Hi, everybody.
I have a SQUID 4.11 compiled on Debian 9.8
with kerberos integration authenticating and browsing without
problems:
The problem starts when I
try to configure a HAProxy 1.8 load balancer to which by redundancy I
configured a virtual IP with the keepalived service. When I point my browser
to the DNS A record (balancer.mydomain.local) which in turn points to the
keepalived virtual IP, the authentication stops working:
In the client browser a prompt appears requesting
authentication.
I find it strange that the IP registered by SQUID is
10.10.8.207, which is the physical IP of my VM, instead of the virtual IP
configured in HAProxy, which is the IP 10.10.8.213.
I send you all
the configurations that I have made to see if you can help me to find where
my configuration error is.
keepalived.conf
global_defs {
notification_email
{
some.user@mydomain.local
}
notification_email_from
balancer1@mydomain.local
smtp_server smtp.
mydomain.local
smtp_connect_timeout
60
}
vrrp_instance VI_1
{
state
MASTER
interface
eth0
virtual_router_id
101
priority
101
advert_int
1
authentication
{
auth_type
PASS
auth_pass
somepass123
}
virtual_ipaddress
{
10.10.8.213
}
}
haproxy.conf
squid.conf
# minimal configuration for testing
visible_hostname proxy1.mydomain.local
http_port
3128
debug_options ALL, 1 33, 2 28, 9
maximum_object_size 8192
KB
error_directory /opt/squid411/share/errors/es-ar
shutdown_lifetime
0 seconds
forwarded_for on
auth_param negotiate program
/usr/local/bin/squid_kerb_auth -i -r -s GSS_C_NO_NAME
auth_param
negotiate children 300 startup=150 idle=10
auth_param negotiate
keep_alive on
acl auth proxy_auth REQUIRED
http_access allow
auth
acl SSL_ports port 443
acl Safe_ports port 80
acl CONNECT
method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT
!SSL_ports
http_access deny all
squid -v
Squid Cache: Version 4.11
Service Name: squid
This binary
uses OpenSSL 1.0.2u 20 Dec 2019. For legal restrictions on
distribution see
https://www.openssl.org/source/license.htmlconfigure
options: '--prefix=/opt/squid411' '--includedir=/include'
'--mandir=/share/man' '--infodir=/share/info'
'--localstatedir=/opt/squid411/var' '--disable-maintainer-mode'
'--disable-dependency-tracking' '--disable-silent-rules' '--enable-inline'
'--enable-async-io' '--enable-storeio=ufs,aufs,diskd'
'--enable-removal-policies=lru,heap' '--enable-delay-pools'
'--enable-cache-digests' '--enable-underscores' '--enable-icap-client'
'--enable-follow-x-forwarded-for' '--enable-auth'
'--enable-digest-auth-helpers' '--enable-negotiate-auth-helpers'
'--enable-auth-ntlm' '--enable-arp-acl' '--enable-esi--disable-translation'
'--with-logdir=/var/log/squid411' '--with-pidfile=/var/run/squid411.pid'
'--with-filedescriptors=65536' '--with-large-files'
'--with-default-user=proxy' '--enable-linux-netfilter'
'--enable-ltdl-convenience' '--with-openssl' '--enable-ssl'
'--enable-ssl-crtd'
env
KRB5_KTNAME=/opt/squid411/etc/PROXY.keytab
KRB5RCACHETYPE=none
/etc/krb5.conf
[libdefaults]
default_realm =
MYDOMAIN.LOCAL
dns_lookup_kdc =
yes
dns_lookup_realm = yes
ticket_lifetime = 24h
default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc
des-cbc-md5
default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc
des-cbc-md5
permitted_enctypes
= aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc
des-cbc-md5
[realms]
MYDOMAIN.LOCAL =
{
kdc =
s-dc00.mydomain.local
kdc =
s-dc01.mydomain.local
kdc =
s-dc02.mydomain.local
admin_server = s-dc00.mydomain.local
}
[domain_realm]
.mydomain.local =
MYDOMAIN.LOCAL
mydomain.local =
MYDOMAIN.LOCAL
msktutil -c -b "OU=SERVIDORES" -s HTTP/debian-proxy.mydomain.local -k
/opt/squid411/etc/PROXY.keytab --computer-name DEBIAN-PROXY --upn
HTTP/debian-proxy.mydomain.local --server s-dc00.mydomain.local --verbose
--enctypes 28
# permissions for kaytab file
chgrp proxy /opt/squid411/etc/PROXY.keytab
chmod g+r
/opt/squid411/etc/PROXY.keytab
klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal:
some.user@MYDOMAIN.LOCAL
Valid
starting
Expires
Service principal
07/23/2020 11:59:45 07/23/2020 21:59:45
krbtgt/MYDOMAIN.LOCAL@MYDOMAIN.LOCAL
renew until 07/24/2020 11:59:40
One thing I didn't quite understand is the procedure to authenticate
from HAProxy. According to the documentation I read, I did the
following:
I created a DNS A record and its PTR in my DNS server pointing to
the virtual IP of the keepalived (10.10.8.213) in the HAProxy.
Then I
created a "HTTP_inet" user account in Active Directory.
Then on my domain
controller, in a CMD with administrator permissions, I ran:
setspn -S
HTTP/inet.mydomain.local HTTP_inet
setspn -S HTTP/inet HTTP_inet
In
both cases the message was: object updated.
Then in my SQUID servers, I
executed:
kinit HTTP_inet@MYDOMAIN.LOCAL
It asks for the user's
password.
Start the ktutil tool
That's where I write:
addent
-password -p HTTP/inet.mydomain.local -k 2 -e rc4-hmac
Ask the user password
addent -password -p HTTP/inet -k 2 -e
rc4-hmac
Ask the user password
wkt
/opt/squid411/etc/PROXY.keytab
quit
list the keys in
keytab:
ktutil
read_kt /opt/squid411/etc/PROXY.keytab
1 1 DEBIAN-PROXY$@MYDOMAIN.LOCAL
2 1
DEBIAN-PROXY$@MYDOMAIN.LOCAL
3 1
DEBIAN-PROXY$@MYDOMAIN.LOCAL
4 1
HTTP/debian-proxy.mydomain.local@MYDOMAIN.LOCAL
5 1
HTTP/debian-proxy.mydomain.local@MYDOMAIN.LOCAL
6 1
HTTP/debian-proxy.mydomain.local@MYDOMAIN.LOCAL
7 1
host/DEBIAN-PROXY@MYDOMAIN.LOCAL
8 1
host/DEBIAN-PROXY@MYDOMAIN.LOCAL
9 1
host/DEBIAN-PROXY@MYDOMAIN.LOCAL
10 1
host/debian-proxy.mydomain.local@MYDOMAIN.LOCAL
11 1
host/debian-proxy.mydomain.local@MYDOMAIN.LOCAL
12 1
host/debian-proxy.mydomain.local@MYDOMAIN.LOCAL
13 2
HTTP/inet.mydomain.local@MYDOMAIN.LOCAL
14 2
HTTP/inet@MYDOMAIN.LOCAL
It's this last part I understand the least,
maybe the mistake is there. Or somewhere else.
I appreciate any help you
can offer me.
Best regards,
Gabriel
