<HTML xmlns:o><HEAD>
<META content="text/html; charset=utf-8" http-equiv=Content-Type>
<META name=Generator content="Microsoft Word 15 (filtered medium)">
<STYLE>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</STYLE>
<STYLE>@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;
mso-fareast-language:EN-US;}div.WordSection1
{page:WordSection1;}</STYLE>
</HEAD>
<BODY lang=EN-GB style="WORD-WRAP: break-word" dir=ltr vLink=#96607d
link=#467886>
<DIV dir=ltr>
<DIV style="FONT-SIZE: 10pt; FONT-FAMILY: 'Arial'; COLOR: #000000">
<DIV>Hi Mark,</DIV>
<DIV> </DIV>
<DIV> Be aware that Browsers may behave differently when using
CNAMES. Some Browser uses the HTTP/<CNAME> ticket and some use
HTTP/<NAME of reverse lookup of the CNAME IP></DIV>
<DIV> </DIV>
<DIV> e.g. if proxy.example.com is a cname for server1.example.com
on 192.168.1.2</DIV>
<DIV> </DIV>
<DIV> You may need tickets for both i.e. HTTP/proxy.example.com AND
HTTP/server1.example.com </DIV>
<DIV> </DIV>
<DIV> If you use GSLB or other load balancing techniques make sure
all server keys plus the GSLB and CNAME keys are included in the keytab on all
servers supporting the GSLB or CNAME..</DIV>
<DIV> </DIV>
<DIV>Markus</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV
style="BORDER-TOP-COLOR: #000000; BORDER-BOTTOM-COLOR: #000000; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 4px solid; BORDER-RIGHT-COLOR: #000000">
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>
<DIV>"Mark Cairney" <Mark.Cairney@ed.ac.uk> wrote in message
news:6a32534a-d605-474f-9cca-79d3735385b4@ed.ac.uk...</DIV></DIV></DIV>
<DIV
style="BORDER-TOP-COLOR: #000000; BORDER-BOTTOM-COLOR: #000000; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 4px solid; BORDER-RIGHT-COLOR: #000000">
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>
<DIV class=WordSection1>
<P class=MsoNormal>Hi,<o:p></o:p></P>
<P class=MsoNormal>I’ve been trying to get Kerberos Authentication against AD
working but have been seeing inconsistent results/behaviour across multiple Oses
and I’m not sure if the issue lies with the DNS configuration, Kerberos itself
or with the Squid config:<o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>THE DNS setup is as follows:<o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>test.squid.cluster.
3600
IN
CNAME
test-squid-cluster.dyn-zone.<o:p></o:p></P>
<P class=MsoNormal>test-squid-cluster.dyn-zone. 60 IN A
1.2.3.4<o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>Where 1.2.3.4 is the IP of one of the servers in the cluster.
The intention is to have multiple Squid servers behind a single DNS name for
high-availability.<o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>This is what I’m seeing in the cache log with my current
setup:<o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>Windows:<o:p></o:p></P>
<P class=MsoNormal>negotiate_kerberos_auth.cc(182): pid=668789 :2025/06/16
16:03:01| negotiate_kerb<o:p></o:p></P>
<P class=MsoNormal>eros_auth: ERROR: gss_accept_sec_context() failed:
Unspecified GSS failure. Min<o:p></o:p></P>
<P class=MsoNormal>or code may provide more information. Cannot find key for
HTTP/ test-squid-cluster.dyn-zone@REALM kvno 2 in keytab (request ticket server
HTTP/test.squid.cluster@REALM<o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>Rocky Linux:<o:p></o:p></P>
<P class=MsoNormal>curl -ik -vvv -L --proxy-negotiate -U : -b ~/cookiejar.txt -c
~/cookiejar.txt -x <A class=moz-txt-link-rfc2396E href="test.squid.cluster:3128"
moz-do-not-send="true">"test.squid.cluster:3128"</A> <A
class=moz-txt-link-freetext href="https://www.bbc.co.uk"
