Endian Firewall

[Bugs]

Hiya all,

 

we have a Endian Firewall and i`m trying to get it to automatically pass the login credentials from the windows 7 clients to the firewall using AD.

 

I have successfully joined it to the network, and I can see the computer account on my windows Server, but it refuses to pass the login info, when you try to access a site a log in box appears asking for login and password I fill this in (according to my access policy) and it just bounces back as if its the wrong password.

 

I have tried various things with no luck, I even have one of the techy's from one of our partner schools looking into it, and he seems to get the same results on his test box. I`m using version 2.4.

 

Cany anybody shed any light on this?

[squeeky]

are they macs ? we have endian firewall and it hates the mac NTLM support. Ive not used 2.4 but i know it deffinatly works in 2.3. would you like a screenshot of my domain settings page ? Also you might need to change group policy to allow insecure domain access (or something like that) It took me ages to figure out how to make it work properly Edited November 4, 2010 by squeeky

[Bugs]

No they are all windows 7 PC's, id love a screen shot of your settings page, iv tried modifying the local policy whether it was that I changed I cant remember now.

 

Thanks

[tom_newton]

Try it with XP. If it works with XP its probably an incompatibility with their version of samba, in which case there's a registry hack somewhere to downgrade Win7's more aggressive NTLM requirements

[squeeky]

Right ive done some screenshots. Our domain server is (DT-SERVER) 192.168.1.2 and our domain is DESIGNTECH.SCHOOL (fully qualified). Personally ive had issues with anything above windows 2003 server. Win 7 isnt the issue as we have a test client running as stock and the internet works on that. The error in NTML is between your server and and endian. If its looking then thats because either the credentials arnt ever getting to the server or its rejecting them. For NTML you must use IE. Use a packet sniffer on your server and see if you can see any credentials comming through to the server (tho they will be encrypted) the problem probably lines between different versions of ntlm on your server and what endian expects. check the squid logs aswell eg error.log cos that will tell you if the username was invalid or what. Let me know if you have more issues because ive got other ideas.

 

 

This was interesting

http://developers.de/blogs/damir_dobric/archive/2009/08/16/enabling-of-ntlm-on-windows-7-and-windows-server-2008-r2.aspx

 

 

http://voteforaserver.co.cc/Endian/NTLM1.png

 

http://voteforaserver.co.cc/Endian/NTLM2.png

 

http://voteforaserver.co.cc/Endian/NTLM3.png

Edited November 4, 2010 by squeeky

[Bugs]

Thanks for the screenshots, the only thing I was missing was the DNS routing which iv added, and just in the process of restarting the system.

 

Iv installed wireshark on the AD server and first initial capture didnt show any packets coming from my client, and that was from an XP machine, I will try again to confirm.

 

I do get TCP denied errors in the proxy log tho.

[squeeky]

Well the information doesnt go straight from the XP client to the Windows Server. It goes like this XP Auth ----> Squid (endian) pass access controls -----> windows server. Edited November 5, 2010 by squeeky

[Bugs]

Just had another look Wireshark shows communication with the firewall. I can see the firewall sending request to the AD server but, when the ad server replies it show error packets with a STATUS_PIPE_DISCONECTED error

[squeeky]

Hmm. Thats new. Im pretty sure thats to do with security settings on AD server. Can show a copy of the error log that squid gives ?

[Bugs]

Hope this helps

 

[squeeky]

It does but to find out more i need you to SSH in to the endian box and get /var/logs/squid/error.log and paste it here because the log you shown is access.log

[Bugs]

I`m not sure how to actually get the file off the box, if you can talk me through it i`ll do it.

[squeeky]

Have you got ssh enabled ? if so download WINSCP (an ssh file manager) and then login that way using your terminal username and password. If not you can enable it on the web interface

[Bugs]

Iv already got SSH enabled did it throught the web interface, i`m using Putty

[squeeky]

putty wont really help you. If you use WINSCP youll see you entire file structure and can just drag the files to your hard disk.

 

 

or do vi (or vim)

 

vi /var/log/squid/error.log

 

or

 

vim /var/log/squid/error.log

 

send a screenshot of the bottom of that file over

to quit type :q

Edited November 5, 2010 by squeeky

[Bugs]

I cant find an error.log file, iv got an access.log which is basically the screen shot

[Bugs]

Found a samba log and the last few lines are these.

 

[2010/11/05 15:15:49, 0] rpc_client/cli_pipe.c:rpc_api_pipe(789)

Nov 5 15:15:49 firewall winbindd[5046]: rpc_api_pipe: Remote machine FOXWOOD-SCHOOL.FOXGLOVE.LOCAL pipe \NETLOGON fnum 0x8003 returned critical error. Error was NT_STATUS_PIPE_DISCONNECTED

Nov 5 15:20:49 firewall winbindd[5046]: [2010/11/05 15:20:49, 0] rpc_client/cli_pipe.c:rpc_api_pipe(789)

Nov 5 15:20:49 firewall winbindd[5046]: rpc_api_pipe: Remote machine FOXWOOD-SCHOOL.FOXGLOVE.LOCAL pipe \NETLOGON fnum 0x8003 returned critical error. Error was NT_STATUS_PIPE_DISCONNECTED

