<HTML><HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<STYLE style="DISPLAY: none"
type=text/css> P {margin-top:0;margin-bottom:0;} </STYLE>
</HEAD>
<BODY dir=ltr>
<DIV dir=ltr>
<DIV style="FONT-SIZE: 10pt; FONT-FAMILY: 'Arial'; COLOR: #000000">
<DIV>Hi Enfal,</DIV>
<DIV> </DIV>
<DIV> Do you run also
samba on the server ? If so samba may change the AD host entry to
which your keytab is associated. This means your keytab gets out of sync with
AD.</DIV>
<DIV> </DIV>
<DIV>Markus</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV
style="BORDER-TOP-COLOR: #000000; BORDER-BOTTOM-COLOR: #000000; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 4px solid; BORDER-RIGHT-COLOR: #000000">
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>
<DIV>"Enfal Gok" <enfal.gok2004@gmail.com> wrote in message
news:PAWPR03MB9010DF5EEC64C9A281A03B24F4152@PAWPR03MB9010.eurprd03.prod.outlook.com...</DIV></DIV></DIV>
<DIV
style="BORDER-TOP-COLOR: #000000; BORDER-BOTTOM-COLOR: #000000; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 4px solid; BORDER-RIGHT-COLOR: #000000">
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>
<DIV class=elementToProof
style="FONT-SIZE: 12pt; MARGIN-BOTTOM: 1em; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; MARGIN-TOP: 1em; COLOR: rgb(0,0,0)">Dear
Squid Community/Support Team,</DIV>
<DIV
style="FONT-SIZE: 12pt; MARGIN-BOTTOM: 1em; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; MARGIN-TOP: 1em; COLOR: rgb(0,0,0)">I
am currently configuring Squid with Kerberos authentication and LDAP group-based
access control. However, I am encountering persistent issues, and I would
greatly appreciate your guidance. Below are the details of my configuration and
the errors I am facing.</DIV>
<HR>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0)"><B>Error
Logs</B></DIV>
<DIV class=elementToProof
style="FONT-SIZE: 12pt; MARGIN-BOTTOM: 1em; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; MARGIN-TOP: 1em; COLOR: rgb(0,0,0)">The
following errors repeatedly appear in the Squid logs:</DIV><PRE><DIV style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0)"><BUTTON class="flex gap-1 items-center select-none py-1"><DIV></DIV></BUTTON></DIV><DIV class=elementToProof style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0); DIRECTION: ltr"><CODE>2025/01/03 19:35:40 kid1| Starting new helpers
2025/01/03 19:35:40 kid1| helperOpenServers: Starting 1/5 'ext_kerberos_ldap_group_acl' processes
support_sasl.cc(276): pid=70855 :2025/01/03 19:35:40| kerberos_ldap_group: ERROR: ldap_sasl_interactive_bind_s error: Local error
support_ldap.cc(1086): pid=70855 :2025/01/03 19:35:40| kerberos_ldap_group: ERROR: Error while binding to ldap server with SASL/GSSAPI: Local error
support_ldap.cc(1172): pid=70855 :2025/01/03 19:35:40| kerberos_ldap_group: ERROR: Error while binding to ldap server with Username/Password: Encoding error
(ext_kerberos_ldap_group_acl): ../../../../libraries/liblber/io.c:108: ber_write: Assertion `buf != NULL' failed.
