Search squid archive

Re: Re: squid_kerb_ldap issues

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Markus,
Thanks for your input. I ended up completely removing everything and
recreating my key tab and it works great now.

One more question for you or the list: Is it possible to do machine based
AD auth to squid?
We have a use case here where we would want to allow a machine access to a
resource but not necessarily specifically allow the users who are logged
in to it.
Thanks again,
-Scott

Scott Finlon, CISSP GCIA GCIH
-----------------------------------
Information Security Engineer
The University of Scranton
email : scott.finlon@xxxxxxxxxxxx
phone : 570-941-6168
-----------------------------------






On 8/21/14, 3:20 PM, "Markus Moeller" <huaraz@xxxxxxxxxxxxxxxx> wrote:

>Hi Scott,
>
>   So from what see in your first log you have a user MYSUER with a
>domain/realm MYDOMAIN, but squid belongs to SUBDOMAIN.DOMAIN.COM.
>squid_kerb_ldap tries to authenticate to  the domain MYDOMAIN  using the
>keytab but does not find any entry for MYDOMAIN in the keytab.   Then
>squid_kerb_ldap tries to find an entry in the keytab of a domain which
>trusts MYDOMAIN and fails.  It seems there is no Kerberos trust between
>MYDOMAIN and SUBDOMAIN.DOMAIN.COM.
>
>  The second log looks better, but the password stored in the keytab for
>SQUIDPROXY-K$ is incorrect (Preauthentication failed).
>
>
>Markus
>
>"Scott Finlon"  wrote in message
>news:D01B8481.36D86%scott.finlon@xxxxxxxxxxxx...
>
>Hi All,
>
>
>I have squid_kerb_auth working and authenticating via my key tab file.
>However, when trying to lock it down to users that are in a group in AD,
>I¹m seeing a weird issue.
>I put my sanitized output here: http://pastebin.com/wGc3RC0h
>But basically if I use this "./squid_kerb_ldap -d -g proxy_allow -D
>MYDOMAIN² it is able to auth to AD and eventually attempts to use a bind
>path of dc=MYDOMAIN instead of dc=MYDOMAIN,dc=DOMAIN,dc=COM, and then it
>gives a referral error.
>
>So seeing that, I tried to use my full domain as the default domain, like
>this "./squid_kerb_ldap -d -g proxy_allow -D MYDOMAIN.MYDOMAIN.COM² it
>gives a Preauthentication failed error and doesn¹t even make it in to AD,
>full output here: http://pastebin.com/Gk1ci0nt
>
>That makes me think it¹s an issue with the key tab file, but it works
>appropriately with kerb auth just not kerb ldap. Any ideas?
>I am going to try and make a key tab file with ktpass instead of msktutil
>and see if that has any affect.
>Thanks,
>-Scott
>
>
>
>
>






[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux