[squid-users] Squid authentication issues

L.P.H. van Belle belle at bazuin.nl
Fri Jul 31 07:01:23 UTC 2020


I use this : 

You need this in smb.conf 
# Added for freeradius or squid proxy support
# Obligated to set on both AD-DC and Member server.
ntlm auth = mschapv2-and-ntlmv2-only 

And this or something like that, i have more working auth setups for squid, 
But i use this primarly. 

auth_param negotiate program /usr/lib/squid/negotiate_wrapper_auth \
    --kerberos /usr/lib/squid/negotiate_kerberos_auth -k /etc/squid/HTTP.keytab \
    -s HTTP/proxy1.internal.domain.tld at REALM \
    --ntlm /usr/bin/ntlm_auth --helper-protocol=gss-spnego --domain=NTDOM

Still not working try/change above line to : 
    --ntlm /usr/bin/ntlm_auth --allow-mschapv2 --helper-protocol=gss-spnego --domain=NTDOM

But should not be needed. 

And dont forget to add the HTTP spn on the member server.
net ads keytab add_update_ads HTTP/proxy1.internal.domain.tld -UAdministrator

Also, A+PTR records are a must for the proxy with kerberos auth, 


And do remove from smb.conf : 
>     winbind enum users = yes
>     winbind enum groups = yes
Or set these to no. 

I use that on Debian 10 with now squid 4.12. (ssl enabled)
(since debian 8 and squid 3.x ) 
There are more options here, but start with above.

My setup does, in this order. 
Negotiated Kerberos/NTLM auth with LDAP auth as fall back.

Beside these few small point, your setup looks great to me. 


Greetz, 

Louis


________________________________

	Van: squid-users [mailto:squid-users-bounces at lists.squid-cache.org] Namens Marcio Demetrio Bacci
	Verzonden: donderdag 30 juli 2020 19:37
	Aan: Squid Users
	Onderwerp: [squid-users] Squid authentication issues
	
	
	Hi,
	
	I set up Squid 4.6 on Debian 10 and I'm having problems with browser authentication on a Windows station.
	
	I did the tests on the command line and apparently it's OK.
	
	root at proxy:/etc/squid/acls# /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
	Registered MSG_REQ_POOL_USAGE
	Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED
	lp_load_ex: refreshing parameters
	Initialising global parameters
	rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
	Processing section "[global]"
	EMPRESA+mane XXXXX
	NT_STATUS_OK: The operation completed successfully. (0x0)
	OK
	
	Here are my configuration files:
	
	#/ETC/SAMBA/SMB.CONF
	[global]
	    netbios name = PROXY
	    workgroup = EMPRESA
	    security = ADS
	    realm = EMPRESA.COM.BR
	    encrypt passwords = yes
	    username map = /etc/samba/user.map
	
	    log file = /var/log/samba/%m.log
	    log level = 3 passdb:5 auth:5
	
	    idmap config * : backend = tdb
	    idmap config * : range = 3000-7999
	
	    idmap config EMPRESA:backend = ad
	    idmap config EMPRESA:schema_mode = rfc2307
	    idmap config EMPRESA:range = 10000-999999
	    idmap config EMPRESA:unix_nss_info = yes
	    idmap config EMPRESA:unix_primary_group = yes
	
	    winbind refresh tickets = Yes
	    winbind use default domain = yes
	    winbind separator = +
	    winbind enum users = yes
	    winbind enum groups = yes
	
	    vfs objects = acl_xattr
	    map acl inherit = yes
	    store dos attributes = yes
	
	    template shell = /bin/bash
	    template homedir = /home/%U
	
	    dedicated keytab file = /etc/krb5.keytab
	    kerberos method = secrets and keytab
	
	    load printers = no
	    printing = bsd
	    printcap name = /dev/null
	    disable spoolss = yes
	
	#ETC/NSSWITCH.CONF
	# /etc/nsswitch.conf
	#
	# Example configuration of GNU Name Service Switch functionality.
	# If you have the `glibc-doc-reference' and `info' packages installed, try:
	# `info libc "Name Service Switch"' for information about this file.
	
	passwd:         compat winbind 
	group:          compat winbind 
	shadow:         compat
	gshadow:        files
	
	hosts:          files dns
	networks:       files
	
	protocols:      db files
	services:       db files
	ethers:         db files
	rpc:            db files
	netgroup:       nis
	
