[squid-users] Squid - using NTLM for SSO

Wed May 10 06:23:19 UTC 2017

On 10/05/17 12:16, Dijxie wrote:
>
>> Hello list,
>>
>>
>> I need your help with a Squid-Proxy (3.5) NTLM Auth, the aim is to 
>> use SSO for my windows clients.
>>
>> My Windows-Clients are using Active-Directory running on a Samba4-PDC.
>>
>> I set up ldap basic auth in a developer environment, now I want to 
>> achieve SSO. (using NTLM?)
>>
>> The Documentation on 
>> http://wiki.squid-cache.org/ConfigExamples/Authenticate/Ntlm doesn't 
>> really help me enough (on my knowledge about squid and forms of 
>> authentication/samba).
>>
>>
>> Tests:
>>
>> -> testing Kerberos
>>
>> I'm able to obtain (kinit) tickets and list them (klist)
>>
>>
>> root at xxx-testproxy01:~# kinit Administrator
>> Password for Administrator at X-XXX.LOCAL:
>> root at xxx-testproxy01:~# klist
>> Ticket cache: FILE:/tmp/krb5cc_0
>> Default principal: Administrator at X-XXX.LOCAL
>>
>> Valid starting       Expires              Service principal
>> 2017-05-09 08:43:25  2017-05-09 18:43:25 krbtgt/X-XXX.LOCAL at X-XXX.LOCAL
>>     renew until 2017-05-10 08:43:21
>>
>> -> testing Samba:
>> I joined my domain X-XXX.
>> Test support for ntlm:
>> root at xxx-testproxy01:~# wbinfo -a testuser%xxxxxxxxxxx
>> plaintext password authentication succeeded
>> challenge/response password authentication succeeded
>>
>> root at xxx-testproxy01:~# wbinfo -a testuser%xxxxxxxxxxx
>> plaintext password authentication succeeded
>> challenge/response password authentication succeeded
>> root at xxx-testproxy01:~# wbinfo -t
>> checking the trust secret for domain X-XXX via RPC calls succeeded
>> root at xxx-testproxy01:~# wbinfo -g
>> X-XXX\cert publishers
>> ...negotiate_wrapper
>> X-XXX\webusers
>>
>> -> Testing NTLM-helper:
>> Now here's my problem.
>>
>> root at xxx-testproxy01:~# /usr/bin/ntlm_auth 
>> --helper-protocol=squid-2.5-ntlmssp --username=testuser 
>> --password=xxxxxxxxxxx
>> x-xxx\testuserxxxxxxxxxxx
>> SPNEGO request [testuser xxxxxxxxxxx] invalid prefix
>> BH SPNEGO request invalid prefix
>>
>> root at xxx-testproxy01:~# /usr/bin/ntlm_auth 
>> --helper-protocol=squid-2.5-basic --username=testuser 
>> --password=xxxxxxxxxxx
>> x-xxx\testuser xxxxxxxxxxx
>> OK
>>
>> What is ntlmssp? I read both helpers on tutorials. If I need both, 
>> why do I need both?
>> My squid is starting how it should, logs are looking normal, PopUp 
>> for authentication appears aswell, but I can't log in. I shoudn't 
>> need to authenticate in the first place because it should use SSO.
>> What is missing/faulty?
>> The rest of squid is basic stuff:mail/u/0/
>> auth_param ntlm program /usr/bin/ntlm_auth 
>> –helper-protocol=squid-2.5-ntlmssp --username=testuser 
>> --password=Passme123
>> auth_param ntlm children 10
>> auth_param basic program /usr/bin/ntlm_auth 
>> –helper-protocol=squid-2.5-basic --username=testuser --password=Passme123
>> auth_param basic children 5
>> auth_param basic realm Proxy Server
>> auth_param basic credentialsttl 2 hours
>> auth_param basic casesensitive off
>> authenticate_cache_garbage_interval 10 seconds
>> ...
>> acl auth proxy_auth REQUIRED
>> acl SSL_ports port 443
>> acl Safe_ports port 80          # http
>> acl Safe_ports port 21          # ftp
>> acl Safe_ports port 443         # https
>> acl Safe_ports port 70          # gopher
>> acl Safe_ports port 210         # wais
