-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi list, I have an old installation using squid-2.6.STABLE23 with ntlm_auth for Windows XP users belonging to a group; it works like a charm, but I want to upgrade it for various reasons (security, need to support Win7, ...). So I made a fresh Linux install (Mandriva-2010.2). It has squid-3.1-14.1mdv2010.1 (but the log says Squid Cache version 3.1.4). Now I'm a bit confused about what is needed to achieve Windows authentication (XP, then 7). From the documentation, I understood that squid_kerb_auth should be enough, so I have this in squid.conf: auth_param negotiate program /usr/lib/squid/squid_kerb_auth -d The new server has joined the windows domain using mskutil (I'd like to avoid samba if possible). The DSN is OK, ntp is working so no clock problem. But authentication doesn't work, see log below. How should I configure the Windows group? So my question is simple: do I need anything else besides squid_kerb_auth for Windows group authentication? Are samba, ntlm_auth still needed? Thanks, - -- Jean-Denis Girard SysNux SystÃmes Linux en PolynÃsie franÃaise http://www.sysnux.pf/ TÃl: +689 50 10 40 / GSM: +689 79 75 27 2011/01/07 10:10:43.769| authenticateValidateUser: Validating Auth_user request '0'. 2011/01/07 10:10:43.769| authenticateValidateUser: Auth_user_request was NULL! 2011/01/07 10:10:43.769| authenticateAuthenticate: broken auth or no proxy_auth header. Requesting auth header. 2011/01/07 10:10:43.769| authenticateFixHeader: headertype:37 authuser:0 2011/01/07 10:10:43.769| AuthNegotiateConfig::fixHeader: Sending type:37 header: 'Negotiate' 2011/01/07 10:10:43.775| authenticateAuthenticate: header Negotiate YIIGJgYG [snip] 2011/01/07 10:10:43.775| authenticateAuthenticate: This is a new checklist test on FD:9 2011/01/07 10:10:43.775| authenticateAuthenticate: no connection authentication type 2011/01/07 10:10:43.775| AuthConfig::CreateAuthUser: header = 'Negotiate YIIGJg [snip] 2011/01/07 10:10:43.775| AuthUser::AuthUser: Initialised auth_user '0x8c20b08' with refcount '0'. 2011/01/07 10:10:43.775| AuthUserRequest::AuthUserRequest: initialised request 0x8c20458 2011/01/07 10:10:43.775| authenticateAuthUserLock auth_user '0x8c20b08'. 2011/01/07 10:10:43.775| authenticateAuthUserLock auth_user '0x8c20b08' now at '1'. 2011/01/07 10:10:43.775| AuthNegotiateConfig::decode: Negotiate authentication 2011/01/07 10:10:43.775| authenticateValidateUser: Validating Auth_user request '0x8c20458'. 2011/01/07 10:10:43.775| authenticateValidateUser: Validated Auth_user request '0x8c20458'. 2011/01/07 10:10:43.775| authenticateValidateUser: Validating Auth_user request '0x8c20458'. 2011/01/07 10:10:43.775| authenticateValidateUser: Validated Auth_user request '0x8c20458'. 2011/01/07 10:10:43.775| AuthNegotiateUserRequest::authenticated: user not fully authenticated. 2011/01/07 10:10:43.775| AuthNegotiateUserRequest::authenticate: auth state negotiate none. Received blob: 'Negotiate YIIGJgYGKwYBBQUCoIIGGjCCBha [snip] 2011/01/07 10:10:43.775| AuthUserRequest::lock: auth_user request '0x8c20458 0->1 2011/01/07 10:10:43.775| authenticateValidateUser: Validating Auth_user request '0x8c20458'. 2011/01/07 10:10:43.775| authenticateValidateUser: Validated Auth_user request '0x8c20458'. 2011/01/07 10:10:43.775| AuthNegotiateUserRequest::authenticated: user not fully authenticated. 2011/01/07 10:10:43.775| AuthUserRequest::lock: auth_user request '0x8c20458 1->2 2011/01/07 10:10:43.776| authenticateValidateUser: Validating Auth_user request '0x8c20458'. 2011/01/07 10:10:43.776| authenticateValidateUser: Validated Auth_user request '0x8c20458'. 