[ubuntu] Squid and NTLM

[localzuk]

I have an issue with a new Squid box I'm setting up. I have set up the settings per all the various advice threads on here and across the web. Namely, pretty much the same as http://www.edugeek.net/forums/nix/18109-ntlm-auth-squid.html#post180421

 

However, I have the same problem that that thread indicates...

 

ie. I get messages saying 'Login for user [sCH4290\username]@[iTS] failed due to [winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/run/samba/winbindd_privileged are set correctly.]'

 

Where am I going wrong?

[Geoff]

chown root:squid /var/cache/samba/winbindd_privileged
chmod 750 /var/cache/samba/winbindd_privileged

[localzuk]

winbindd_privileged is not in /var/cache/samba, it is in /var/run/samba/.

 

So, changing any group/permission settings on it is pointless, as a restart resets them back again to the Ubuntu defaults.

 

Although, running it when the server is on does make it work (ie. setting the perms for the directory as you say).

[localzuk]

Update, i've edited /etc/init.d/winbind to chown root:squid instead of chgrp winbindd_priv

 

Thanks geoff.

[Geoff]

https://bugs.launchpad.net/ubuntu/+source/samba/+bug/64425

[localzuk]

https://bugs.launchpad.net/ubuntu/+source/samba/+bug/64425

 

Indeed, and that page doesn't actually list a solution - as the one involving the group winbindd_priv doesn't actually work.

 

I think I'll stick with what now works

[joe90bass]

Update, i've edited /etc/init.d/winbind to chown root:squid instead of chgrp winbindd_priv

 

Thanks geoff.

 

Hi Localz,

I'm having the same issue an Google leads me to your post! What did you put exactly? My Linux knowledge is a bit vague! I'm guessing you're on about this part:

mkdir -p /var/run/samba/winbindd_privileged || return 1

chgrp winbindd_priv $PIDDIR/winbindd_privileged/ || return 1

chmod 0750 $PIDDIR/winbindd_privileged/ || return 1

start-stop-daemon --start --quiet --oknodo --exec $DAEMON -- $WINBINDD_OPTS

 

Cheers

[joe90bass]

After searching google and reading above I solved my issue by adding the proxy user to the winbindd_priv group using webmin