Dansguardian on windows 2003 domain

[netadmin]

I managed to get a Suse 10.2 server installed with Squid and Dansguardian fully operational

 

Has anyone found a good method for automatically authenticating logged in domain users?

 

I want the users to login to the Windows domain (with XP Pro), like they currently do and for Dansguardian (or Squid) to silently and automatically retrieve their username, so I can better track user internet activity.

 

Thanks for any ideas.

[Geoff]

If you add the Linux Server to the Windows domain as a Domain member (you need to configure Kerberos, Samba and Winbind for this) you can use the ntlm_auth Squid authentication helper to make this work. However this only works for clients with IE or Firefox. It's best to configure the basic_auth too for fallback.

[netadmin]

Thank you.

 

I found in Suse 10.2's Yast control panel there is an option for Windows Domain Membership and Samba server. When I clicked on Domain membership, it downloaded files for samba and winbind. (I don't remember about Kerberos, I don't think it downloaded anything). I entered my domain name in Windows Domain Membership. Do I need to do anything else?

 

(Right now, the linux pc is at my house, and not connected to the school network. I will connect it to the network when get everything mostly ready to go, so I hopefully only have small config changes to do).

 

Anyway, is anyone familiar with this step? I'll admit, I am very new to linux, and still have a lot to learn. Thanks!

[Geoff]

You need to verify what sort of membership it's decided to use. Open up /etc/samba/smb.conf in a text editor. You absolutely must use 'security = ADS'. If Yast has decided to do something else, you'll have to ignore it and configure samba and friends manually.

[netadmin]

It does not even list a security line. I'm guessing this means I need to manually configure it?

[Geoff]

yes

[netadmin]

You need to verify what sort of membership it's decided to use. Open up /etc/samba/smb.conf in a text editor. You absolutely must use 'security = ADS'. If Yast has decided to do something else, you'll have to ignore it and configure samba and friends manually.

 

I did some clicking around today and it turns out I had forgotten to actually join the domain. smb.conf now lists security = ADS. The linux machine is also now listed in Active Directory.

 

Any tips on next steps, or additional tests I need to run?

[Geoff]

Check winbind is installed and works. You do this by running the 'wbinfo -t' command.

[netadmin]

OK. Below is the response after I ran the command.

checking the trust secret via RPC calls succeeded

[Geoff]

Looks good. You can continue by configuring squid. Once squid is working, configure NTLM and basic authentication in squid. Then you can move on to dansguardian.

[netadmin]

On one of the Squid documentation pages I just found, it recommended testing the NTLM authentication. I tried this and got an error message and was wondering if you have any ideas what might be wrong (if anything).

 

It said to enter

/usr/bin/ntlm_auth --username=[username]

at the console. I did this, and then it prompts for the password, like the documentation says.

However, the documentation says it should then say NT_STATUS_OK, and if not, to recheck your config (nothing more specific, though). It actually says NT_STATUS_NO_SUCH_USER on an account that is part of the domain (the admin account).

 

Thanks for any ideas. I GREATLY appreciate it and am learning a lot about linux.

[Geoff]

try specifying the domain name too.

[netadmin]

OK. I tried entering the username (the second one on the command) as DOMAIN\administrator (with domain the actual domain name, of course) and got the same error message.

 

Something else interesting, I noticed on the logon screen there is an option to logon to Suse with your Windows domain username/password. I tried this, it started to login, then said

could not start kstartupconfig. Check your installation.

and then goes back to the login screen.

 

Could this be related?

[Geoff]

You misunderstand.

 

/usr/bin/ntlm_auth --username=USERNAME --domain=DOMAIN

[netadmin]

Sorry about that.

 

Trying that revised code worked perfectly.

It now says

NT_STATUS_OK: Success (0x0) 

 

Thanks! I'll try to configure Squid later today.

[CyberNerd]

if you add

 winbind use default domain = yes

in your smb.conf you shouldn't need to specify the domain

[netadmin]

Thanks, Cybernerd. I'll keep that trick in mind.

[netadmin]

I tried to update the Squid.conf file and got a few errors. I think I'm getting close!

