407 proxy authentication

[rashidhussain]

Hi, im hoping someone can help, ive been placed in charge of the web filtering, but am getting the accounts department trying to access an application which requires internet. They keep getting a logon failure.

 

The software, winbacs, have sent me logs of the problem:

 

HTTP: 407 Proxy Authentication Required

X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0

X-Cache: MISS from ClientSiteProxy

X-Cache-Lookup: NONE from ClientSiteProxy:3128

Connection: close

Content-Length: 1364

Content-Type: text/html

Date: Wed, 02 Feb 2011 15:00:14 GMT

Expires: Wed, 02 Feb 2011 15:00:14 GMT

Proxy-Authenticate: NTLM

Server: squid/2.7.STABLE4

Via: 1.0 ClientSiteProxy:3128 (squid/2.7.STABLE4)

ERROR: Cache Access Denied

------------

 

I am using messagelabs as the web filtering tool and using clientsiteproxy. I think I need to mage some changes to the squid file but am unsure of how to go about this, any help will be appreciated.

[glennda]

Not used Messagelabs or anything but to bypass ntlm for some sites you will need to add a line like this

 

acl bypassNTLM dstdomain "/etc/squid/bypassauth.squid"

 

above acl AuthorizedUsers proxy_auth REQUIRED

 

then create the file bypassauth.squid inside the folder /etc/squid/ above and add the domains the program needs access to

 

restart squid

[rashidhussain]

Hi, thanks

Ive got to the part where Ive created a file called bypassauth.squid, but unsure how to add a domain in here.

 

The rest of the log shows:

 

ERROR

Cache Access Denied

---

 

While trying to retrieve the URL:

paymentservices.bacs.co.uk:443

 

The following error was encountered:

• Cache Access Denied.

 

So I am thinking the domain is paymentservices.bacs.co.uk:443. Can you let me know the format I need to type this into the new blank bypassauth.squid I have created.

[glennda]

Just type in bacs.co.uk and it should then do anything for the whole domain - or just put in paymentservices.bacs.co.uk

 

It might need the subdomain aswell as the domain

 

Or put in *.bacs.co.uk

Edited February 3, 2011 by glennda

[glennda]

Did that work?

[rashidhussain]

hi again, im having difficulties since restarting the squidNT service. It would not restart giving me an error service not restarting 107. I then tried to uninstall the program and reinstall, but now getting error 1920 when trying to reinstall the program Edited February 3, 2011 by rashidhussain

[rashidhussain]

Ok I have managed to restart squid successfully now, so will get back to you once I have tested this. Many thanks for you assistance.

[rashidhussain]

hi, ive just tried the solution, but they are still getting logon failure on the application

[rashidhussain]

hi, is there any other suggestions for resolving this issue, thanks.

[glennda]

Sorry for not getting back to you - As far as i know that should have worked. Can you proxy see that site unrestricted? ie there is no upstream filter in place

[rashidhussain]

Sorry I am not sure how to go about checking this. I recieved a document from the software company in which they asked me to put the same proxy I had from the internet explorer into their own software and to leave the username and password as blank if the user does not get prompted for this when opening the internet. I tried this, but no luck.

[glennda]

I mean can you plug something in on the other side of the proxy and see if you can get to the webaddress.