Thanks for the reply. The wrong behavior appears no matters if IE or Firefox are the default browser as long as the user works with a MS application. We have checked proxy configuration in MS Windows Media Player and it's ok (but keeps asking for username and password) and proxycfg reports a right configuration. MS Office has no way to configure it, so, it uses IE configuration. Also, we have tried upgrading and downgrading Squid, but, the thing is that in some circumstances, MS apps, doesn't use IE proxy configuration but this isn't happen whith others like OpenOffice. Also, there is no other IP in the log because we are using Dansguardian, but, we have tested just working with Squid and it's the same behavior. Next is better log extract : 127.0.0.1 - - [01/Oct/2009:15:49:53 -0500] "GET http://www.microsoft.com/isapi/redir.dll? HTTP/1.0" 407 1901 TCP_DENIED:NONE 127.0.0.1 - smedina [01/Oct/2009:15:49:55 -0500] "GET http://www.microsoft.com/isapi/redir.dll? HTTP/1.0" 302 784 TCP_MISS:DIRECT 127.0.0.1 - smedina [01/Oct/2009:15:49:55 -0500] "GET http://go.microsoft.com/fwlink/? HTTP/1.0" 302 655 TCP_MISS:DIRECT 127.0.0.1 - smedina [01/Oct/2009:15:49:56 -0500] "GET http://latam.msn.com/? HTTP/1.0" 200 15908 TCP_MISS:DIRECT 127.0.0.1 - smedina [01/Oct/2009:15:49:56 -0500] "GET http://rad.msn.com/ADSAdClient31.dll? HTTP/1.0" 403 1434 TCP_DENIED:NONE 127.0.0.1 - smedina [01/Oct/2009:15:49:56 -0500] "GET http://a.rad.msn.com/ADSAdClient31.dll? HTTP/1.0" 403 1438 TCP_DENIED:NONE 127.0.0.1 - smedina [01/Oct/2009:15:49:56 -0500] "GET http://b.rad.msn.com/ADSAdClient31.dll? HTTP/1.0" 403 1438 TCP_DENIED:NONE 127.0.0.1 - smedina [01/Oct/2009:15:49:56 -0500] "GET http://c.msn.com/c.gif? HTTP/1.0" 200 599 TCP_MISS:DIRECT 127.0.0.1 - smedina [01/Oct/2009:15:49:57 -0500] "GET http://rad.msn.com/ADSAdClient31.dll? HTTP/1.0" 403 1434 TCP_DENIED:NONE 127.0.0.1 - smedina [01/Oct/2009:15:49:57 -0500] "GET http://msnportal.112.2o7.net/b/ss/msnportallatamhome/1/H.1-pdv-2/s05276950994648? HTTP/1.0" 200 685 TCP_MISS:DIRECT 127.0.0.1 - smedina [01/Oct/2009:15:49:57 -0500] "GET http://a.rad.msn.com/ADSAdClient31.dll? HTTP/1.0" 403 1438 TCP_DENIED:NONE 127.0.0.1 - smedina [01/Oct/2009:15:49:58 -0500] "GET http://latam.msn.com/ajax/horoscope.aspx? HTTP/1.0" 200 2988 TCP_MISS:DIRECT 127.0.0.1 - - [01/Oct/2009:15:50:35 -0500] "GET http://www.google.com.pe/ HTTP/1.0" 407 1853 TCP_DENIED:NONE 127.0.0.1 - smedina [01/Oct/2009:15:50:42 -0500] "GET http://www.google.com.pe/ HTTP/1.0" 200 4746 TCP_MISS:DIRECT 127.0.0.1 - smedina [01/Oct/2009:15:50:43 -0500] "GET http://www.google.com.pe/ HTTP/1.0" 200 4379 TCP_MISS:DIRECT 127.0.0.1 - smedina [01/Oct/2009:15:50:43 -0500] "GET http://www.google.com.pe/images/close_sm.gif HTTP/1.0" 200 627 TCP_HIT:NONE 127.0.0.1 - smedina [01/Oct/2009:15:50:43 -0500] "GET http://www.google.com.pe/images/chrome_48.gif HTTP/1.0" 200 3003 TCP_HIT:NONE 127.0.0.1 - smedina [01/Oct/2009:15:50:43 -0500] "GET http://www.google.com.pe/intl/en_com/images/logo_plain.png HTTP/1.0" 200 8045 TCP_HIT:NONE 127.0.0.1 - smedina [01/Oct/2009:15:50:43 -0500] "GET http://www.google.com.pe/images/modules/buttons/g-button-chocobo-basic-2.gif HTTP/1.0" 200 865 TCP_HIT:NONE 127.0.0.1 - smedina [01/Oct/2009:15:50:43 -0500] "GET http://www.google.com.pe/images/modules/buttons/g-button-chocobo-basic-1.gif HTTP/1.0" 200 9540 TCP_HIT:NONE 127.0.0.1 - smedina [01/Oct/2009:15:50:43 -0500] "GET http://www.google.com.pe/favicon.ico HTTP/1.0" 200 1706 TCP_HIT:NONE 127.0.0.1 - smedina [01/Oct/2009:15:50:43 -0500] "GET http://www.google.com.pe/images/nav_logo7.png HTTP/1.0" 200 5978 TCP_HIT:NONE 127.0.0.1 - smedina [01/Oct/2009:15:50:44 -0500] "GET http://www.google.com.pe/extern_js/f/CgJlcxICcGUrMAo4NiwrMA44BywrMBY4ECwrMBc4AywrMBg4BCwrMCU4yYgBLCswJjgFLCswJzgCLA/3__u7Qm5Gk4.js