<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:12.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
span.E-MailFormatvorlage20
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">No idea?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none;mso-fareast-language:DE">Von:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-ligatures:none;mso-fareast-language:DE"> squid-users
<squid-users-bounces@lists.squid-cache.org> <b>Im Auftrag von </b>Michael Egert<br>
<b>Gesendet:</b> Freitag, 30. August 2024 14:35<br>
<b>An:</b> squid-users@lists.squid-cache.org<br>
<b>Betreff:</b> [squid-users] negotiate_kerberos_auth not working anymore<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hello all,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have a little problem with this helper, it worked fine for a while and then suddely stopped working.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I can call a kerberos ticket when using kinit <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-bottom:solid windowtext 1.0pt;padding:0cm 0cm 1.0pt 0cm">
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">root@sv-asa-proxy:/var/log/squid# kinit -kt /etc/squid/sv-asa-proxy.keytab
<a href="mailto:HTTP/sv-asa-proxy@ASA.LOCAL">HTTP/sv-asa-proxy@ASA.LOCAL</a><o:p></o:p></p>
<p class="MsoNormal">root@sv-asa-proxy:/var/log/squid# klist<o:p></o:p></p>
<p class="MsoNormal"><span lang="NL">Ticket cache: FILE:/tmp/krb5cc_0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">Default principal: <a href="mailto:HTTP/sv-asa-proxy@ASA.LOCAL">
HTTP/sv-asa-proxy@ASA.LOCAL</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="NL">Valid starting Expires Service principal<o:p></o:p></span></p>
<p class="MsoNormal">08/30/24 14:24:27 08/31/24 00:24:27 <a href="mailto:krbtgt/ASA.LOCAL@ASA.LOCAL">
krbtgt/ASA.LOCAL@ASA.LOCAL</a><o:p></o:p></p>
<p class="MsoNormal"> renew until 08/31/24 14:24:27<o:p></o:p></p>
<p class="MsoNormal">root@sv-asa-proxy:/var/log/squid#<o:p></o:p></p>
<div style="border:none;border-bottom:solid windowtext 1.0pt;padding:0cm 0cm 1.0pt 0cm">
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">so – this works well<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="NL">this is a part of my squid.conf:<o:p></o:p></span></p>
<div style="border:none;border-bottom:solid windowtext 1.0pt;padding:0cm 0cm 1.0pt 0cm">
<p class="MsoNormal"><span lang="NL"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span lang="NL">auth_param negotiate program /usr/lib/squid/negotiate_kerberos_auth -k /etc/squid/sv-asa-proxy.keytab -s
<a href="mailto:HTTP/sv-asa-proxy@ASA.LOCAL">HTTP/sv-asa-proxy@ASA.LOCAL</a> -r -d<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">auth_parauth_param negotiate children 100 startup=0 idle=10<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">auth_param negotiate keep_alive on<o:p></o:p></span></p>
<div style="border:none;border-bottom:solid windowtext 1.0pt;padding:0cm 0cm 1.0pt 0cm">
<p class="MsoNormal"><span lang="NL">acl kerb-auth proxy_auth REQUIRED<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="NL">i also tried<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="NL">auth_param negotiate program /usr/lib/squid/negotiate_kerberos_auth -k /etc/squid/sv-asa-proxy.keytab -s
<a href="mailto:HTTP/sv-asa-proxy@ASA.LOCAL">HTTP/sv-asa-proxy@ASA.LOCAL</a> -s GSS_C_NO_NAME -r -d<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="NL">no success...<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="NL">when i try<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="NL">root@sv-asa-proxy:/var/log/squid# /usr/lib/squid/negotiate_kerberos_auth_test -k /etc/squid/sv-asa-proxy.keytab -s
<a href="mailto:HTTP/sv-asa-proxy.asa.local@ASA.LOCAL">HTTP/sv-asa-proxy.asa.local@ASA.LOCAL</a> -s GSS_C_NO_NAME -d -i<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:28:35| negotiate_kerberos_auth_test: gss_init_sec_context() failed: Unspecified GSS failure. Minor code may provide more information. Server not found in Kerberos database<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">Token: NULL<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">root@sv-asa-proxy:/var/log/squid#<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="NL">and when i try this one:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="NL">root@sv-asa-proxy:/var/log/squid# /usr/lib/squid/negotiate_kerberos_auth -k /etc/squid/sv-asa-proxy.keytab -s
<a href="mailto:HTTP/sv-asa-proxy.asa.local@ASA.LOCAL">HTTP/sv-asa-proxy.asa.local@ASA.LOCAL</a> -d -r<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">negotiate_kerberos_auth.cc(489): pid=5286 :2024/08/30 14:29:25| negotiate_kerberos_auth: INFO: Starting version 3.1.0sq<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">negotiate_kerberos_auth.cc(548): pid=5286 :2024/08/30 14:29:25| negotiate_kerberos_auth: INFO: Setting keytab to /etc/squid/sv-asa-proxy.keytab<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">negotiate_kerberos_auth.cc(571): pid=5286 :2024/08/30 14:29:25| negotiate_kerberos_auth: INFO: Changed keytab to MEMORY:negotiate_kerberos_auth_5286<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL"><a href="mailto:admin@ASA.LOCAL">admin@ASA.LOCAL</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">negotiate_kerberos_auth.cc(612): pid=5286 :2024/08/30 14:30:06| negotiate_kerberos_auth: DEBUG: Got 'admin@ASA.LOCAL' from squid (length: 15).