Squid NTLM passthrough to parent ISA

[_Jo_]

I've tried for a few days now to get my squid configuration to work with a parent ISA server using NTLM. I've read through a lot of really good threads on edugeek and elsewhere to get it this far, but I just can't get the authentication to work.

 

Initial installation seemed to go ok. Samba, winbind appear to work.

 

However, when I request a page in a browser, I get 3 pop up boxes asking for user / password.

 

squid access.log shows:

1206709266.220 7  TCP_denied/407 2287 GET http://www.google.co.uk/ - NONE/- text/html

 

After 3 retries of putting in a user/password (and I was hoping it wouldn't prompt at all) I then get an error page from the parent proxy:

HTTP 407 Proxy Authentication Required - The ISA Server requires authorization to fulfill the request. Access to the Web Proxy service is denied. (12209)

 

-----------------------------------------------------------------

Internet Security and Acceleration Server

ISA Server: ISA.

Via: 1.0 UBFW.

:3128 (squid/2.6.STABLE14)

 

 

wbinfo -t

checking the trust secret via RPC calls succeeded

 

net ads status -U

Outputs a lot of information about the squid host from AD

 

my squid.conf contains

cache_peer servername parent 8080 0 default no-query login=PASS

auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 5
authenticate_ttl 180 seconds
auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
acl ntlm_users proxy_auth REQUIRED
http_access allow ntlm_users

 

 

IF I change the parent proxy address to that of another Linux box I have here running NTLMAPS, the request goes through and I can browse.

So I must be getting something really wrong with my squid.conf as far as the authentication side goes.

 

I've tried specifying a user/password on the cache_peer line and that didn't work either. I still got prompted at the client, and it still failed.

 

Any help appreciated, getting a bit fed up!

 

Jo

 

Ubuntu server 7.10

Squid v2.6.STABLE14

NTLM_AUTH Version 3.0.26a

[Geoff]

Squid cannot be used as a NTLM auth client to another proxy. You must configure another authentication method that squid supports on your parent ISA proxy (eg, basic). Alternatively add an IP rule so that squid does not need to authenticate.

[Guest monkeyx]

Does this answer your question ?

 

use 'login=PASS' if users must authenticate against

the upstream proxy. This will pass the users credentials

as they are to the peer proxy. This only works for the

Basic HTTP authentication sheme. Note: To combine this

with proxy_auth both proxies must share the same user

database as HTTP only allows for one proxy login.

Also be warned this will expose your users proxy

password to the peer. USE WITH CAUTION

 

 

Could you explain a little more about what you are trying to do.

 

I currently have squid/dansgauradian logging ntml usernames for all staff/students so that we can apply local policies and track usernames.

 

We then forward all requests to the LEA ISA server, which does not track credentialls only IP addresses. So we do not need the PASS option.

[el8linuxel8]

Check out ntlmaps, probably not really practical but you could mod it, pretty simple python.

[_Jo_]

...This only works for the

Basic HTTP authentication sheme.

 

Oops. I remember reading that bit now. Back to square 1.

Thanks for pointing that out.

 

Could you explain a little more about what you are trying to do.

 

I wanted to put all pupil requests through DansGuardian before they went on to the LEA ISA proxy server, which requires authentication. They also log all access and put requests through websense.

 

I could put them all through NTLMAPS, but as far as I know, all access would then be recorded at the LEA under the same username. (This is the only way I've configured it before.)

 

@Geoff:

"Alternatively add an IP rule so that squid does not need to authenticate."

Is this simple? Would DG still work with this configuration?

I thought squid would have to authenticate with the ISA.

 

Jo

[_Jo_]

The ISA doesn't appear to support basic authentication. So I've tried putting NTLMAPS on the server and running all internet access through that so:

 

Client -> dansguardian -> squid -> ntlmaps -> ISA

 

While this works, I'm not sure if it will work quickly enough for 250 users at the same time.

 

The clients still get prompted for authentication by squid when the open a new browser. Is there any way to avoid this and still record the usernames?