moz-do-not-send="true">https://www.bbc.co.uk</A><o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>negotiate_kerberos_auth.cc(182): pid=668789 :2025/06/17
08:51:52| negotiate_kerb<o:p></o:p></P>
<P class=MsoNormal>eros_auth: ERROR: gss_accept_sec_context() failed:
Unspecified GSS failure. Min<o:p></o:p></P>
<P class=MsoNormal>2025/06/17 08:51:52| negotiate_kerberos_auth: INFO: User not
authenticated<o:p></o:p></P>
<P class=MsoNormal>2025/06/17 08:51:52.964 kid1| ERROR: Negotiate Authentication
validating user. R<o:p></o:p></P>
<P class=MsoNormal>esult: {result=BH, notes={message: gss_accept_sec_context()
failed: Unspecified<o:p></o:p></P>
<P class=MsoNormal>er <A moz-do-not-send="true">HTTP/server1@</A>REALM);
}}<o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>klist -e<o:p></o:p></P>
<P class=MsoNormal>Ticket cache: <A class=moz-txt-link-freetext
href="file:///tmp/krb5cc_138460_vF4BWcMsZu"
moz-do-not-send="true">FILE:/tmp/krb5cc_138460_vF4BWcMsZu</A><o:p></o:p></P>
<P class=MsoNormal>Default principal: <A class=moz-txt-link-freetext
moz-do-not-send="true">ext6033@ED.AC.UK</A><o:p></o:p></P>
<P class=MsoNormal>17/06/25 08:51:44 17/06/25 18:51:24
krbtgt/REALM@REALM<o:p></o:p></P>
<P class=MsoNormal> Etype (skey, tkt):
aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96<o:p></o:p></P>
<P class=MsoNormal>17/06/25 08:51:52 17/06/25 18:51:24
HTTP/server@<o:p></o:p></P>
<P class=MsoNormal> Etype (skey, tkt):
aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96<o:p></o:p></P>
<P class=MsoNormal> Ticket server:
server/REALM@REALM<o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>With the same behaviour if I use the Dynamic Zone record in
the curl command i.e.<o:p></o:p></P>
<P class=MsoNormal>curl -ik -vvv -L --proxy-negotiate -U : -b ~/cookiejar.txt -c
~/cookiejar.txt -x <A class=moz-txt-link-rfc2396E
href="test-squid-cluster.dyn-zone:3128" moz-do-not-send="true">"
test-squid-cluster.dyn-zone:3128"</A> <A class=moz-txt-link-freetext
href="https://www.bbc.co.uk"
moz-do-not-send="true">https://www.bbc.co.uk</A><o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal><o:p>Ubuntu 24.04</o:p></P>
<P class=MsoNormal><o:p>curl -ik -vvv -L --proxy-negotiate -U : -b
~/cookiejar.txt -c ~/cookiejar.txt -x <A class=moz-txt-link-rfc2396E
href="test.squid.cluster:3128"
moz-do-not-send="true">"test.squid.cluster:3128"</A> <A
class=moz-txt-link-rfc2396E href="https://www.bbc.co.uk"
moz-do-not-send="true">"https://www.bbc.co.uk"</A> works</o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal><o:p>negotiate_kerberos_auth.cc(815): pid=668789 :2025/06/18
09:11:17| negotiate_kerberos_auth: DEBUG: OK
token=oYG3MIG0oAMKAQChCwYJKoZIhvcSAQICooGfBIGcYIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRvJ1BxA5rnZjKbfBVE0YqUlnYx7oLguj09HLH4SJRumUjWWXh99B/4X72vpFqCXeOKmvzSDlWG0Io1ZjQxNOxqni4sFx8exojIzg4aIWKAcYB21OHr9m0T9dfymDVoV61Cofyq38fUaN5Loen9YX0h
user=account<BR>2025/06/18 09:11:17| negotiate_kerberos_auth: INFO: User account
authenticated<BR></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal><o:p>klist -e<BR>Ticket cache: <A class=moz-txt-link-freetext
href="file:///tmp/krb5cc_1001_7KsHEg"
moz-do-not-send="true">FILE:/tmp/krb5cc_1001_7KsHEg</A><BR>Default principal:
account@REALM<BR><BR>Valid starting
Expires
Service principal<BR>06/18/25 09:10:09 06/18/25 19:10:09
krbtgt/REALM@REALM<BR> renew until 06/19/25 09:09:36, Etype
(skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 <BR>06/18/25
09:11:17 06/18/25 19:10:09
HTTP/test-squid-cluster.dyn-zone@<BR> renew until 06/19/25
09:09:36, Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96
<BR></o:p></P>
<P class=MsoNormal><BR><o:p></o:p></P>
<P class=MsoNormal><o:p>curl -ik -vvv -L --proxy-negotiate -U : -b