	#/ETC/KRB5.CONF
	[libdefaults]
	    dns_lookup_realm = false
	    dns_lookup_kdc = true
	    default_realm = EMPRESA.COM.BR
	
	#/ETC/SQUID/SQUID.CONF
	
	http_port 3128
	
	cache_mem 512 MB
	cache_swap_low 80
	cache_swap_high 90
	
	maximum_object_size 512 MB
	minimum_object_size 0 KB
	
	maximum_object_size_in_memory 4096 KB
	
	cache_replacement_policy heap LFUDA
	memory_replacement_policy heap LFUDA
	
	quick_abort_min -1 KB
	
	detect_broken_pconn on
	
	fqdncache_size 1024
	
	refresh_pattern ^ftp: 1440 20% 10080
	refresh_pattern ^gopher: 1440 0% 1440
	refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
	refresh_pattern . 0 20% 4320
	
	access_log /var/log/squid/access.log
	cache_log /var/log/squid/cache.log
	
	cache_dir aufs /var/spool/squid 600 16 256
	
	auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
	auth_param ntlm children 20 startup=0 idle=1
	auth_param ntlm keep_alive on
	
	visible_hostname "Monitoramento de Acesso à Internet"
	### acls
	#acl manager proto cache_object
	acl localhost src MailScanner warning: numerical links are often malicious: 192.168.1.17/32 <http://192.168.1.17/32> 
	acl to_localhost dst MailScanner warning: numerical links are often malicious: 192.168.1.17/32 <http://192.168.1.17/32> 
	acl SSL_ports port 22 80 3456 443 563 587 993 2811 3001 3322 7071 8443 9191 10000 23000 
	acl Safe_ports port 21 # ftp
	acl Safe_ports port 70 # gopher
	acl Safe_ports port 80 # http
	acl Safe_ports port 88 # kerberos
	acl Safe_ports port 123 # ntp
	acl Safe_ports port 210 # wais
	acl Safe_ports port 280 # http-mgmt
	acl Safe_ports port 3456 # Siafi
	acl Safe_ports port 389 # ldap
	acl Safe_ports port 443 # https
	acl Safe_ports port 488 # gss-http
	acl Safe_ports port 563 # snews
	acl Safe_ports port 591 # filemaker
	acl Safe_ports port 777 # multiling http
	acl Safe_ports port 3001         # imprenssa nacional
	acl Safe_ports port 8080 # http
	acl Safe_ports port 8443 # http
	acl Safe_ports port 1025-65535 # unregistered ports
	
	acl purge method PURGE
	acl CONNECT method CONNECT
	
	# ---- Windows Update ----
	acl microsoft url_regex "/etc/squid/acls/ms-update"
	acl atualizacoes dstdomain microsoft.com
	http_access allow microsoft
	http_access allow atualizacoes
	
	http_access allow localhost
	http_access allow purge localhost
	http_access deny purge
	http_access deny !Safe_ports
	http_access deny CONNECT !SSL_ports
	
	acl autenticados proxy_auth REQUIRED
	http_access deny !autenticados
	
	acl sites_liberados url_regex -i "/etc/squid/acls/sites-permitidos"
	http_access allow sites_liberados
	
	acl extensoes_bloqueadas url_regex -i "/etc/squid/acls/extensoes-proibidas"
	http_access deny extensoes_bloqueadas
	
	### Bloqueia sites por URL
	acl sites_bloqueados url_regex -i "/etc/squid/acls/sites-proibidos"
	http_access deny sites_bloqueados
	
	### Rede LAN #####
	acl rede_usuarios src MailScanner warning: numerical links are often malicious: 192.168.0.0/24 <http://192.168.0.0/24> 
	
	
	### Nega acesso de quem nao esta na rede local
	http_access allow rede_usuarios
	acl extensoes_bloqueadas url_regex -i "/etc/squid/acls/extensoes-proibidas"
	acl sites_liberados url_regex -i "/etc/squid/acls/sites-permitidos"
	http_access allow sites_liberados
	http_access deny extensoes_bloqueadas
	http_access allow autenticados
	http_access deny all
	
	error_directory /usr/share/squid/errors/pt-br
	
	coredump_dir /var/spool/squid
	
	can anybody help me?
	
	Regards,
	
	Márcio Bacci
	




More information about the squid-users mailing list