Hi Guys!
Probably this is not the best place to ask, I'll try anyway... =)
I've been trying to configure a Samba PDC and a Squid Porxy server
with NTLM auth on the same machine but NTML_AUTH keeps complaining
about: NT_STATUS_INVALID_HANDLE.... I have others machines running
Squid and Authenticating against a Samba Server but on different
machines, this is the first time a try both on the same machine.
Can I use Squid+NTLM Auth and Samba configured as PDC on the same
machine? Is there any winbind issue with this kind of configuration?
I'm using SLES10+SP2
Samba version as reported by rpm is 3.0.32-0.8
Squid version as reported by rpm is 2.5.STABLE12-18.13
-------------------------------------------------
This is my smb.conf
[global]
dos charset = 850
unix charset = ISO8859-1
workgroup = C1.SV
netbios name = PDCSRVC1SV
server string =
interfaces = eth0
bind interfaces only = Yes
map to guest = Bad Password
passdb backend = ldapsam:ldap://127.0.0.1
guest account = Invitado
time server = Yes
deadtime = 20
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
printcap name = cups
logon path =
logon home =
domain logons = Yes
os level = 65
preferred master = Yes
domain master = Yes
wins support = Yes
ldap admin dn = cn=Administrador,o=Ferreteria EPA
ldap delete dn = Yes
ldap group suffix = ou=group
ldap machine suffix = ou=people
ldap passwd sync = Yes
ldap suffix = ou=c1,c=sv,o=Ferreteria EPA
ldap user suffix = ou=people
idmap domains = DEFAULT
idmap alloc backend = ldap
idmap alloc config:range = 10000-100000
idmap alloc config:ldap_url = ldap://127.0.0.1
idmap alloc config:ldap_user_dn = cn=Administrador,o=Ferreteria EPA
idmap alloc config:ldap_base_dn = ou=idmap,ou=c1,c=sv,o=Ferreteria EPA
idmap config DEFAULT:range = 10000-100000
idmap config DEFAULT:ldap_url = ldap://127.0.0.1
idmap config DEFAULT:ldap_user_dn = cn=Administrador,o=Ferreteria EPA
idmap config DEFAULT:ldap_base_dn = ou=idmap,ou=c1,c=sv,o=Ferreteria EPA
idmap config DEFAULT:default = yes
idmap config DEFAULT:readonly = no
idmap config DEFAULT:backend = ldap
ldapsam:editposix = yes
ldapsam:trusted = yes
create mask = 0640
force create mode = 0640
directory mask = 0750
force directory mode = 0750
case sensitive = No
dont descend = /proc,/dev,/etc,/lib,/lost+found,/initrd
My relevant squid.conf lines...
auth_param ntlm program /usr/bin/ntlm_auth
--helper-protocol=squid-2.5-ntlmssp C1.SV/PDCSRVC1SV
auth_param basic program /usr/bin/ntlm_auth
--helper-protocol=squid-2.5-basic C1.SV/PDCSRVC1SV
auth_param ntlm children 100
auth_param basic children 100
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
The pdc works as expected, machine join works like charm, users and
groups management works equally right, all accounts are placed in the
LDAP, getent passwd, groups and shadow shows the ldap accounts
I also did a few tests with wbinfo
e01ssvsai:/var/lib/samba/winbindd_privileged # wbinfo -u
invitado
usuarioprueba
e01ggen
e01glogis
e01gcont
e01jcomp1
e01jcomp2
e01jcomp3
e01jcomp4
e01jrepo
e01jreclu
e01rrece
e01gcom
e01ssvsai:/var/lib/samba/winbindd_privileged # wbinfo -g
BUILTIN
BUILTIN
domain users
domain admins
domain guests
grupoprueba
gcentralsv
gcompras
gcontrol
ggerencia
glogistica
gmercadeo
gpersonal
gventas
gjefecompras
gjefecontrol
gjefelogistica
gjefepersonal
e01ssvsai:/var/lib/samba/winbindd_privileged # wbinfo --all-domains
C1.SV
I also made sure squid users can read /var/lib/samba/winbindd_privileged
I also noted this error:
e01ssvsai:/var/lib/samba/winbindd_privileged # wbinfo
--authenticate=administrator%12345678
plaintext password authentication failed
error code was NT_STATUS_NO_SUCH_USER (0xc0000064)
error messsage was: No such user
Could not authenticate user administrator%12345678 with plaintext password
winbind separator was NULL!
challenge/response password authentication failed
error code was NT_STATUS_INVALID_HANDLE (0xc0000008)
error messsage was: Invalid handle
Could not authenticate user administrator with challenge/response
Does someone have any idea of could go wrong? When I use squid and
samba on different machines i usually join the squid machine to the
domain using a net join, is this necesary when the pdc and squid are
on the same machine?
Victor Medina
Samuel Goldwyn - "I don't think anyone should write their
autobiography until after they're dead."
