<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=us-ascii" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 11.00.10570.1001"></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=171043008-24072020><FONT color=#0000ff
size=2 face=Arial>i would recommend to ..</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=171043008-24072020><FONT color=#0000ff
size=2 face=Arial>1) use debian buster,</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=171043008-24072020><FONT color=#0000ff
size=2 face=Arial>2) use squid 4.12</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=171043008-24072020><FONT color=#0000ff
size=2 face=Arial>3) use samba (winbind). </FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=171043008-24072020><FONT color=#0000ff
size=2 face=Arial></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=171043008-24072020><FONT color=#0000ff
size=2 face=Arial>needed in smb.conf ( only shown whats really needed
), there is more offcourse. </FONT></SPAN></DIV><SPAN class=171043008-24072020>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial></FONT><BR><FONT
color=#0000ff size=2 face=Arial> dedicated keytab file =
/etc/krb5.keytab<BR> kerberos method = secrets and
keytab</FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Arial></FONT> </DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial>
# renew the kerberos ticket<BR> winbind refresh tickets =
yes<BR></FONT></DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial>
# Added for freeradius support<BR> <SPAN
class=171043008-24072020>#</SPAN>ntlm auth =
mschapv2-and-ntlmv2-only<BR><BR></FONT><SPAN lang=N>
<P><FONT color=#0000ff size=2 face=Arial>apt install winbind
krb5-user </FONT><SPAN class=171043008-24072020><FONT color=#0000ff size=2
face=Arial>should be sufficient. <BR></FONT><SPAN lang=N><BR><FONT color=#0000ff
size=2 face=Arial>samba joins the domain. <BR></FONT></SPAN></SPAN><SPAN
class=171043008-24072020><SPAN lang=N><FONT color=#0000ff size=2
face=Arial>/etc/krb5.keytab contains the default part and refreshed the server
kerberos passworks/tickes. </FONT></SPAN></SPAN></P>
<P><SPAN class=171043008-24072020><SPAN lang=N><FONT color=#0000ff size=2
face=Arial>And for squid its keytab. <BR><BR>kinit Administrator<BR>export
KRB5_KTNAME=FILE:/etc/squid/HTTP-$(hostname -s).keytab<BR><SPAN
class=171043008-24072020><SPAN lang=N><FONT color=#0000ff size=2 face=Arial>net
ads keytab add_update_ads <SPAN
class=171043008-24072020>HTTP</SPAN>/$(hostname -f) -U
Administrator<BR></FONT></SPAN></SPAN><BR># alias name to keytab<BR>net ads
keytab ADD HTTP/CNAME.FQDN <BR><BR># check keytab file.<BR>klist -ke
/etc/squid/HTTP-$(hostname -s).keytab<BR>unset KRB5_KTNAME<BR><BR># set
rights.<BR>chgrp proxy /etc/squid/HTTP-$(hostname -s).keytab<BR>chmod g+r
/etc/squid/HTTP-$(hostname -s).keytab</FONT></SPAN></SPAN></P>
<P><SPAN class=171043008-24072020><SPAN lang=N><FONT color=#0000ff size=2
face=Arial>And i use in squid <BR>auth_param negotiate program
/usr/lib/squid/negotiate_wrapper_auth \<BR> --kerberos
/usr/lib/squid/negotiate_kerberos_auth -k /etc/squid/HTTP-hostname.keytab
\<BR> -s <A
href="mailto:HTTP/hostname.fqdn@REALM">HTTP/hostname.fqdn@REALM</A> -s <A
href="mailto:HTTP/CNAME.FQDN@REALM">HTTP/CNAME.FQDN@REALM</A>
<BR> --ntlm /usr/bin/ntlm_auth --helper-protocol=gss-spnego
--domain=NTDOM <BR><BR>Point to think about. </FONT></SPAN></SPAN></P><SPAN
class=171043008-24072020><SPAN lang=N><FONT color=#0000ff size=2
face=Arial></FONT></SPAN></SPAN></SPAN></DIV>
<DIV dir=ltr align=left><SPAN lang=N><SPAN class=171043008-24072020><SPAN
lang=N>
<P><SPAN class=171043008-24072020></SPAN><FONT face=Arial><FONT
color=#0000ff><FONT size=2><SPAN class=171043008-24072020>server
</SPAN>I</FONT></FONT></FONT><FONT face=Arial><FONT color=#0000ff><FONT
size=2><SPAN class=171043008-24072020>P's needs A +
PTR <BR></SPAN><SPAN class=171043008-24072020> use CNAMEs in the DNS.
