Dansguardian on windows 2003 domain

[netadmin]

OK--Here's the latest update on my system. Earlier, I tried to reset the permissions to grant squid access to winbind. However, in the process, something went very wrong and I now get the following error when I try to start winbind.

 

[2007/06/17 21:39:47, 0] lib/util_sock.c:create_pipe_sock(1285)
 invalid permissions on socket directory /var/lib/samba/winbindd_privileged
open_winbind_socket: Resource temporarily unavailable

 

Any tips on how to properly fix this? I have tried resetting the permissions to what the other folders are set to originally, and it still has the same error. I am really hoping I will not have to format the hard drive and start the Suse install from the beginning.

 

Luckily, my VNC connection continues to work, so this is making my troubleshooting much easier.

[Geoff]

change the group ownership of '/var/lib/samba/winbindd_privileged' to whatever group squid runs as (most likely 'squid' or 'proxy').

[netadmin]

OK, it looks like I had a corrupt file somewhere. I reinstalled Samba and got it configured like before. I can now manually start winbind.

 

However, when I try to change the permission settings (changing group to Squid) for the winbindd_privileged folder, winbind then stops and refuses to start itself, or be manually started.

 

Please see my attached image. This is my current permission settings for the folder. Please let me know if you have any advice.

[ChrisH]

According to geoff the owner should be the account that runs squid. The owner on your screenshot is root.

[netadmin]

OK, I discovered that the reason winbind kept crashing was that the server needed a restart after I reinstalled Samba. The permissions have been corrected.

 

However, when I try to access websites, I still get about 10-12 login prompts and it still does not accept the username/password.

 

The log file shows that it is recording the username, which is was not before, so this appears to be a good sign.

 

Do you think that http access is disabled for NTLM user ACL, or is it still a winbind problem?

[Geoff]

That is a Squid ACL problem. Verify you http_access and acl lines are correct and ordered appropriately.

[netadmin]

Hmm... they look correct to me, but that does not mean much, plus it still does not work.

 

Do I have to define another ACL variable somewhere?

squid.pdf

[Geoff]

Enabling NTLM keep alive is probably a good idea.

auth_param ntlm keep_alive on

 

I don't see anything obviously wrong with your http_access lines. I shall post mine tomorrow though so you can compare.

[netadmin]

Thank you, Geoff, I'd appreciate that if you would post your settings.

 

I did notice one more thing, not sure if it's related- check the attachment to see the warning I get anytime squid starts or stops.

[Geoff]

I am using the following version of squid

 

root@titan:/etc/squid# squid -v
Squid Cache: Version 2.5.STABLE12
configure options:  --prefix=/usr --exec_prefix=/usr --bindir=/usr/sbin --sbindir=/usr/sbin --libexecdir=/usr/lib/squid --sysconfdir=/etc/squid --localstatedir=/var/spool/squid --datadir=/usr/share/squid --enable-async-io --with-pthreads --enable-storeio=ufs,aufs,diskd,null --enable-linux-netfilter --enable-arp-acl --enable-removal-policies=lru,heap --enable-snmp --enable-delay-pools --enable-htcp --enable-poll --enable-cache-digests --enable-underscores --enable-referer-log --enable-useragent-log --enable-auth=basic,digest,ntlm --enable-carp --with-large-files i386-debian-linux

 

With the following configuration

 

#IP/Port squid listens for connections on

#for testing
#http_port 8080

#for dansguardian
http_port localhost:3128

# What we call ourselves

visible_hostname proxy.carrhill.lancs.sch.uk

#don't cache urls with these in them

hierarchy_stoplist cgi-bin ?

acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY

# how much ram to use

cache_mem 256 MB

# largest file to cache

maximum_object_size  200 MB

#where the cache is on disk, how large it is (50Gb)

cache_dir ufs /var/spool/squid 50000 16 256

#Define upstream proxy

cache_peer proxy.lancsngfl.ac.uk        parent  8080    7       no-query default

#Authentication methods

#NTLM

auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 10
auth_param ntlm max_challenge_reuses 0
auth_param ntlm max_challenge_lifetime 2 minutes

#Basic Auth (Just in case)

auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 5 hours

#define some acls

# basic stuff
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object

#Localhost
acl localhost src 127.0.0.1/255.255.255.255

#Local LEA
acl local_external dstdomain lancsngfl.ac.uk

#Local domain
acl local_servers dstdomain carrhill.lancs.ac.uk

#LAN IP Range
acl local_ip_range dst 10.73.24.0/255.255.252.0
acl local_lan_ip src 10.73.24.0/255.255.252.0

