Squid Proxy, Debian and NTLM - Need Help

[JonThompson]

Help!

 

We have a squid3 proxy server running in a Hyper-V Debian machine. We set the server up in March and following a guide on the internet we got it to authenticate using your AD credentials and work using security groups (Internet Allowed, Internet Not Allowed etc.)

 

The server has been up and running for the last month without any problems. On Friday my colleague installed the latest batch of security updates on the windows server and on the Debian machine.

 

When we came back on Monday, every time a user opens a browser window (IE, FF Chrome) squid prompted for user credentials - no matter which way you entered your AD credentials it refused them.

 

After tinkering with it today, I have restored it to a 'working' snapshot; I have turned off the Firewall through Webmin and I have re-joined it to the domain.

Now, whilst the server initially refused all requests from all browsers, it now seems that it’s working through Firefox (I can browse the web and posted this!), but still prompts for authentication in Chrome and IE.

 

Has anybody else had this issue before? Anybody have any ideas what could be causing this to stop working overnight?

 

Thanks.

[jinnantonnixx]

Try

wbinfo -u

from the terminal.

THis should list AD users

If you get a problem, check your squid logs (in /var/log/squid) - look for Unspecified GSS failure - classic sign of Winbind going wrong.

 

Probably a Samba problem - I've seen this a few times.

 

First, simple thing to check - permissions OK?

 

chmod 750 /var/lib/samba/winbindd_privileged

chmod 600 /etc/squid/HTTP.keytab

chown squid:squid /etc/squid/HTTP.keytab

 

 

If all these pass muster, check your NTLM authenticator with this command (note, you might have a different auth program - check your squid.conf)

/usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic

Type in the following - replacing DOMAIN, username, and PASSWORD with the relevant details:

DOMAIN+username PASSWORD

(hit return)

 

It should either come back with an OK or ERR message, along with some other diagnostic info?

Edited May 20, 2014 by jinnantonnixx

[JonThompson]

Thanks for the quick reply.

 

I ran wbinfo -u and it returned a load of users from AD.

 

I ran chmod 750 /var/lib/samba/winbindd_privileged and it couldn't find it?

 

I ran chmod 600 /etc/squid/HTTP.keytab (It's called PROXY.keytab on our system) this worked.

 

I ran chown squid:squid /etc/squid/HTTP.keytab as root:root as we haven't got a squid user and this worked.

 

I ran /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic DOMAIN+username PASSWORD replacing the relevant sections, and pressed enter. The command is still running as I type and hasn't returned anything to the console as yet, but I'm guessing that this should return something eventually?

[jinnantonnixx]

I often had weird problems like this after Squid upgrades.

 

Try this first:

Assign privileges to the WinBind socket with the command:

chmod 750 /var/lib/samba/winbindd_privileged

 

 

 

Check the trust secret between the computer and AD

wbinfo -t

 

This should be OK as you're seeing AD users, but check nevertheless.

 

 

You should see OK or ERR from the ntlm_auth program (immediately). Something wrong there. Look at your squid.conf file (in /etc/squid) and find the line that mentions ntlm_auth - make sure the path is OK.

Perhaps your winbind separator isn't '+'. Try it with a '\'

so you'd type DOMAIN\\ <- Note you must use two backslashes

 

 

 

Add the following line to the ‘Global Settings’ section of the file /etc/samba/smb.conf

winbind refresh tickets = yes

Edited May 21, 2014 by jinnantonnixx

[cpjitservices]

you may also need to issue: ntpdate *dcservername or IP* to make sure the clocks are synced. also have a look at the command *klist* see if you kerberos sessions has timed out. If it has use *kinit* and then Administrative account to create a new ticket. Also, you should be able to see your Debian machine in AD.

 

you can also use *getent group* to make sure the groups of users in AD have been synced. If all above is correct then it should just work.

Edited May 21, 2014 by cpjitservices

[jinnantonnixx]

Good point about the clocks being in sync. Well worth checking and using an NTP service (even internally)

 

I presume he's just using NTLM rather than Kerberos (though it's perfectly normal to have both running concurrently, the preference determined by their order in squid.conf) so I suspect the klist and kinit are out of the picture. But that's an assumption.....

Edited May 21, 2014 by jinnantonnixx

[cpjitservices]

Good point about the clocks being in sync.

 

I presume he's just using NTLM rather than Kerberos (though it's perfectly normal to have both running concurrently, the preference determined by their order in squid.conf) so I suspect the klist and kinit are out of the picture. But that's an assumption.....