<BR>and make sure the resolving is setup correctly.
</SPAN></FONT></FONT></FONT></P>
<P><FONT face=Arial><FONT color=#0000ff><FONT size=2><SPAN
class=171043008-24072020>Add a caching DNS to the proxy. ( and let squid use it
also ) </SPAN></FONT></FONT></FONT></P>
<P><SPAN class=171043008-24072020></SPAN><SPAN
class=171043008-24072020></SPAN><FONT color=#0000ff size=2 face=Arial>I<SPAN
class=171043008-24072020> had this working (without HAproxy) but with
keepalived. </SPAN></FONT></P>
<P><SPAN class=171043008-24072020></SPAN><SPAN
class=171043008-24072020></SPAN><SPAN class=171043008-24072020><FONT
color=#0000ff size=2 face=Arial>A</FONT></SPAN><SPAN
class=171043008-24072020><FONT color=#0000ff size=2 face=Arial>s far i can tel,
your problem is in how the hostnames and ip are
used. <BR></FONT></SPAN><SPAN class=171043008-24072020></SPAN><FONT
color=#0000ff size=2 face=Arial>b<SPAN class=171043008-24072020>ut above might
give you ideas. <BR></SPAN></FONT></P>
<P><SPAN class=171043008-24072020></SPAN><SPAN
class=171043008-24072020></SPAN><FONT color=#0000ff size=2 face=Arial>G<SPAN
class=171043008-24072020>reetz, </SPAN></FONT></P><FONT color=#0000ff size=2
face=Arial><SPAN
class=171043008-24072020></SPAN></FONT></SPAN></SPAN></SPAN></DIV>
<DIV dir=ltr align=left><SPAN lang=N><SPAN class=171043008-24072020><SPAN
lang=N><SPAN class=171043008-24072020></SPAN>
<P><SPAN class=171043008-24072020></SPAN><FONT color=#0000ff size=2
face=Arial>L<SPAN
class=171043008-24072020>ouis</SPAN><BR></FONT></P></SPAN></SPAN></SPAN></DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2
face=Arial> </DIV></FONT></SPAN><FONT color=#0000ff size=2
face=Arial></FONT><FONT color=#0000ff size=2 face=Arial></FONT><FONT
color=#0000ff size=2 face=Arial></FONT><BR>
<BLOCKQUOTE
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px"
dir=ltr>
<DIV lang=nl class=OutlookMessageHeader dir=ltr align=left>
<HR tabIndex=-1>
<FONT size=2 face=Tahoma><B>Van:</B> squid-users
[mailto:squid-users-bounces@lists.squid-cache.org] <B>Namens </B>Service
MV<BR><B>Verzonden:</B> donderdag 23 juli 2020 17:36<BR><B>Aan:</B>
squid-users@lists.squid-cache.org<BR><B>Onderwerp:</B> [squid-users] Problem
with HAProxy + Squid 4.11 + Kerberos authentication<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV dir=ltr>Hi, everybody.<BR>I have a SQUID 4.11 compiled on Debian 9.8 with
kerberos integration authenticating and browsing without
problems:<BR>cache.log<BR>squid_kerb_auth: User some.user
authenticated<BR>access.log<BR>10.10.10.203 TCP_TUNNEL/200 5264 CONNECT <A
href="http://update.googleapis.com:443">update.googleapis.com:443</A>
some.user HIER_DIRECT/<A href="http://172.217.162.3"><font color="red"><b>MailScanner warning: numerical links are often malicious:</b></font> <FONT
color=red><B>MailScanner warning: numerical links are often
malicious:</B></FONT> 172.217.162.3</A> -<BR><BR>The problem starts when I try
to configure a HAProxy 1.8 load balancer to which by redundancy I configured a
virtual IP with the keepalived service. When I point my browser to the DNS A
record (balancer.mydomain.local) which in turn points to the keepalived
virtual IP, the authentication stops working:<BR>cache.log
<DIV>no records<BR>access.log<BR>10.10.8.207 TCP_DENIED/407 4142 CONNECT <A
href="http://update.googleapis.com:443">update.googleapis.com:443</A> -
HIER_NONE/- text/</DIV>
<DIV><BR></DIV>
<DIV>In the client browser a prompt appears requesting
authentication.<BR><BR>I find it strange that the IP registered by SQUID is
10.10.8.207, which is the physical IP of my VM, instead of the virtual IP
configured in HAProxy, which is the IP 10.10.8.213.<BR><BR>I send you all the
configurations that I have made to see if you can help me to find where my
configuration error is.<BR><BR>keepalived.conf
<DIV> global_defs {<BR> notification_email
{<BR> some.user@mydomain.local<BR>
}<BR> notification_email_from
balancer1@mydomain.local<BR> smtp_server smtp.
