jinnantonnixx Posted May 21, 2014 Posted May 21, 2014 (edited) Progress! Of sorts, anyway. I would definitely delete the AD computer account, and tomorrow re-run the msktutil with the additional parameters I mentioned. Don't forget to delete the keytab files rm /etc/squid/HTTP.keytab rm /etc/krb5.keytab then run 'kinit Administrator' before attempting the msktutil. Then set the keytab permissions chmod 660 /etc/squid/HTTP.keytab chown squid:squid /etc/squid/HTTP.keytab List the Kerberos tickets with the command klist -ekt If you get a failure after the inital msktutil, don't despair - try this a few times msktutil --auto-update --verbose If that fails, then despair. If it still doesn't work, change your squid.conf so that the NTLM auth directive appears above the Kerberos directive (or even comment the Kerberos line out with a '#'). NTLM isn't a pretty authenticator, but if it works it will buy you time. Edited May 21, 2014 by jinnantonnixx
JonThompson Posted May 22, 2014 Author Posted May 22, 2014 Progress! Of sorts, anyway. I would definitely delete the AD computer account, and tomorrow re-run the msktutil with the additional parameters I mentioned. Don't forget to delete the keytab files rm /etc/squid/HTTP.keytab rm /etc/krb5.keytab then run 'kinit Administrator' before attempting the msktutil. Then set the keytab permissions chmod 660 /etc/squid/HTTP.keytab chown squid:squid /etc/squid/HTTP.keytab List the Kerberos tickets with the command klist -ekt If you get a failure after the inital msktutil, don't despair - try this a few times msktutil --auto-update --verbose If that fails, then despair. If it still doesn't work, change your squid.conf so that the NTLM auth directive appears above the Kerberos directive (or even comment the Kerberos line out with a '#'). NTLM isn't a pretty authenticator, but if it works it will buy you time. I deleted the account from AD this morning, and I have rejoined it using msktutil. I've ran the update command but it's still prompting for authentication in IE and working in Firefox. I tried your suggestion about the squid config and FF prompted me for my AD username and password and worked. IE on the other hand just gave me an access denied page. I've ran the klist -ekt command and it's returned a list of tokens for the server.
jinnantonnixx Posted May 22, 2014 Posted May 22, 2014 (edited) Install kerbtray (it's in one of the Windows resource kits - PITA to find) and stick it on one of the client windows machines. It'll appear in the system tray (bottom right), use it to view the Kerberos tickets on the machine. Then use it to delete all Kerberos tickets Close the browser and reopen it, and see if you get any fresh tickets from the Squid server. Foudn a link http://www.computerperformance.co.uk/Litmus/tools_ezine.htm#Kerbtray Edited May 22, 2014 by jinnantonnixx
JonThompson Posted May 22, 2014 Author Posted May 22, 2014 Install kerbtray (it's in one of the Windows resource kits - PITA to find) and stick it on one of the client windows machines. It'll appear in the system tray (bottom right), use it to view the Kerberos tickets on the machine. Then use it to delete all Kerberos tickets Close the browser and reopen it, and see if you get any fresh tickets from the Squid server. Foudn a link Ezine Tools - Guy Windows toolkit of handy utilities I've ran it on my machine. When I purge tickets, then close and reopen IE I get asked for credentials which it refuses. After awhile it stops asking and I get access denied from squid. The kerbtray app lists 0 tickets, and says No Network credentials. However when I run klist in cmd it lists two tickets, one from krbtgt for the domain?, and one from the squid server (AES-256)
JonThompson Posted May 23, 2014 Author Posted May 23, 2014 It's defiantly the Kerberos that's causing the issue. I commented it out this morning and it allowed traffic through IE without authentication. The only problem is that it doesn't like https traffic? Any ideas on how to get around this?
jinnantonnixx Posted May 23, 2014 Posted May 23, 2014 (edited) Did you delete the kerberos tickets on the Debian server before starting over with msktutil? rm /etc/squid/HTTP.keytab rm /etc/krb5.keytab This is important at the new tickets might be appended to the file and missed. Then Delete the kerberos account for the computer. Wait for replication Then kinit Administrator Then the msktutil...... with the --dont-expire-password --enctypes 28 parameters. Wait for replication (wait for the computer account to appear on all controllers) Set permissions on the file /etc/squid/HTTP.keytab with the commands: chmod 660 /etc/squid/HTTP.keytab chown squid:squid /etc/squid/HTTP.keytab Reboot the Debian server Edited May 23, 2014 by jinnantonnixx
JonThompson Posted May 23, 2014 Author Posted May 23, 2014 (edited) Did you delete the kerberos tickets on the Debian server before starting over with msktutil? rm /etc/squid/HTTP.keytab rm /etc/krb5.keytab This is important at the new tickets might be appended to the file and missed. Then Delete the kerberos account for the computer. Wait for replication Then kinit Administrator Then the msktutil...... with the --dont-expire-password --enctypes 28 parameters. Wait for replication (wait for the computer account to appear on all controllers) Set permissions on the file /etc/squid/HTTP.keytab with the commands: chmod 660 /etc/squid/HTTP.keytab chown squid:squid /etc/squid/HTTP.keytab Reboot the Debian server I cant find a krb5.keytab file. I've even done a locate. Do you think this could be the problem? I do have a krb5.conf file Edited May 23, 2014 by JonThompson
jinnantonnixx Posted May 23, 2014 Posted May 23, 2014 (edited) Could be. Don't rely on 'locate' - it reads a database which it normally updates once a day. Locate is handy for finding static files, but it isn't dynamic. Use 'find' instead. Normally, the krb5.keytab file is created when you run mstkutil and all you have to worry about is setting the permissions. You can make it manually, but what you've done already should work. You ARE running msktutli under sudo aren’t you? Look for it in /etc/. Is it there? Edited May 23, 2014 by jinnantonnixx
jinnantonnixx Posted May 23, 2014 Posted May 23, 2014 (edited) This looks useful - see if it helps Creating Kerberos Keytab Files Compatible with Active Directory ~ ITAdminTools.com The default location is /etc/krb5.keytab Edited May 23, 2014 by jinnantonnixx
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now