 

Code entered into squid.conf

auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 5
auth_param ntlm max_challenge_reuses 0
auth_param ntlm max_challenge_lifetime 2 minutes

auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 5 hours

acl NTLMUsers proxy_auth REQUIRED
http_access allow all NTLMUsers

 

When I reset and restarted Squid in Konsole, the following error messages appeared.

 

2007/06/16 12:39:24| unrecognised ntlm auth scheme parameter 'max_challenge_reuses'
2007/06/16 12:39:24| unrecognised ntlm auth scheme parameter 'max_challenge_lifetime'
2007/06/16 12:39:24| ACL name 'all' not defined!
FATAL: Bungled squid.conf line 1888: http_access allow all NTLMUsers
Squid Cache (Version 2.6.STABLE5): Terminated abnormally.

 

Any ideas?

[Geoff]

auth_param ntlm max_challenge_reuses 0
auth_param ntlm max_challenge_lifetime 2 minutes

 

These only work on Squid 2.4. Use the following instead.

 

authenticate_ttl 180

 

Also

 

http_access allow all NTLMUsers

 

is wrong. It should be

 

http_access allow NTLMUsers

[netadmin]

OK. One less error now

 

When I reset squid with squid -z, I get the following message:

2007/06/16 14:08:00| WARNING: No units on 'authenticate_ttl 180', assuming 180.000000 second
2007/06/16 14:08:00| Creating Swap Directories

firewall:~ # /etc/init.d/squid start
Starting WWW-proxy squid                                             done

 

Something seems to have a problem right now. When I try to connect to a website on this linux box, but going through the proxy server, it does not accept network usernames and passwords. It just keeps asking for username and password and never accepting it.

 

Also, I found a Kerberos test command (klist -e) and got the following error message:

klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_0)


Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached

 

Did I miss a step?

[Geoff]

kinit [email][email protected][/email]TLD

 

and try again.

[netadmin]

No Konsole errors after I typed your revised command

I then tried a klist -e and it had the following response, I'm guessing this is good.

 

Ticket cache: FILE:/tmp/krb5cc_0
Default principal: Administrator@DOMAIN

Valid starting     Expires            Service principal
06/16/07 20:42:24  06/17/07 06:42:05  krbtgt/DOMAIN@DOMAIN
       renew until 06/17/07 20:42:24, Etype (skey, tkt): ArcFour with HMAC/md5, ArcFour with HMAC/md5


Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached

 

I now tested the proxy server by changing the browser connection setting on the firewall computer (I know I have to manually enter the username) and it goes into an endless logon loop, continually asking for username/password and never accepting it. :?

[netadmin]

First of all, I am very sorry that I had double posted the last message. I got that cleaned up now. (I had clicked quote rather than edit, like I had wanted to do and did not notice until just now.)

 

I looked at the log files and think I might have found the problem on why it is not accepting the username and password for the domain, but have no clue how to fix it. Below is an excerpt from the Squid log.

 

Login for user [DOMAIN]\[administrator]@[DOMAIN] failed due to [winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/lib/samba/winbindd_privileged are set correctly.]
2007/06/17 10:29:21| authenticateNTLMHandleReply: Error validating user via NTLM. Error returned 'BH NT_STATUS_ACCESS_DENIED'

 

Anyone have any ideas?

[netadmin]

@Geoff

 

I'm not sure exactly what happened. I restarted the server, after I had been looking at the log files. I have changed all settings back that I had been tweaking. Something seems to be wrong now, though.

 

-The Suse login screen no longer has the option to logon to the windows domain (not that I need that, I'm just afraid it might mean a larger Suse issue)

-wbinfo -u now says error looking up domain users.

-winbind now refuses to start. When I manually start it, it says WARNING: /var/run/samba/winbindd.pid FAILED.

 

Do you have any ideas on where to start checking settings? It appears like the config files still reference the domain connection, like before.

 

I really appreciate all the help you have given so far, and am hoping you might have an idea on this latest issue.

[Geoff]

Login for user [DOMAIN]\[administrator]@[DOMAIN] failed due to [winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/lib/samba/winbindd_privileged are set correctly.

 

You must ensure squid has read/write access to the winbindd pipe.