mydomain.local <BR> smtp_connect_timeout 60<BR>
}<BR><BR> vrrp_instance VI_1 {<BR> state
MASTER<BR> interface eth0<BR>
virtual_router_id 101<BR> priority 101<BR>
advert_int 1<BR> authentication {<BR>
auth_type PASS<BR>
auth_pass somepass123<BR> }<BR>
virtual_ipaddress {<BR>
10.10.8.213<BR> }<BR> }<BR><BR></DIV>
<DIV><BR></DIV>
<DIV>haproxy.conf</DIV>
<DIV>global<BR>log /dev/log local0<BR>log /dev/log local1 notice<BR>chroot
/var/lib/haproxy<BR>stats socket /run/haproxy/admin.sock mode 660 level
admin<BR>stats timeout 30s<BR>user haproxy<BR>group
haproxy<BR>daemon<BR>maxconn 4000<BR>ca-base /etc/ssl/certs<BR>crt-base
/etc/ssl/private<BR>server=haproxy<BR>ssl-default-bind-ciphers
ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS<BR>ssl-default-bind-options
no-sslv3<BR><BR>defaults<BR>balance source<BR>log global<BR>mode
http<BR>option httplog<BR>option dontlognull<BR>option
http-server-close<BR>option forwardfor except <A
href="http://127.0.0.0/8"><font color="red"><b>MailScanner warning: numerical links are often malicious:</b></font> <FONT color=red><B>MailScanner warning: numerical
links are often malicious:</B></FONT> 127.0.0.0/8</A><BR>timeout connect
5000<BR>timeout client 50000<BR>timeout server 50000<BR><BR>errorfile 400
/etc/haproxy/errors/400.http<BR>errorfile 403
/etc/haproxy/errors/403.http<BR>errorfile 408
/etc/haproxy/errors/408.http<BR>errorfile 500
/etc/haproxy/errors/500.http<BR>errorfile 502
/etc/haproxy/errors/502.http<BR>errorfile 503
/etc/haproxy/errors/503.http<BR>errorfile 504
/etc/haproxy/errors/504.http<BR><BR>### statistics<BR>listen stats<BR>bind <A
href="http://10.10.8.213:1936"><font color="red"><b>MailScanner warning: numerical links are often malicious:</b></font> <FONT color=red><B>MailScanner warning:
numerical links are often malicious:</B></FONT> 10.10.8.213:1936</A><BR>mode
http<BR>stats enable<BR>stats hide-version<BR>stats realm Haproxy\
Statistics<BR>stats uri /haproxy?stats<BR>stats auth
haproxy:somepass123<BR><BR>### balancer<BR>listen squid<BR>bind <A
href="http://10.10.8.213:3128"><font color="red"><b>MailScanner warning: numerical links are often malicious:</b></font> <FONT color=red><B>MailScanner warning:
numerical links are often malicious:</B></FONT> 10.10.8.213:3128</A><BR>
mode http<BR> option httplog<BR> balance source<BR>
hash-type consistent<BR> option httpclose<BR> cookie SERVERID
insert indirect nocache<BR> option forwardfor header X-Client<BR>
server proxy1 <A href="http://10.10.8.205:3128"><font color="red"><b>MailScanner warning: numerical links are often malicious:</b></font> <FONT color=red><B>MailScanner
warning: numerical links are often malicious:</B></FONT> 10.10.8.205:3128</A>
check inter 2000 rise 2 fall 5<BR></DIV>
<DIV>
<DIV> server proxy2 <A href="http://10.10.8.206:3128"><font color="red"><b>MailScanner warning: numerical links are often malicious:</b></font> <FONT