 

I've got a samba server here which authenticates via AD, if one of the servers gets rebooted either the DC or the CentOS server for updates I have to issue the ntpdate command otherwise users got the login box.

 

example : ntpdate dcserver.domain.local

 

if you get an error when running that command, stop the ntp service and run it again.

Edited May 21, 2014 by cpjitservices

[jinnantonnixx]

I've got a samba server here which authenticates via AD, if one of the servers gets rebooted either the DC or the CentOS server for updates I have to issue the ntpdate command otherwise users got the login box.

 

example : ntpdate dcserver.domain.local

 

Possibly out on a limb, but I think you can get around that with the 'tinker panic 0' directive in ntp.conf (which allows for massive drift correction).

[JonThompson]

I often had weird problems like this after Squid upgrades.

 

Try this first:

Assign privileges to the WinBind socket with the command:

chmod 750 /var/lib/samba/winbindd_privileged

 

Check the trust secret between the computer and AD

wbinfo -t

 

This should be OK as you're seeing AD users, but check nevertheless.

 

You should see OK or ERR from the ntlm_auth program (immediately). Something wrong there. Look at your squid.conf file (in /etc/squid) and find the line that mentions ntlm_auth - make sure the path is OK.

Perhaps your winbind separator isn't '+'. Try it with a '\'

so you'd type DOMAIN\\ <- Note you must use two backslashes

 

Add the following line to the ‘Global Settings’ section of the file /etc/samba/smb.conf

winbind refresh tickets = yes

 

I've tried chmod 750 /var/lib/samba/winbindd_privileged but it says 'No such file or directory..'

 

wbinfo -t returns that the trust secret for our domain via RPC calls succeeded.

 

I've checked the path to our ntlm_auth and I've also tried it with \\ and it still hangs there doing nothing. Our ntlm_auth has -ntlmssp instead of basic.

 

I've added that line to our samba conf file.

 

Our Squid Config runs kerberos and ntlm then pure ntlm then basic authentication. We haven't got a time server installed on the server. If it helps Im sure that this was the guide that we used Active Directory Integrated Squid Proxy - Bit Binary Wiki

 

If it helps I can post our Squid Config file?

[jinnantonnixx]

Ah that's an entirely different kettle of fish. You're running Kerberos, and as it's first in the list you'll hit any Kerberos errors first.

 

Elementary check is that of 'kinit Administrator' and 'klist' as mentioned by @cpjitservices

 

Quite often 'authconfig --update' will fix things.

 

A common error is that of using the same computer account to create your Samba connection and Kerberos connection. You should use two different computer accounts. Also, you can specify that the computer account does not expire. (--dont-expire-password parameter of msktutil)

 

I'd recommend you look at this article as it covers most of the detail you need to know.

http://blog.stefan-macke.com/2011/04/19/single-sign-on-with-kerberos-using-debian-and-windows-server-2008-r2/

Edited May 21, 2014 by jinnantonnixx

[JonThompson]

Ah that's an entirely different kettle of fish. You're running Kerberos, and as it's first in the list you'll hit any Kerberos errors first.

 

Elementary check is that of 'kinit' and 'klist' as mentioned by @cpjitservices

 

I've ran kinit and used my username and password. When I then run klist it returns a ticket. Our error log states squid_kerb_auth: ERROR: gss_accept_sec_context() failed: Unspecified GSS failure. Minor code may provide more information.

 

Then it's negotiate_wrapper: Return 'BH gss_accept_sec_context() failed: Unspecified GSS failure. Minor code may provide more information.

[jinnantonnixx]

I would delete the Kerberos account for the Debian server from AD and recreate it.

 

How did you create the Kerberos account? msktutil?

 

Scratch that - look at the article in my above post and see if that helps.

Edited May 21, 2014 by jinnantonnixx

[JonThompson]

I would delete the Kerberos account for the Debian server from AD and recreate it.

 

How did you create the Kerberos account? msktutil?

 

Scratch that - look at the article in my above post and see if that helps.

 

I used the following command to add it into AD - msktutil --auto-update --verbose --computer-name squidproxy-k

 

The problem is it doesn't seem to work anymore!

[jinnantonnixx]

What, msktutil doesn't work? Any error message?

 

I would add the following parameters to the msktutil command.

 

--dont-expire-password --enctypes 28

 

Delete the account squidproxy-k from AD. Give it time to percolate through if you have multiple DCs. <<< Important!!! Then try the msktutil again.

Edited May 21, 2014 by jinnantonnixx

[JonThompson]

What, msktutil doesn't work? Any error message?

 

I would add the following parameters to the msktutil command.