~/cookiejar.txt -c ~/cookiejar.txt -x <A class=moz-txt-link-rfc2396E
href="test-squid-cluster.dyn-zone:3128"
moz-do-not-send="true">"test-squid-cluster.dyn-zone:3128"</A> <A
class=moz-txt-link-rfc2396E href="https://www.bbc.co.uk"
moz-do-not-send="true">"https://www.bbc.co.uk"</A></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal><o:p>Works as well<BR></o:p></P>
<P class=MsoNormal><o:p>klist -e<BR>Ticket cache: <A class=moz-txt-link-freetext
href="file:///tmp/krb5cc_1001_7KsHEg"
moz-do-not-send="true">FILE:/tmp/krb5cc_1001_7KsHEg</A><BR>Default principal:
account@REALM<BR><BR>Valid starting
Expires
Service principal<BR>06/18/25 09:17:11 06/18/25 19:17:11
krbtgt/REAM@REALM<BR> renew until 06/19/25 09:16:55, Etype
(skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 <BR>06/18/25
09:17:38 06/18/25 19:17:11
HTTP/test-squid-cluster.dyn-zone@<BR> renew until 06/19/25
09:16:55, Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96
<BR> Ticket server: <A
class="moz-txt-link-abbreviated moz-txt-link-freetext"
moz-do-not-send="true">HTTP/test-exams-cache.www-dyn.ed.ac.uk@ED.AC.UK</A><BR></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>Mac (Sequoia 15.5)<o:p></o:p></P>
<P class=MsoNormal>curl -ik -vvv -L --proxy-negotiate -U : -b ~/cookiejar.txt -c
~/cookiejar.txt -x <A class=moz-txt-link-rfc2396E
href="test.squid.cluster.dyn-zone:3128"
moz-do-not-send="true">"test.squid.cluster.dyn-zone:3128"</A> <A
class=moz-txt-link-freetext href="https://www.bbc.co.uk"
moz-do-not-send="true">https://www.bbc.co.uk</A><o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>2025/06/17 09:32:26| negotiate_kerberos_auth: INFO: User not
authenticated<o:p></o:p></P>
<P class=MsoNormal>2025/06/17 09:32:26.600 kid1| ERROR: Negotiate Authentication
validating user. R<o:p></o:p></P>
<P class=MsoNormal>esult: {result=BH, notes={message: gss_accept_sec_context()
failed: Unspecified<o:p></o:p></P>
<P class=MsoNormal>GSS failure. Minor code may provide more information.
Cannot find key for HTTP/<o:p></o:p></P>
<P class=MsoNormal>test-squid-cluster.dyn-zone@REALM kvno 2 in keytab (request
ticket serv<o:p></o:p></P>
<P class=MsoNormal>er <A class=moz-txt-link-freetext
moz-do-not-send="true">HTTP/test.squid.cluster@</A>REALM); }}<o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>klist -v<o:p></o:p></P>
<P class=MsoNormal>Server: <A class=moz-txt-link-freetext
moz-do-not-send="true">HTTP/test.squid.cluster@</A>REALM<o:p></o:p></P>
<P class=MsoNormal>Client: account@REALM<o:p></o:p></P>
<P class=MsoNormal>Ticket etype: aes256-cts-hmac-sha1-96, kvno 2<o:p></o:p></P>
<P class=MsoNormal>Ticket length: 1690<o:p></o:p></P>
<P class=MsoNormal>Auth time: Jun 17 09:32:17 2025<o:p></o:p></P>
<P class=MsoNormal>Start time: Jun 17 09:32:26 2025<o:p></o:p></P>
<P class=MsoNormal>End time: Jun 17 19:31:56 2025<o:p></o:p></P>
<P class=MsoNormal>Ticket flags: enc-pa-rep, pre-authent,
forwardable<o:p></o:p></P>
<P class=MsoNormal>Addresses: addressless<o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>curl -ik -vvv -L --proxy-negotiate -U : -b ~/cookiejar.txt -c
~/cookiejar.txt -x <A class=moz-txt-link-rfc2396E
href="test-squid-cluster.dyn.zone:3128"
moz-do-not-send="true">"test-squid-cluster.dyn.zone:3128"</A> <A
class=moz-txt-link-freetext href="https://www.bbc.co.uk"
moz-do-not-send="true">https://www.bbc.co.uk</A><o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>Successful:<o:p></o:p></P>
<P class=MsoNormal>2025/06/17 09:36:38| negotiate_kerberos_auth: INFO: User
account authenticated<o:p></o:p></P>
<P class=MsoNormal>2025/06/17 09:36:38.165 kid1| 82,2| external_acl.cc(700)
aclMatchExternal: ldap_group = ALLOWED<o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>Klist -v<o:p></o:p></P>
