Hello people, in general terms my proxy works quite well. However I tell you
that very eventually, (maybe about 10 times per day based on 15 users using
my test proxy) I get this error in cache.log:
negotiate_kerberos_auth.cc(180): pid=21573 :2018/09/28 14:42:25|
negotiate_kerberos_auth: ERROR: gss_accept_sec_context() failed: Unspecified
GSS failure. Minor code may provide more information. Request is a replay
2018/09/28 14:42:25 kid1| ERROR: Negotiate Authentication validating user.
Result: {result=BH, notes={message: gss_accept_sec_context() failed:
Unspecified GSS failure. Minor code may provide more information. Request
is a replay; }}
negotiate_kerberos_auth.cc(180): pid=21573 :2018/09/28 14:42:26|
negotiate_kerberos_auth: ERROR: gss_accept_sec_context() failed: Unspecified
GSS failure. Minor code may provide more information. Request is a replay
2018/09/28 14:42:26 kid1| ERROR: Negotiate Authentication validating user.
Result: {result=BH, notes={message: gss_accept_sec_context() failed:
Unspecified GSS failure. Minor code may provide more information. Request
is a replay; }}
I've browse several hours without finding out what causes this error, or if
it's serious, or if I should ignore it.
Could someone with more experience tell me if it's possible what could be
the reason for this error?
My testing environment:
- A VM CentOS 7 Core over VirtualBox 5.2, 1 NIC.
- My VM is attached to my domain W2012R2 (following this post
https://www.rootusers.com/how-to-join-centos-linux-to-an-active-directory-domain/)
to achieve kerberos authentication transparent to the user. SElinux
disabled. Owner permissions to user squid in all folders/files involved.
- squid 3.5.20 installed and working great with Negotiate/NTLM and
Negotiate/Kerberos authentication
squid.conf
### Negotiate/NTLM and Negotiate/Kerberos authentication
auth_param negotiate program /usr/sbin/negotiate_wrapper --ntlm
/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp --kerberos
/usr/lib64/squid/negotiate_kerberos_auth -r -d -s GSS_C_NO_NAME
auth_param negotiate children 200
auth_param negotiate keep_alive on
Thank you very much indeed.
Cordial greetings
Gabriel
--
Sent from: http://squid-web-proxy-cache.1019090.n4.nabble.com/Squid-Users-f1019091.html
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