 

--dont-expire-password --enctypes 28

 

When I run msktutil --auto-update --verbose --computer-name squidproxy-k it complains that

 

Delete the account squidproxy-k from AD. Give it time to percolate through if you have multiple DCs. <<< Important!!! Then try the msktutil again.

 

When I run msktutil --auto-update --verbose --computer-name squidproxy-k it complains that mskutil command not found yet it previously worked?

 

Thanks for your help so far.

[jinnantonnixx]

Odd!

 

locate msktutil

 

or

 

find / -name msktutil

[JonThompson]

Odd!

 

locate msktutil

 

or

 

find / -name msktutil

 

locate msktutil returns /var/cache/apt/archives/msktutil_0.4-2_amd64.deb

[jinnantonnixx]

That's it? Well your msktutil has vamoosed. Very strange.

 

the 'locate' command uses a database that might be a day old, so try the find command, but try it as a superuser (with su or sudo, I can't remember which Debian uses) just in case the permissions are bananas on msktutil.

 

As a last resort you could run dpkg to install that .deb file and hope that it re-installs it.

Edited May 21, 2014 by jinnantonnixx

[JonThompson]

That's it? Well your msktutil has vamoosed. Very strange.

 

the 'locate' command uses a database that might be a day old, so try the find command, but try it as a superuser (with su or sudo, I can't remember which Debian uses) just in case the permissions are bananas on msktutil.

 

As a last resort you could run dpkg to install that .deb file and hope that it re-installs it.

 

I've ran the find with sudo command it doesn't return anything. Just returns to the command line. When I try and reinstall it from the website in the guide I sued it fails as the cert on the website has failed.

[jinnantonnixx]

Well, the deb file is there (hopefully) so that's worth a shot.

 

sudo (or su) dpkg -i /var/cache/apt/archives/msktutil_0.4-2_amd64.deb

 

http://www.cyberciti.biz/howto/question/linux/dpkg-cheat-sheet.php

 

 

I bet you wished you left it alone now.

Edited May 21, 2014 by jinnantonnixx

[JonThompson]

Well, the deb file is there so that's worth a shot.

 

sudo (or su) dpkg -i /var/cache/apt/archives/msktutil_0.4-2_amd64.deb

 

dpkg cheat sheet

 

 

I bet you wished you left it alone now.

 

Yep! *bangs head on desk*

 

I ran the command and it said complains about a dependency problem - msktutil depends on libkrb53 as it's not installed, when it was. When I run sudo apt-get install krb5-user libkrb53 says it's not available, but is referred to by another package which may be missing or has been obsoleted.

[jinnantonnixx]

Sound like you're having a typical 'my sortta day',

 

Well, you'll need msktutil either way.

 

Try this

 

sudo apt-get update

sudo apt-get install msktutil

 

If it's not in the repository, see if this works: msktutil_0.5.1-1_amd64.deb Debian Jessie Download and see if you can install it with dpkg.

 

Failing that, you'll have to build it. That's not as bad as it sounds, I did it when I needed it (I used Centos, but the principle is the same). If memory serves you'll need to install 'build essentials' or something similar, but let's burn that bridge when we come to it

Edited May 21, 2014 by jinnantonnixx

[JonThompson]

Sound like you're having a typical 'my sortta day',

 

Well, you'll need msktutil either way.

 

Try this

 

sudo apt-get update

sudo apt-get install msktutil

 

If it's not in the repository, see if this works: msktutil_0.5.1-1_amd64.deb Debian Jessie Download and see if you can install it with dpkg.

 

Failing that, you'll have to build it. That's not as bad as it sounds, I did it when I needed it (I used Centos, but the principle is the same). If memory serves you'll need to install 'build essentials' or something similar, but let's burn that bridge when we come to it

 

Tried that and after being told to run sudo apt-get install -f to fix errors, I loaded the Package Installer and pointed it at the downloaded deb file and it's come back with an error: dependency is not satisfiable: libc6 (>=2.14)

[jinnantonnixx]

Have you run update and upgrade on your server to get all components up to date?

 

sudo apt-get update

sudo apt-get upgrade

[JonThompson]

Have you run update and upgrade on your server to get all components up to date?

 

sudo apt-get update

sudo apt-get upgrade

 

Yep, it's just upgraded some more packages and it's still complaining and wont let me install it.

 

I've just ran msktutil --auto-update --verbose --computer-name squidproxy-k and it actually ran without errors. I've just deleted the account from AD, let it synch and re ran it to get it back into AD. I've just tried browsing IE and it still prompts for authentication. I'll try the other commands again tomorrow and see what happens.