#Software that doesn't support user authentication

#For windows updates
acl windowsupdates dstdomain .microsoft.com .windowsupdate.com

#For food software
acl food dstdomain .cls-bfh.co.uk

#Standard ACLs
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 777         # multiling http
acl purge method PURGE
acl CONNECT method CONNECT

#Authentication ACL
acl AuthorizedUsers proxy_auth REQUIRED

# Allow manager from Localhost
http_access allow manager localhost
http_access allow manager local_lan_ip
http_access deny manager

# Only allow purge requests from localhost
http_access allow purge localhost
http_access deny purge

# Deny requests to unknown ports
http_access deny !Safe_ports

# Deny CONNECT to other than SSL ports
http_access deny CONNECT !SSL_ports

#Allow without authentication
#http_access allow localhost

#Allow software  with no authentication
http_access allow windowsupdates
http_access allow food

#allow authenticated users
http_access allow AuthorizedUsers

# Don't go via another proxy for these addresses
always_direct allow local_external
always_direct allow local_servers
always_direct allow local_ip_range
never_direct allow all

# And finally deny all other access to this proxy
http_access deny all

[netadmin]

Thank you, Geoff. That's very helpful.

I am now trying to install Squid version 2.5, like on your system, so the configuration file will be more similar, and hopefully, easier for me to find the problem.

 

One odd problem occurred after I reinstalled it and editted the config file. The attached error message appears anytime squid starts/stops.

 

This appeared a few minutes after Squid "terminated abnormally" and said warning: Squid killed!

 

Have you seen this message before?

[Geoff]

The init script for squid probably isn't doing the right thing for the new version.

[netadmin]

^It turns out I had accidentally copied the Squid 2.6 init script. A quick squid reinstall fixed that problem and I now get the authentication dialog.

 

However, I am still getting 6+ dialogs and it is not accepting the username and password. I have updated the config file to be very similar to yours.

 

I do not know if I missed something in the config file, or what.

 

Do you have any more ideas? (I can get any file that might be helpful).

 

Thanks again.

squid_-_notepad.pdf

[Geoff]

You have a broken acl. You wrote

http_access allow all AuthorizedUsers

It should read as

http_access allow AuthorizedUsers

[netadmin]

I now fixed the broken ACL.

 

However, it is still not accepting the username/password.

I did notice something odd: the first few login prompts just say

Enter username and password for proxy "" at 192.168.0.2:3128.

then the last few login prompts say

Enter username and password for proxy "Squid proxy-caching web server" at 192.168.0.2:3128.

 

The username is only recorded in the log for the second style of login prompt.

 

Does this mean something is still not configured correctly, and could cause it to not accept any username/password? Thanks.

[Geoff]

NTLM authentication is failing. This is most likely a problem with Samba/Winbind.

[netadmin]

I checked the Samba and Winbind logs and found a few interesting events that might be related to the NTLM problem. Screenshots are attached. These events occur after every system restart.

 

Any thoughts on whether these are a likely cause, and tips on how to correct these? Thanks.

[Geoff]

what's the result of 'wbinfo -t'?

[netadmin]

wbinfo -t produces the following result:

 

checking the trust secret via RPC calls succeeded  

 

Is this is a good response?

 

 

In addition, wbinfo -g lists all domain user groups (not sure if that helps any).

[Geoff]

Do

net ads status -U 

and

ntlm_auth --username= --domain= -d10 --diagnostics

work?

[netadmin]

Please see attachments.

Net ads appears to be ok, ntlm_auth had several errors.

 

This is a problem, I'm guessing??

netads.pdf

ntlm.pdf

[Geoff]

What version of ntlm_auth are you using?

[netadmin]

How do I get the version number?

[Geoff]

root@titan:~# ntlm_auth -V
Version 3.0.22

In theory, the version of ntlm_auth should be the same as the version of samba your using.

root@titan:~# smbd -V
Version 3.0.22

 

If not, or they are both really old. This might be why your having problems.

[netadmin]

Thanks.

 

Samba is version 3.023d-6-1083-SUSE-SL10.2

NTLM_auth keeps saying unknown option when I try -V.

 

Does this mean it needs to be reinstalled? Any tips on reinstalling it? It does not appear in Yast as an install option.