Nov 5 15:25:49 firewall winbindd[5046]: [2010/11/05 15:25:49, 0] rpc_client/cli_pipe.c:rpc_api_pipe(789)

Nov 5 15:25:49 firewall winbindd[5046]: rpc_api_pipe: Remote machine FOXWOOD-SCHOOL.FOXGLOVE.LOCAL pipe \NETLOGON fnum 0x8003 returned critical error. Error was NT_STATUS_PIPE_DISCONNECTED

Nov 5 15:30:49 firewall winbindd[5046]: [2010/11/05 15:30:49, 0] rpc_client/cli_pipe.c:rpc_api_pipe(789)

Nov 5 15:30:49 firewall winbindd[5046]: rpc_api_pipe: Remote machine FOXWOOD-SCHOOL.FOXGLOVE.LOCAL pipe \NETLOGON fnum 0x8003 returned critical error. Error was NT_STATUS_PIPE_DISCONNECTED

Nov 5 15:35:49 firewall winbindd[5046]: [2010/11/05 15:35:49, 0] rpc_client/cli_pipe.c:rpc_api_pipe(789)

Nov 5 15:35:49 firewall winbindd[5046]: rpc_api_pipe: Remote machine FOXWOOD-SCHOOL.FOXGLOVE.LOCAL pipe \NETLOGON fnum 0x8003 returned critical error. Error was NT_STATUS_PIPE_DISCONNECTED

Nov 5 15:40:49 firewall winbindd[5046]: [2010/11/05 15:40:49, 0] rpc_client/cli_pipe.c:rpc_api_pipe(789)

Nov 5 15:40:49 firewall winbindd[5046]: rpc_api_pipe: Remote machine FOXWOOD-SCHOOL.FOXGLOVE.LOCAL pipe \NETLOGON fnum 0x8003 returned critical error. Error was NT_STATUS_PIPE_DISCONNECTED

[Bugs]

anyone help me with this still havig problems with it

[squeeky]

I have found your answer after hours of searching, Hope this works (let me know)

 

See Mantis Bug Page: 0002839: Proxy Auth and AD 2008R2 fail - Mantis

 

Problem:

Endian HTTP Proxy doesn't work with Windows Server 2008 R2 Active Directory

Log errors on /var/log/samba/samba.log, like this:

winbindd[7024]: rpc_api_pipe: Remote machine domain.local pipe \NETLOGON fnum 0x8003 returned critical error. Error was NT_STATUS_PIPE_DISCONNECTED

 

What cause it:

samba 3.2 is incompatible with ADS Windows 2008 R2

 

How to fix it:

Upgrade to samba 3.5.4.

 

1- Download Samba 3.5.4 packages from: HERE (Sorry its Megaupload) tell me if you need it uploading somewhere else (Squeeky)

2-Copy the file EFW2.4_Samba_Fix.tgz to your firewall, the easiest way is with WinSCP

3-Unzip the file, either with WinSCP File->Custom Commands->Untar or using the command tar -xvf EFW2.4_Samba_Fix.tgz

4-Go to the directory called samba: cd samba

5-Run the installer: ./install.sh It should install all the packages involved correctly.

6-Reboot

 

Warning

It works as intented in my test machine, that's all. I only tested it with Windows Server 2008 R2, I haven't tested on any other AD server.

Use this patch at your own risk. I'm not responsible of any use or problem with these rpms (either good or bad).

If you want to see the sources, ask for them. There are a lot, though.

 

 

Source: ENDIAN Firewall - [EFW 2.4 Community] Active Directory 2008 R2 Bugfix

Edited December 9, 2010 by squeeky

[tom_newton]

Do I win a prize for suggesting this was the case earlier?

[squeeky]

no, but you would have done if you had actuary found the answer as well

[Bugs]

thanx guys i'll give it a go on monday when I get to work on Monday (Not there to day as couldnt get there cause of ice)

[Bugs]

Hi Guys,

 

worked a charm, thanx guys, specially to Squeeky as he's done all the hard graft

[pkombala]

Hiya all,

 

we have a Endian Firewall and i`m trying to get it to automatically pass the login credentials from the windows 7 clients to the firewall using AD.

 

I have successfully joined it to the network, and I can see the computer account on my windows Server, but it refuses to pass the login info, when you try to access a site a log in box appears asking for login and password I fill this in (according to my access policy) and it just bounces back as if its the wrong password.

 

I have tried various things with no luck, I even have one of the techy's from one of our partner schools looking into it, and he seems to get the same results on his test box. I`m using version 2.4.

 

Cany anybody shed any light on this?

 

search this command on endian community it is working fine for me

chgrp squid /ver/cache/samba/winbindd_privileged/

chmod 750 /ver/cache/samba/winbindd_privileged/

 

USE DNS 1 WINDOWS DOMAIN CONTROLLER ip

SYSTEM -NETWORK CONFIGURATION DOMAIN NAME -SAME AS YOUR FULL DOMAIN NAME (pdc)

 

 

use putty from windows computer and connect through ssh