<P class=MsoNormal>Server: <A
moz-do-not-send="true">krbtgt/REALM@</A>REALM<o:p></o:p></P>
<P class=MsoNormal>Client: account@REALM <o:p></o:p></P>
<P class=MsoNormal>Ticket etype: aes256-cts-hmac-sha1-96, kvno 11<o:p></o:p></P>
<P class=MsoNormal>Ticket length: 1683<o:p></o:p></P>
<P class=MsoNormal>Auth time: Jun 17 09:36:31 2025<o:p></o:p></P>
<P class=MsoNormal>End time: Jun 17 19:36:23 2025<o:p></o:p></P>
<P class=MsoNormal>Ticket flags: enc-pa-rep, pre-authent, initial,
forwardable<o:p></o:p></P>
<P class=MsoNormal>Addresses: addressless<o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>Server: <A class=moz-txt-link-freetext
moz-do-not-send="true">HTTP/test-squid-cluster.dyn.zone@</A>REALM<o:p></o:p></P>
<P class=MsoNormal>Client: <A
moz-do-not-send="true">account@</A>REALM<o:p></o:p></P>
<P class=MsoNormal>Ticket etype: aes256-cts-hmac-sha1-96, kvno 1<o:p></o:p></P>
<P class=MsoNormal>Ticket length: 1698<o:p></o:p></P>
<P class=MsoNormal>Auth time: Jun 17 09:36:31 2025<o:p></o:p></P>
<P class=MsoNormal>Start time: Jun 17 09:36:38 2025<o:p></o:p></P>
<P class=MsoNormal>End time: Jun 17 19:36:23 2025<o:p></o:p></P>
<P class=MsoNormal>Ticket flags: enc-pa-rep, pre-authent,
forwardable<o:p></o:p></P>
<P class=MsoNormal>Addresses: addressless<o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>The relevant parts of the squid.conf are:<o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>http_port 3128<o:p></o:p></P>
<P class=MsoNormal>cache_mem 256 mb<o:p></o:p></P>
<P class=MsoNormal>maximum_object_size_in_memory 512 KB<o:p></o:p></P>
<P class=MsoNormal>maximum_object_size 2048 mb<o:p></o:p></P>
<P class=MsoNormal>cache_dir ufs /var/spool/squid 51200 16 256<o:p></o:p></P>
<P class=MsoNormal>debug_options ALL,2<o:p></o:p></P>
<P class=MsoNormal>visible_hostname test-squid-cluster.dyn.zone<o:p></o:p></P>
<P class=MsoNormal>unique_hostname server1<o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>refresh_pattern
.
0 20% 4320
ignore-reload<o:p></o:p></P>
<P class=MsoNormal>auth_param basic children 10<o:p></o:p></P>
<P class=MsoNormal>auth_param negotiate program
/usr/lib64/squid/negotiate_kerberos_auth -k /etc/squid/HTTP.keytab -s <A
class=moz-txt-link-freetext
moz-do-not-send="true">HTTP/test-squid-cluster.dyn.zone@</A>REALM -d -i
-r<o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>(We also have LDAP basic auth configured as a fallback which
works as expected but modern Windows clients no longer support basic auth for
proxy servers).<o:p></o:p></P>
<P class=MsoNormal><o:p></o:p> </P>
<P class=MsoNormal>klist -k /etc/squid/HTTP.keytab<o:p></o:p></P>
<P class=MsoNormal>Keytab name: <A class=moz-txt-link-freetext
href="file:///etc/squid/HTTP.keytab"
moz-do-not-send="true">FILE:/etc/squid/HTTP.keytab</A><o:p></o:p></P>
<P class=MsoNormal>KVNO Principal<o:p></o:p></P>
<P class=MsoNormal>----
--------------------------------------------------------------------------<o:p></o:p></P>
<P class=MsoNormal> 1 <A
moz-do-not-send="true">TESTSQUIDCACHE@</A>REALM<o:p></o:p></P>
<P class=MsoNormal> 1 <A
moz-do-not-send="true">TESTSQUIDCACHE@</A>REALM<o:p></o:p></P>
<P class=MsoNormal> 1 <A
moz-do-not-send="true">TESTSQUIDCACHE@</A>REALM<o:p></o:p></P>
<P class=MsoNormal> 1 <A class=moz-txt-link-freetext
moz-do-not-send="true">HTTP/test-squid-cache.dyn.zone@</A>REALM<o:p></o:p></P>
<P class=MsoNormal> 1 <A class=moz-txt-link-freetext
moz-do-not-send="true">HTTP/test-squid-cache.dyn.zone@</A>REALM<o:p></o:p></P>
<P class=MsoNormal> 1 <A class=moz-txt-link-freetext
moz-do-not-send="true">HTTP/test-squid-cache.dyn.zone@</A>REALM<o:p></o:p></P>
<DIV>
