On 10/11/2022 4:50 am, Bertrand Friconneau wrote:
Hi Everyone,
I've got Squid 4.10 on Ubuntu 20.10 LTS
I try to upgrade my server to Ubuntu 22.04 LTS
But the users couldn't get internet no more.
Here is the log in /var/log/squid/access.log :
1668004454.050 0 172.22.200.1 TCP_DENIED/407 3951 CONNECT
drive.google.com:443 - HIER_NONE/- text/html
1668004454.052 0 172.22.200.1 TCP_DENIED/407 3951 CONNECT
drive.google.com:443 - HIER_NONE/- text/html
1668004454.057 0 172.22.200.1 TCP_DENIED/407 3951 CONNECT
drive.google.com:443 - HIER_NONE/- text/html
1668004454.063 1 172.22.200.1 TCP_DENIED/407 4454 CONNECT
drive.google.com:443 - HIER_NONE/- text/html
1668004454.076 10 172.22.200.1 NONE_NONE/500 0 CONNECT
drive.google.com:443 infoe HIER_NONE/- -
And on the client :
ERR_TUNNEL_CONNECTION_FAILED
According to this page :
https://wiki.squid-cache.org/ConfigExamples/Authenticate/Ntlm
The cause is due to challenge-response process of NTLM
How can I solve it ?
Regards
Bertrand Friconneau
-------------------------------------------------------------------------------------------------------------------------------------------------------
Here is my config file of squid :
dns_v4_first on
visible_hostname squid
Please use an actual FQDN hostname. This is the proxies "visible"
hostname - eg sent as the domain name for URLs in error pages etc.
error_directory /usr/share/squid/errors/French
These days it would be better to use:
error_default_language fr
or at least
error_directory /usr/share/squid-langpack/fr
auth_param ntlm program /usr/bin/ntlm_auth
--helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 250
auth_param ntlm keep_alive off
...
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
or maybe limit manager access to administrationzone
http_access deny manager
custom access policy rules should be down here:
http_access allow sitebypass
http_access deny tor
http_access deny url_exe
http_access allow administrationzone
#http_access allow pedagozone
#http_access allow xibozone
All these below are of the same ACL type and all "allow" actions.
Therefore you can combine them into one ACL definition.
http_access allow informatiquezone
http_access allow secuzone
http_access allow srvzone
http_access allow ntlm
What about invalid logins, missing logins etc?
We highly recommend that the line triggering auth is a "deny" policy to
reject all those.
http_access deny !ntlm
... then you allow what can be done by logged in accounts.
http_access allow localnet
or
http_access allow all
You may see a behaviour difference with this change to how Squid handles
the login.
After doing it, of the problem continues try to get some debug
information from the auth helper to see what it is getting from the
client and why that is not being accepted.
PS. Since you have Kerberos available, please consider moving away from
NTLM to using Negotiate/Kerberos auth. It has both better security and
far better performance for the proxy.
Amos
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