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">negotiate_kerberos_auth.cc(661): pid=5286 :2024/08/30 14:30:06| negotiate_kerberos_auth: ERROR: Invalid request [admin@ASA.LOCAL]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">BH Invalid request<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="NL">And the log:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:25 kid1| Set Current Directory to /var/spool/squid<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:25 kid1| Starting Squid Cache version 5.9 for x86_64-pc-linux-gnu...<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:25 kid1| Service Name: squid<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:25 kid1| Process ID 5309<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:25 kid1| Process Roles: worker<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:25 kid1| With 1024 file descriptors available<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:25 kid1| Initializing IP Cache...<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:25 kid1| DNS Socket created at [::], FD 9<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:25 kid1| DNS Socket created at 0.0.0.0, FD 10<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:25 kid1| Adding nameserver 192.168.40.1 from squid.conf<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:25 kid1| Adding nameserver 192.168.40.2 from squid.conf<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:25 kid1| helperOpenServers: Starting 0/100 'negotiate_kerberos_auth' processes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:25 kid1| helperStatefulOpenServers: No 'negotiate_kerberos_auth' processes needed.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:25 kid1| helperOpenServers: Starting 0/25 'ext_kerberos_ldap_group_acl' processes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:25 kid1| helperOpenServers: No 'ext_kerberos_ldap_group_acl' processes needed.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:25 kid1| Logfile: opening log daemon:/var/log/squid/access.log<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:25 kid1| Logfile Daemon: opening log /var/log/squid/access.log<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Unlinkd pipe opened on FD 16<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Logfile: opening log daemon:/var/log/squid/store.log<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Logfile Daemon: opening log /var/log/squid/store.log<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Swap maxSize 20480000 + 2097152 KB, estimated 1736704 objects<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Target number of buckets: 86835<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Using 131072 Store buckets<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Max Mem size: 2097152 KB<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Max Swap size: 20480000 KB<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Rebuilding storage in /var/cache/squid (clean log)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Using Least Load store dir selection<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Set Current Directory to /var/spool/squid<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Finished loading MIME types and icons.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| HTCP Disabled.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Pinger socket opened on FD 23<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Squid plugin modules loaded: 0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Adaptation support is off.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Accepting HTTP Socket connections at conn3 local=[::]:8080 remote=[::] FD 21 flags=9<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Done reading /var/cache/squid swaplog (50 entries)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Finished rebuilding storage from disk.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| 50 Entries scanned<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| 0 Invalid entries.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| 0 With invalid flags.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| 50 Objects loaded.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| 0 Objects expired.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| 0 Objects cancelled.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| 0 Duplicate URLs purged.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| 0 Swapfile clashes avoided.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Took 0.01 seconds (5303.35 objects/sec).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Beginning Validation Procedure<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Completed Validation Procedure<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| Validated 50 Entries<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26 kid1| store_swap_size = 732.00 KB<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26| pinger: Initialising ICMP pinger ...<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26| pinger: ICMP socket opened.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:26| pinger: ICMPv6 socket opened<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL">2024/08/30 14:31:27 kid1| storeLateRelease: released 0 objects<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="NL">Do you have any suggstions for me?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="NL">Kind regards <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="NL">Michael<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL"><o:p> </o:p></span></p>
</div>
</body>
</html>