color=red><B>MailScanner warning: numerical links are often
malicious:</B></FONT> 10.10.8.206:3128</A> check inter 2000 rise 2 fall
5<BR></DIV>
<DIV></DIV></DIV>
<DIV><BR></DIV>
<DIV><BR></DIV>
<DIV>squid.conf</DIV>
<DIV># minimal configuration for testing</DIV>
<DIV>visible_hostname proxy1.mydomain.local<BR>http_port 3128<BR>debug_options
ALL, 1 33, 2 28, 9<BR>maximum_object_size 8192 KB<BR>error_directory
/opt/squid411/share/errors/es-ar<BR>shutdown_lifetime 0
seconds<BR>forwarded_for on<BR>auth_param negotiate program
/usr/local/bin/squid_kerb_auth -i -r -s GSS_C_NO_NAME<BR>auth_param negotiate
children 300 startup=150 idle=10<BR>auth_param negotiate keep_alive on<BR>acl
auth proxy_auth REQUIRED<BR>http_access allow auth<BR>acl SSL_ports port
443<BR>acl Safe_ports port 80<BR>acl CONNECT method CONNECT<BR>http_access
deny !Safe_ports<BR>http_access deny CONNECT !SSL_ports<BR>http_access deny
all<BR></DIV>
<DIV><BR></DIV>
<DIV><BR></DIV>
<DIV>squid -v</DIV>
<DIV>Squid Cache: Version 4.11<BR>Service Name: squid<BR><BR>This binary uses
OpenSSL 1.0.2u 20 Dec 2019. For legal restrictions on distribution see
<A
href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</A><BR><BR>configure
options: '--prefix=/opt/squid411' '--includedir=/include'
'--mandir=/share/man' '--infodir=/share/info'
'--localstatedir=/opt/squid411/var' '--disable-maintainer-mode'
'--disable-dependency-tracking' '--disable-silent-rules' '--enable-inline'
'--enable-async-io' '--enable-storeio=ufs,aufs,diskd'
'--enable-removal-policies=lru,heap' '--enable-delay-pools'
'--enable-cache-digests' '--enable-underscores' '--enable-icap-client'
'--enable-follow-x-forwarded-for' '--enable-auth'
'--enable-digest-auth-helpers' '--enable-negotiate-auth-helpers'
'--enable-auth-ntlm' '--enable-arp-acl' '--enable-esi--disable-translation'
'--with-logdir=/var/log/squid411' '--with-pidfile=/var/run/squid411.pid'
'--with-filedescriptors=65536' '--with-large-files'
'--with-default-user=proxy' '--enable-linux-netfilter'
'--enable-ltdl-convenience' '--with-openssl' '--enable-ssl'
'--enable-ssl-crtd'<BR></DIV>
<DIV><BR></DIV>
<DIV><BR></DIV>
<DIV>env</DIV>
<DIV>KRB5_KTNAME=/opt/squid411/etc/PROXY.keytab<BR>KRB5RCACHETYPE=none<BR></DIV>
<DIV><BR></DIV>
<DIV><BR></DIV>
<DIV>/etc/krb5.conf</DIV>
<DIV>[libdefaults]<BR> default_realm = MYDOMAIN.LOCAL<BR>
dns_lookup_kdc = yes<BR> dns_lookup_realm = yes <BR>
ticket_lifetime = 24h<BR><BR>
default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc
des-cbc-md5<BR> default_tkt_enctypes =
aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5<BR>
permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac
des-cbc-crc des-cbc-md5<BR><BR>[realms]<BR> MYDOMAIN.LOCAL =
{<BR> kdc = s-dc00.mydomain.local<BR>
kdc = s-dc01.mydomain.local<BR> kdc =
s-dc02.mydomain.local<BR> admin_server =