HTTP/1.0" 200 6295 TCP_MISS:DIRECT 127.0.0.1 - smedina [01/Oct/2009:15:50:44 -0500] "GET http://clients1.google.com.pe/generate_204 HTTP/1.0" 204 330 TCP_MISS:DIRECT 127.0.0.1 - smedina [01/Oct/2009:15:50:44 -0500] "GET http://www.google.com.pe/csi? HTTP/1.0" 204 421 TCP_MISS:DIRECT Thanks again! --- Walter Cuestas Agramonte, Certified | Ethical Hacker (C|EH) SANS/GIAC Certified Penetration Tester (GPEN) Gerente General Phone : 511-997926168 Ethical Hacking/Forensics/InfoSec http://www.open-sec.com http://ehopen-sec.blogspot.com/ On Wed, Sep 30, 2009 at 10:04 PM, Amos Jeffries <squid3@xxxxxxxxxxxxx> wrote: > On Wed, 30 Sep 2009 21:05:07 -0500, Walter Cuestas <wcuestas@xxxxxxxxxxxx> > wrote: >> Hi, in short : >> >> Every time a user click on a link in a MS Office document or select some >> Internet related app (like MS Windows Media Player), the user if forced > to >> re-authenticate (a popup window appears). >> >> We have tested using Firefox instead IE7/IE8 and happens the same, but, > if >> we use OpenOffice.org and Firefox in the same machines, no >> re-authentication is required. So, it seems this is a MS related problem >> with Squid. (Time and resource usage related stuff has been tested and >> are not the source of this problem). > > > Yes. New internet links by new software not already knowing the login tends > to do this. > > Clicking on links within firefox is no different to opening IE and clicking > links inside the pages themselves. > OpenOffice I dare say makes firefox or IE open the page, yes? which would > make the browser work with the proxy as it would for any other web page > using credentials it has previously been given for the proxy. > > MS software tends to link individually to the web engine software built > into windows. So each app (Media Player, IE, MSN, Live Messenger, Office, > etc) has effectively its own different web browser. With their own settings > etc. > > You might be able to get around some of this by ensuring that the MS > software all use the same proxy settings. > ( to do that set the IE internet options correctly then run the command > line "proxycfg -u" ) but that will not help unless you can enter the user > credentials into every piece of browser software on the computer as well. > Or use some form of single-sign-on. > > Personally I dislike this model of embedding, but I applaud MS for at least > keeping the private settings separate by default. > >> >> The authentication uses the basic one (not NTLM) and goes to an Active >> Directory. >> >> Any clue about it will help us a lot! > > Please upgrade to a recent STABLE release as soon as possible. *10 was > officially withdrawn for serious usability issues. There are also major > security issues as far up as *18. I hope the 2.1 part of your version > numbering means those at least have been patched. > >> >> Thanks in advance. >> >> PD: Some extract from access.log : > > An extract which does not include the successful requests ( *_MISS and > *_HIT) would be easier to read... > > Cropping it down shows only two there. > * One is a outright forbidden (403) > * The other is missing authentication credentials (407). > * all requests are logged from 127.0.0.1 which prevents any track of > whether the auth was retried later. > > > >> 127.0.0.1 - smedina [30/Sep/2009:16:40:39 -0500] "GET >> http://rad.msn.com/ADSAdClient31.dll? HTTP/1.0" 403 1522 TCP_DENIED:NONE > >> 127.0.0.1 - - [30/Sep/2009:16:40:46 -0500] "GET >> http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl HTTP/1.0" 407 >> 2039 TCP_DENIED:NONE > > There is little more we can say with the given details. The fact that > Firefox has no issues indicates it's not a Squid problem. > > Amos > >
