/haproxy/errors/408.http<br> errorfile 500 /etc/haproxy/errors/500.http<br> errorfile 502 /etc/haproxy/errors/502.http<br> errorfile 503 /etc/haproxy/errors/503.http<br> errorfile 504 /etc/haproxy/errors/504.http<br><br>### statistics<br>listen stats<br> bind <a href="http://10.10.8.213:1936">10.10.8.213:1936</a><br> mode http<br> stats enable<br> stats hide-version<br> stats realm Haproxy\ Statistics<br> stats uri /haproxy?stats<br> stats auth haproxy:somepass123<br><br>### balancer<br>listen squid<br> bind <a href="http://10.10.8.213:3128">10.10.8.213:3128</a><br> mode http<br> option httplog<br> balance source<br> hash-type consistent<br> option httpclose<br> cookie SERVERID insert indirect nocache<br> option forwardfor header X-Client<br> server proxy1 <a href="http://10.10.8.205:3128">10.10.8.205:3128</a> check inter 2000 rise 2 fall 5<br></div><div><div> server proxy2 <a href="http://10.10.8.206:3128">10.10.8.206:3128</a> check inter 2000 rise 2 fall 5<br></div><div></div></div><div><br></div><div><br></div><div>squid.conf</div><div># minimal configuration for testing</div><div>visible_hostname proxy1.mydomain.local<br>http_port 3128<br>debug_options ALL, 1 33, 2 28, 9<br>maximum_object_size 8192 KB<br>error_directory /opt/squid411/share/errors/es-ar<br>shutdown_lifetime 0 seconds<br>forwarded_for on<br>auth_param negotiate program /usr/local/bin/squid_kerb_auth -i -r -s GSS_C_NO_NAME<br>auth_param negotiate children 300 startup=150 idle=10<br>auth_param negotiate keep_alive on<br>acl auth proxy_auth REQUIRED<br>http_access allow auth<br>acl SSL_ports port 443<br>acl Safe_ports port 80<br>acl CONNECT method CONNECT<br>http_access deny !Safe_ports<br>http_access deny CONNECT !SSL_ports<br>http_access deny all<br></div><div><br></div><div><br></div><div>squid -v</div><div>Squid Cache: Version 4.11<br>Service Name: squid<br><br>This binary uses OpenSSL 1.0.2u 20 Dec 2019. For legal restrictions on distribution see <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a><br><br>configure options: '--prefix=/opt/squid411' '--includedir=/include' '--mandir=/share/man' '--infodir=/share/info' '--localstatedir=/opt/squid411/var' '--disable-maintainer-mode' '--disable-dependency-tracking' '--disable-silent-rules' '--enable-inline' '--enable-async-io' '--enable-storeio=ufs,aufs,diskd' '--enable-removal-policies=lru,heap' '--enable-delay-pools' '--enable-cache-digests' '--enable-underscores' '--enable-icap-client' '--enable-follow-x-forwarded-for' '--enable-auth' '--enable-digest-auth-helpers' '--enable-negotiate-auth-helpers' '--enable-auth-ntlm' '--enable-arp-acl' '--enable-esi--disable-translation' '--with-logdir=/var/log/squid411' '--with-pidfile=/var/run/squid411.pid' '--with-filedescriptors=65536' '--with-large-files' '--with-default-user=proxy' '--enable-linux-netfilter' '--enable-ltdl-convenience' '--with-openssl' '--enable-ssl' '--enable-ssl-crtd'<br></div><div><br></div><div><br></div><div>env</div><div>KRB5_KTNAME=/opt/squid411/etc/PROXY.keytab<br>KRB5RCACHETYPE=none<br></div><div><br></div><div><br></div><div>/etc/krb5.conf</div><div>[libdefaults]<br> default_realm = MYDOMAIN.LOCAL<br> dns_lookup_kdc = yes<br> dns_lookup_realm = yes <br> ticket_lifetime = 24h<br><br> default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5<br> default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5<br> permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5<br><br>[realms]<br> MYDOMAIN.LOCAL = {<br> kdc = s-dc00.mydomain.local<br> kdc = s-dc01.mydomain.local<br> kdc = s-dc02.mydomain.local<br> admin_server = s-dc00.mydomain.local<br> }<br><br>[domain_realm]<br> .mydomain.local = MYDOMAIN.LOCAL<br> mydomain.local = MYDOMAIN.LOCAL<br></div><div><br></div><div><br></div><div>msktutil -c -b "OU=SERVIDORES" -s HTTP/debian-proxy.mydomain.local -k /opt/squid411/etc/PROXY.keytab --computer-name DEBIAN-PROXY --upn HTTP/debian-proxy.mydomain.local --server s-dc00.mydomain.local --verbose --enctypes 28<br></div><div><br></div><div><br></div><div># permissions for kaytab file</div><div>chgrp proxy /opt/squid411/etc/PROXY.keytab<br>chmod g+r /opt/squid411/etc/PROXY.keytab<br></div><div><br></div><div><br></div><div>klist<br>Ticket cache: FILE:/tmp/krb5cc_0<br>Default principal: some.user@MYDOMAIN.LOCAL<br><br>Valid starting Expires Service principal<br>07/23/2020 11:59:45 07/23/2020 21:59:45 krbtgt/MYDOMAIN.LOCAL@MYDOMAIN.LOCAL<br> renew until 07/24/2020 11:59:40<br></div><div><br></div><div><br></div><div>One thing I didn't quite understand is the procedure to authenticate from HAProxy. According to the documentation I read, I did the following:</div><div><br>I created a DNS A record and its PTR in my DNS server pointing to the virtual IP of the keepalived (10.10.8.213) in the HAProxy. <br>Then I created a "HTTP_inet" user account in Active Directory.<br>Then on my domain controller, in a CMD with administrator permissions, I ran:<br>setspn -S HTTP/inet.mydomain.local HTTP_inet<br>setspn -S HTTP/inet HTTP_inet <br>In both cases the message was: object updated.<br>Then in my SQUID servers, I executed:<br>kinit HTTP_inet@MYDOMAIN.LOCAL<br>It asks for the user's password.<br>Start the ktutil tool<br>That's where I write:<br>addent -password -p HTTP/inet.mydomain.local -k 2 -e rc4-hmac</div><div>Ask the user password<br>addent -password -p HTTP/inet -k 2 -e rc4-hmac</div><div>Ask the user password<br>wkt /opt/squid411/etc/PROXY.keytab<br>quit<br><br>list the keys in keytab:<br>ktutil<br>read_kt /opt/squid411/etc/PROXY.keytab<br> 1 1 DEBIAN-PROXY$@MYDOMAIN.LOCAL<br> 2 1 DEBIAN-PROXY$@MYDOMAIN.LOCAL<br> 3 1 DEBIAN-PROXY$@MYDOMAIN.LOCAL<br> 4 1 HTTP/debian-proxy.mydomain.local@MYDOMAIN.LOCAL<br> 5 1 HTTP/debian-proxy.mydomain.local@MYDOMAIN.LOCAL<br> 6 1 HTTP/debian-proxy.mydomain.local@MYDOMAIN.LOCAL<br> 7 1 host/DEBIAN-PROXY@MYDOMAIN.LOCAL<br> 8 1 host/DEBIAN-PROXY@MYDOMAIN.LOCAL<br> 9 1 host/DEBIAN-PROXY@MYDOMAIN.LOCAL<br> 10 1 host/debian-proxy.mydomain.local@MYDOMAIN.LOCAL<br> 11 1 host/debian-proxy.mydomain.local@MYDOMAIN.LOCAL<br> 12 1 host/debian-proxy.mydomain.local@MYDOMAIN.LOCAL<br> 13 2 HTTP/inet.mydomain.local@MYDOMAIN.LOCAL<br> 14 2 HTTP/inet@MYDOMAIN.LOCAL<br><br>It's this last part I understand the least, maybe the mistake is there. Or somewhere else.<br>I appreciate any help you can offer me. <br><br>Best regards,<br><br>Gabriel<br></div><div><br></div></div></div>