2011/01/07 10:10:43.776| authenticateStart: auth_user_request '0x8c20458' 2011/01/07 10:10:43.776| AuthNegotiateUserRequest::module_start: auth state is '1' 2011/01/07 10:10:43.776| AuthUserRequest::lock: auth_user request '0x8c20458 2->3 2011/01/07 10:10:43| squid_kerb_auth: DEBUG: Got 'YR YIIGJgYGKwYBBQU [snip] bkIUQRH' from squid (length: 2107). 2011/01/07 10:10:43| squid_kerb_auth: DEBUG: Decode 'YIIGJgYGKwYBBQUCoIIGGjCCBhagJDAiB [snip] 2011/01/07 10:10:43| squid_kerb_auth: ERROR: gss_acquire_cred() failed: Unspecified GSS failure. Minor code may provide more information. Key table entry not found 2011/01/07 10:10:43.778| authenticateNegotiateHandleReply: helper: '0x8a0e868' sent us 'BH gss_acquire_cred() failed: Unspecified GSS failure. Minor code may provide more information. Key table entry not found' 2011/01/07 10:10:43.778| negotiate/auth_negotiate.cc(602) releaseAuthServer: releasing Negotiate auth server '0x8a0e868' 2011/01/07 10:10:43.778| authenticateNegotiateHandleReply: Error validating user via Negotiate. Error returned 'BH gss_acquire_cred() failed: Unspecified GSS failure. Minor code may provide more information. Key table entry not found' 2011/01/07 10:10:43.778| authenticateValidateUser: Validating Auth_user request '0x8c20458'. 2011/01/07 10:10:43.778| authenticateValidateUser: Validated Auth_user request '0x8c20458'. 2011/01/07 10:10:43.778| authenticateValidateUser: Validating Auth_user request '0x8c20458'. 2011/01/07 10:10:43.778| authenticateValidateUser: Validated Auth_user request '0x8c20458'. 2011/01/07 10:10:43.778| AuthNegotiateUserRequest::authenticated: user not fully authenticated. 2011/01/07 10:10:43.778| authenticateAuthenticate: header Negotiate YIIGJgYGKwYBBQUCoI IGGjCCBhagJDAiBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKKwYBBAGCNwICCqKCBewEggXoYIIF5AYJKoZIhvcS A [snip] 2011/01/07 10:10:43.778| authenticateValidateUser: Validating Auth_user request '0x8c2 0458'. 2011/01/07 10:10:43.778| authenticateValidateUser: Validated Auth_user request '0x8c20 458'. 2011/01/07 10:10:43.778| AuthNegotiateUserRequest::authenticated: user not fully authe nticated. 2011/01/07 10:10:43.778| AuthNegotiateUserRequest::authenticate: auth state negotiate failed. Negotiate YIIGJgYGKwYBBQUCoIIGGjCCBhagJDAiBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKKwYB [snip] 2011/01/07 10:10:43.778| authenticateValidateUser: Validating Auth_user request '0x8c20458'. 2011/01/07 10:10:43.778| authenticateValidateUser: Validated Auth_user request '0x8c20458'. 2011/01/07 10:10:43.778| AuthNegotiateUserRequest::authenticated: user not fully authenticated. 2011/01/07 10:10:43.778| AuthUserRequest::unlock: auth_user request '0x8c20458 3->2 2011/01/07 10:10:43.778| AuthUserRequest::lock: auth_user request '0x8c20458 2->3 2011/01/07 10:10:43.779| AuthUserRequest::unlock: auth_user request '0x8c20458 3->2 2011/01/07 10:10:43.779| authenticateFixHeader: headertype:37 authuser:0 2011/01/07 10:10:43.779| AuthNegotiateConfig::fixHeader: Sending type:37 header: 'Negotiate' 2011/01/07 10:10:43.779| AuthUserRequest::unlock: auth_user request '0x8c20458 2->1 2011/01/07 10:10:43.779| AuthNegotiateUserRequest::onConnectionClose: closing connection '0x8c16f38' (this is '0x8c20458') 2011/01/07 10:10:43.779| negotiate/auth_negotiate.cc(606) releaseAuthServer: No Negotiate auth server to release. 2011/01/07 10:10:43.779| AuthNegotiateUserRequest::onConnectionClose: Unlocking auth_user from the connection '0x8c16f38'. 2011/01/07 10:10:43.779| AuthUserRequest::unlock: auth_user request '0x8c20458 1->0 2011/01/07 10:10:43.779| AuthUserRequest::unlock: deleting auth_user_request '0x8c20458'. 2011/01/07 10:10:43.779| AuthUserRequest::~AuthUserRequest: freeing request 0x8c20458 -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAk1GD6QACgkQuu7Rv+oOo/giwgCgiP8H2So6bjNcbGhAAG6BbaAj OFMAn3lcytIvvyUMr9aFKoFiph5ld9fL =dvCQ -----END PGP SIGNATURE-----