2025/01/03 19:35:41 kid1| WARNING: external_acl_type #Hlpr7 exited
2025/01/03 19:35:41 kid1| Too few external_acl_type processes are running (need 1/5)
</CODE></DIV></PRE>
<HR>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0)"><B>Current
Configuration</B></DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0)"><B>Kerberos
Authentication</B></DIV><PRE><DIV style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; WHITE-SPACE: normal; COLOR: rgb(0,0,0)"> </DIV><DIV style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0); DIRECTION: ltr"><CODE>auth_param negotiate program /usr/lib/squid/negotiate_kerberos_auth -s HTTP/ubuntuserver.demo.local
auth_param negotiate children 10
auth_param negotiate keep_alive on
</CODE></DIV></PRE>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0)"><B>External
ACL for LDAP Groups</B></DIV><PRE><DIV style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; WHITE-SPACE: normal; COLOR: rgb(0,0,0)"> </DIV><DIV style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0); DIRECTION: ltr"><CODE>external_acl_type kerberos_ldap_group ttl=3600 negative_ttl=3600 %LOGIN /usr/lib/squid/ext_kerberos_ldap_group_acl \ -P HTTP/ubuntuserver.demo.local@DEMO.LOCAL \ -D demo.local \ -b DC=demo,DC=local \ -l ldap://dc.demo.local \ -g FullAccess@DEMO.LOCAL:Restricted@DEMO.LOCAL:Filtered@DEMO.LOCAL:Blocked@DEMO.LOCAL
</CODE></DIV></PRE>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0)"><B>ACL
Definitions</B></DIV><PRE><DIV style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; WHITE-SPACE: normal; COLOR: rgb(0,0,0)"> </DIV><DIV style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0); DIRECTION: ltr"><CODE>acl FullAccess external kerberos_ldap_group FullAccess@DEMO.LOCAL
acl Restricted external kerberos_ldap_group Restricted@DEMO.LOCAL
acl Filtered external kerberos_ldap_group Filtered@DEMO.LOCAL
acl Blocked external kerberos_ldap_group Blocked@DEMO.LOCAL
acl allowed_sites dstdomain .benedictuspoort.be .smartschool.be .microsoft.com
acl bad_sites dstdomain .adult.com .gambling.com
</CODE></DIV></PRE>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0)"><B>Access
Rules</B></DIV><PRE><DIV style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; WHITE-SPACE: normal; COLOR: rgb(0,0,0)"> </DIV><DIV style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0); DIRECTION: ltr"><CODE>http_access allow FullAccess
http_access allow Restricted allowed_sites
http_access deny Restricted
http_access deny Blocked
http_access deny Filtered bad_sites
http_access allow Filtered
http_access deny all
</CODE></DIV></PRE>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0)"><B>Proxy
Settings</B></DIV><PRE><DIV style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; WHITE-SPACE: normal; COLOR: rgb(0,0,0)"> </DIV><DIV style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0); DIRECTION: ltr"><CODE>http_port 3128
cache_dir ufs /var/spool/squid 100 16 256
coredump_dir /var/spool/squid
</CODE></DIV></PRE>
<HR>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0)"><B>What
I Have Tried</B></DIV>
<UL>
<LI
style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0)">Verified
that the Kerberos keytab is up-to-date and matches the Key Version Number
(<CODE>msDS-KeyVersionNumber</CODE>) in Active Directory.
<LI
style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0)">Tested
LDAP queries using <CODE>ldapsearch</CODE> with both simple and GSSAPI
bindings, which work intermittently.
<LI
style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0)">Checked
Squid logs and confirmed that Kerberos tickets are being issued successfully
using <CODE>kinit</CODE> and <CODE>klist</CODE>.</LI></UL>
<DIV
style="FONT-SIZE: 12pt; MARGIN-BOTTOM: 1em; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; MARGIN-TOP: 1em; COLOR: rgb(0,0,0)">Despite
these efforts, the <CODE>ext_kerberos_ldap_group_acl</CODE> helper is unable to
bind to the LDAP server, and the Squid service keeps restarting helpers.</DIV>
<HR>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0)"><B>Request
for Assistance</B></DIV>
<DIV
style="FONT-SIZE: 12pt; MARGIN-BOTTOM: 1em; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; MARGIN-TOP: 1em; COLOR: rgb(0,0,0)">Could
you please provide guidance on:</DIV>
<OL>
<LI
style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0)">Debugging
the <CODE>ext_kerberos_ldap_group_acl</CODE> helper?
<LI
style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0)">Ensuring
compatibility between Kerberos and LDAP for group-based access control?
<LI
style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0)">Any
potential misconfigurations or missing steps in my setup?</LI></OL>
<DIV class=elementToProof
style="FONT-SIZE: 12pt; MARGIN-BOTTOM: 1em; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; MARGIN-TOP: 1em; COLOR: rgb(0,0,0)">Thank
you in advance for your assistance. I look forward to your
recommendations.</DIV>
<DIV class=elementToProof
style="FONT-SIZE: 12pt; FONT-FAMILY: aptos, aptos_embeddedfont, aptos_msfontservice, calibri, helvetica, sans-serif; COLOR: rgb(0,0,0)">Kind
regards,<BR>Enfal gok </DIV>
<P>
<HR>
_______________________________________________<BR>squid-users mailing
list<BR>squid-users@lists.squid-cache.org<BR>https://lists.squid-cache.org/listinfo/squid-users<BR></DIV></DIV></DIV></DIV></BODY></HTML>