>> acl Safe_ports port 1025-65535  # unregistered ports
>> acl Safe_ports port 280         # http-mgmt
>> acl Safe_ports port 488         # gss-http
>> acl Safe_ports port 591         # filemaker
>> acl Safe_ports port 777         # multiling http
>> acl CONNECT method CONNECT
>> ...
>> http_access deny !Safe_ports
>>
>> # Deny CONNECT to other than secure SSL ports
>> http_access deny CONNECT !SSL_ports
>>
>> # Only allow cachemgr access from localhost
>> http_access allow localnet
>> http_access allow localhost manager
>> http_access deny !auth
>> http_access allow auth
>> http_access deny all
>> ...
>> url_rewrite_program /usr/bin/squidGuard -c 
>> /etc/squidguard/squidGuard.conf
>> url_rewrite_children 5
>>
>> Does anyone know further? Thanks in advance.
>> - Kevin
>>
>>
>> _______________________________________________
>> squid-users mailing list
>> squid-users at lists.squid-cache.org
>> http://lists.squid-cache.org/listinfo/squid-users
>
> Hi,
>
>
> 1. There is no point in testing kerberos (kinit) when you're going to 
> use ntlm_auth helper; squid has it's spnego helper, 'negotiate_wrapper 
> ', which is capable doing negotiation between kerberos and NTLM.  Just 
> look for squid-helpers package for your OS; if it's not in OS repo, 
> check http://ngtech.co.il/repo/ - Eliezer is doing really good job here.
>
> If kerberos is working in your environment, I would use 
> negotiate_wrapper or negotiate_kerberos_auth.  Good thing about 
> negotiate_wrapper is -d switch, which is giving you a good portion of 
> debug info in cache.log
>
> Really, NTLM is bitchy and it is not primary protocol even in MS 
> systems since 2003/XP. If you can fulfill kerberos' requirements in 
> your environment,  I would go into kerberos, not NTLM.
>
>
> 2. My guess is that you have problem with access to 
> windbind_priviledged pipe; can you perform usr/bin/ntlm_auth 
> --helper-protocol=squid-2.5-ntlmssp --username=testuser 
> --password=...et cetera witch ptrace? There is still a mess with 
> winbind's pipe location; /var/run/samba vs /var/lib/samba, perharps 
> you need some symlinking, ptrace can give you a clue.
>

The *full* setup related to Squid and winbind permissions is detailed at 
<http://wiki.squid-cache.org/ConfigExamples/Authenticate/Ntlm#winbind_privileged_pipe_permissions> 
- pay particular attention to the three notes. Do ONLY what is 
specifically mentioned there, any other permissions fiddling done will 
only screw things up.

>
> 3. Sometimes - just sometimes - passing --domain=DOMAIN_NAME to 
> /usr/bin/ntlm_auth resolves cosmic issues. Sometimes it's 
> DOMAIN\username vs just username in --username.
>
>
> Last thing is error message: "BH SPNEGO request invalid prefix".  It 
> is strange, at least for me. SPNEGO reply is rather kerberos or 
> negotiate reply; not ntlm_auth. What distro are you using?
>

That output happened because Kevin passed the clear text (Basic auth) 
username/password to the helper when it was running in NTLM mode.  As 
you may notice the exact same input works fine when the helper is run in 
Basic mode.

When the helper is run with --helper-protocol=squid-2.5-ntlmssp the 
input it is expecting is the base64 encoded NTLMSSP object as found in 
the HTTP request headers. Squid does *not* decode the received header 
before sending it to the helper. The helper will respond with the crypto 
hunk to be sent to the client.

Amos