<P class=MsoNormal><SPAN
style="COLOR: #212121; mso-ligatures: none; mso-fareast-language: en-gb"><o:p></o:p></SPAN> </P>
<P class=MsoNormal><SPAN
style="COLOR: #212121; mso-ligatures: none; mso-fareast-language: en-gb">/etc/hosts<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="COLOR: #212121; mso-ligatures: none; mso-fareast-language: en-gb">1.2.3.4
server1.cache server1 test-squid-cache.dyn.zone
test.squid.cluster<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="COLOR: #212121; mso-ligatures: none; mso-fareast-language: en-gb"><o:p></o:p></SPAN> </P>
<P class=MsoNormal><SPAN
style="COLOR: #212121; mso-ligatures: none; mso-fareast-language: en-gb">Finally
the keytab was generated using msktutil e.g.<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="COLOR: #212121; mso-ligatures: none; mso-fareast-language: en-gb">msktutil
-c -h test-squid-cache.dyn.zone -b 'OU=Managed-Linux,OU=Infrastructure'
--computer-name TESTSQUIDCACHE -s HTTP/test-squid-cache.dyn.zone -k
/etc/squid/HTTP.keytab --server domain.controller --realm REALM
--use-service-account --dont-expire-password --upn <A
class=moz-txt-link-freetext
moz-do-not-send="true">HTTP/test-squid-cache.dyn.zone@REALM</A><o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="COLOR: #212121; mso-ligatures: none; mso-fareast-language: en-gb"><o:p></o:p></SPAN> </P>
<P class=MsoNormal><SPAN
style="COLOR: #212121; mso-ligatures: none; mso-fareast-language: en-gb">This
works fairly well/reliably if we use a keytab containing the HTTP/fqdn of the
server itself i.e. HTTP/server1 AND connect using curl using the FQDN of server1
but we need resiliency and high-availability so having a single-host service
would be a last resort.<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="COLOR: #212121; mso-ligatures: none; mso-fareast-language: en-gb"><o:p></o:p></SPAN> </P>
<P class=MsoNormal><SPAN
style="COLOR: #212121; mso-ligatures: none; mso-fareast-language: en-gb">Any
ideas on where I’m going wrong or what I need to add in terms of DNS/keytab
entries? Also some of the clients attempt to use key versions which have never
been issued e.g. kvno 4? <o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="COLOR: #212121; mso-ligatures: none; mso-fareast-language: en-gb"><o:p></o:p></SPAN> </P>
<P class=MsoNormal><SPAN
style="COLOR: #212121; mso-ligatures: none; mso-fareast-language: en-gb">Kind
regards,<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="COLOR: #212121; mso-ligatures: none; mso-fareast-language: en-gb">Mark<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="COLOR: #212121; mso-ligatures: none; mso-fareast-language: en-gb">--<BR>/****************************<BR><BR>Mark
Cairney<BR>ITI Enterprise Services<BR>Information Services<BR>University of
Edinburgh<BR><BR>Tel: 0131 650 6565<BR>Email: </SPAN><U><SPAN
style="COLOR: #0078d7; mso-ligatures: none; mso-fareast-language: en-gb"><A
class=moz-txt-link-freetext
moz-do-not-send="true">Mark.Cairney@ed.ac.uk</A></SPAN></U><SPAN
style="COLOR: #212121; mso-ligatures: none; mso-fareast-language: en-gb"><BR><BR>*******************************/<BR><BR>The
University of Edinburgh is a charitable body, registered in Scotland, with
registration number SC005336.</SPAN><!--[if !vml]--><IMG
style="HEIGHT: 0.333in; WIDTH: 0.333in" alt=signature_2526785256
src="cid:378E760B59F348FCA60BF8CBB549AAAB@Ultrabook1" width=32 height=32
v:shapes="Rectangle_x0020_1"><!--[endif]--><o:p></o:p></P></DIV></DIV>
<P>
<HR>
_______________________________________________<BR>squid-users mailing
list<BR>squid-users@lists.squid-cache.org<BR>https://lists.squid-cache.org/listinfo/squid-users<BR></DIV></DIV></DIV></DIV></BODY></HTML>