[Geoff]

There is something wrong with NTLM auth in your dansguardian/Squid configuration. It should be transparent. Do you have a new enough version of dansguardian to support ntlm pass through?

[_Jo_]

Hi Geoff, It's running Dansguardian 2.8.0.6

[DMcCoy]

Hi Geoff, It's running Dansguardian 2.8.0.6

 

You need 2.9 for the ntlm passthrough, 2.8 needs squid (ntlm) -> dansguardian -> squid

[_Jo_]

You need 2.9 for the ntlm passthrough, 2.8 needs squid (ntlm) -> dansguardian -> squid

 

2 Instances of squid? That sounds complicated. I'm having trouble configuring one instance properly at the moment! (I'll get the hang of it eventually)

 

I'll give 2.9 a try.

(the webmin report viewer said it didn't work with that version. Typical.)

 

Is there any way I can get squid to talk to the ISA directly? ISA is set not to allow basic auth. I don't really want to use NTLMAPS as we could have 250 people connecting at the same time and I'm not sure how it'll cope.

[DMcCoy]

2 Instances of squid? That sounds complicated. I'm having trouble configuring one instance properly at the moment! (I'll get the hang of it eventually)

 

I'll give 2.9 a try.

(the webmin report viewer said it didn't work with that version. Typical.)

 

Is there any way I can get squid to talk to the ISA directly? ISA is set not to allow basic auth. I don't really want to use NTLMAPS as we could have 250 people connecting at the same time and I'm not sure how it'll cope.

 

webmin doesn't work with 2.9 at all, no update appears to be on the horizon either. I was going to get smoothwall instead

[el8linuxel8]

Webmin is bad in general, some of the perl code in it is terrible! I'd configure it manually, id imagine there are alot of docs online on how to setup squid and dansguardian.

[_Jo_]

Webmin is bad in general, some of the perl code in it is terrible! I'd configure it manually, id imagine there are alot of docs online on how to setup squid and dansguardian.

 

I have been configuring it manually.

I put webmin on as an afterthought to view the log files.

 

Ok... installing DG 2.9 : installs ok, but when I try to run it I get

 

Unable to getgrnam(): Success

 

and DG won't start.

Edited April 2, 2008 by _Jo_

[Geoff]

In your dansguardian.conf, what is the 'daemongroup' option set to?

[_Jo_]

In your dansguardian.conf, what is the 'daemongroup' option set to?

 

Both commented out.

 

# daemonuser='nobody'

# daemongroup='nobody'

 

(I just tried uncommenting them and restarting, and same error.)

 

Edit:

Hm. Just tried changing that to

# daemonuser='nobody'

# daemongroup='nogroup'

and restarted:

Error openting / creating log file. (Check ownership and access rights).

I am running as nobody and I am trying to open /var/log/dansguardian/access.log

Edited April 2, 2008 by _Jo_

[_Jo_]

Finally got DG 2.9 working with NTLM.

 

Tweaked the log location permissions, then found I couldn't restart the service "I seem to be running already", (permissions wrong on /etc/init.d/dansguardian) tweaked that as well, then had an error about not being able to start because of some files in /tmp, so cleaned them up and it appears to be working, and logging usernames.

 

I've been told now that the ISA does support Basic. (I've still not managed to get it to work though.)

 

Does anyone have a simple squid.conf I could look at which passes basic auth to an upstream ISA, or uses one account to authenticate with the ISA? (so I don't have to use NTLMAPS) My squid.conf is a bit messy at the moment because I've used 101 sites and examples to try and get it working!

 

 

Thanks everyone for your help so far!

[_Jo_]

Never mind. It's working properly now. Cheers guys.

[weasel7711]

How did you fix the Unable to getgrnam() Success error, I am having the same problem

[ahuxham]

Our ISA server is for backup, with an allow for IP rule.

 

Squid NTLM - Dansguardian - ISA when needed for backup, just add the proxy information into Dansguardian, otherwise;

 

Squid NTLM - Dansguardian - Squid Cache

[weasel7711]

More confused