s-dc00.mydomain.local<BR> }<BR><BR>[domain_realm]<BR>
.mydomain.local = MYDOMAIN.LOCAL<BR> mydomain.local =
MYDOMAIN.LOCAL<BR></DIV>
<DIV><BR></DIV>
<DIV><BR></DIV>
<DIV>msktutil -c -b "OU=SERVIDORES" -s HTTP/debian-proxy.mydomain.local -k
/opt/squid411/etc/PROXY.keytab --computer-name DEBIAN-PROXY --upn
HTTP/debian-proxy.mydomain.local --server s-dc00.mydomain.local --verbose
--enctypes 28<BR></DIV>
<DIV><BR></DIV>
<DIV><BR></DIV>
<DIV># permissions for kaytab file</DIV>
<DIV>chgrp proxy /opt/squid411/etc/PROXY.keytab<BR>chmod g+r
/opt/squid411/etc/PROXY.keytab<BR></DIV>
<DIV><BR></DIV>
<DIV><BR></DIV>
<DIV>klist<BR>Ticket cache: FILE:/tmp/krb5cc_0<BR>Default principal:
some.user@MYDOMAIN.LOCAL<BR><BR>Valid starting Expires
Service
principal<BR>07/23/2020 11:59:45 07/23/2020 21:59:45
krbtgt/MYDOMAIN.LOCAL@MYDOMAIN.LOCAL<BR>
renew until 07/24/2020 11:59:40<BR></DIV>
<DIV><BR></DIV>
<DIV><BR></DIV>
<DIV>One thing I didn't quite understand is the procedure to authenticate from
HAProxy. According to the documentation I read, I did the following:</DIV>
<DIV><BR>I created a DNS A record and its PTR in my DNS server pointing to the
virtual IP of the keepalived (10.10.8.213) in the HAProxy. <BR>Then I
created a "HTTP_inet" user account in Active Directory.<BR>Then on my domain
controller, in a CMD with administrator permissions, I ran:<BR>setspn -S
HTTP/inet.mydomain.local HTTP_inet<BR>setspn -S HTTP/inet HTTP_inet <BR>In
both cases the message was: object updated.<BR>Then in my SQUID servers, I
executed:<BR>kinit HTTP_inet@MYDOMAIN.LOCAL<BR>It asks for the user's
password.<BR>Start the ktutil tool<BR>That's where I write:<BR>addent
-password -p HTTP/inet.mydomain.local -k 2 -e rc4-hmac</DIV>
<DIV>Ask the user password<BR>addent -password -p HTTP/inet -k 2 -e
rc4-hmac</DIV>
<DIV>Ask the user password<BR>wkt
/opt/squid411/etc/PROXY.keytab<BR>quit<BR><BR>list the keys in
keytab:<BR>ktutil<BR>read_kt /opt/squid411/etc/PROXY.keytab<BR> 1
1 DEBIAN-PROXY$@MYDOMAIN.LOCAL<BR> 2 1
DEBIAN-PROXY$@MYDOMAIN.LOCAL<BR> 3 1
DEBIAN-PROXY$@MYDOMAIN.LOCAL<BR> 4 1
HTTP/debian-proxy.mydomain.local@MYDOMAIN.LOCAL<BR> 5 1
HTTP/debian-proxy.mydomain.local@MYDOMAIN.LOCAL<BR> 6 1
HTTP/debian-proxy.mydomain.local@MYDOMAIN.LOCAL<BR> 7 1
host/DEBIAN-PROXY@MYDOMAIN.LOCAL<BR> 8 1
host/DEBIAN-PROXY@MYDOMAIN.LOCAL<BR> 9 1
host/DEBIAN-PROXY@MYDOMAIN.LOCAL<BR> 10 1
host/debian-proxy.mydomain.local@MYDOMAIN.LOCAL<BR> 11 1
host/debian-proxy.mydomain.local@MYDOMAIN.LOCAL<BR> 12 1
host/debian-proxy.mydomain.local@MYDOMAIN.LOCAL<BR> 13 2
HTTP/inet.mydomain.local@MYDOMAIN.LOCAL<BR> 14 2
HTTP/inet@MYDOMAIN.LOCAL<BR><BR>It's this last part I understand the least,
maybe the mistake is there. Or somewhere else.<BR>I appreciate any help you
can offer me. <BR><BR>Best regards,<BR><BR>Gabriel<BR></DIV>
<DIV><BR></DIV></DIV></DIV></BLOCKQUOTE></BODY></HTML>