ahuxham

Hi All, Wondering if anyone had any insight into the following error/quirk, as google doesn't provide a suitable answer as the question is obscure. When reading logs, or using "sarg" to process a log into statistics, it always shows traffic for 192.168.0.0 (which is the acl defined as internal lan), all traffic is denied, however it then does as should report per username (ntlm_auth -- single-sign-on) Now, I have searched google and found nothing, but EVERY request a user makes i.e. 192.168.0.0 d www.google.com 192.168.0.0 d www.google.co.uk k.bridson 1 www.google.com k.bridson 1 www.google.co.uk Implying that localhost or some obscure call makes the first request, is than denied, and then the user requests and recieves content. "The above is show through SquidView, to monitor traffic, and every occurance of 192.168.0.0 has denied access. Yesterdays usage was around 900mb, but the line only has 5-7 trial members testing it, and 192.168.0.0 pulled almost 140mb data, I would like to hope its not repeating the data, as thats unnecessary data fetching" Anyone have any ideas?

"mkdir /etc/samba/drivers" than copy the original drivers in there, chown the folder as you would, and leave both locations chowned to domain admins, that way either one will work, if you're not sure about location. Another point may be to send him a PM and suggest the guides not very clear on those steps.

It took me ages to read, as I kept laughing.... very funny.

You'll want to run "locate drivers" thus showing all locations of that folder, it may have placed it in a different location, or surely, these "drivers" are the ones you've just downloaded, wouldn't you need to point that toward the location where they are shared?

You sure can. For example Samba, dependant of system, creates its winbindd pipe in different places, so I did a "locate d_pipe" and lo and behold it found the correct location of the folder. Its just a text search, either folder locations, filenames, etc etc

If you know there's meant to be something in there, do the following: shell: updatedb shell: locate filename and it should point to the correct location of the file.

quick work around: chgrp administrator /var/../.. && chmod 750 /var/../..

Current user loading http://server/exchange/name.surname shouldn't by default be prompted for credentials as you own the mailbox. Windows Host, authenticating through Windows Proxy, onto a Windows Server, or is there something else inbetween?

squid + squidGuard. Create a blacklist for google.com, google.co.uk, google.cn (we have many a chinese boarding student) add redirect to your own search, apply to squid.conf, and squid will see the site as blocked and redirect to the "naughty" page, which in this case is our own search page.

3.1.1 Sure, but thats an upgrade, specifically on the debian path to an unstable proxy which is annoying, however with time, and code testing it will become stable and user friendly. I have tried 3.x.x, and to be honest the delay_pools loving is something to be desired, at present, we have our blacklists and whitelists, both staff and students go through the machine, therefore to cause them annoyance we have every kind of messenger on a 256kb/s delay pool, which in turn speeds everything else up for everyone else, than again, youtube and facebook are AGGRESSIVELY cached via ACL's to minimize load on our end as well. Regards, NTLM: Just have a search for that registry key, and note the DWORD value, you'll be surprised how something so simple can cause you heartache. Should be DWORD:1 however its often DWORD:3 or 0, reboot and NTLM seems to work in what MS say "Negotiation Compatibilty Mode"

I was only following what a few websites suggested doing, from their outputs, its actually prompted withing terminal for username and password. However you are correct and the problem is now resolved. Want to know how? Safari.. I forgot it doesnt support either ntlmssp or basic helper protocols and just stalls its self all day long. Internet Explorer works perfectly, and squidview is showing all user traffic per name now. Firefox works as well, however would be nice to fix safari. Internet Explorer and Vista didn't work till I found a registry fix for it, should try that and hope Safari will actually play nice. HKLM> SYSTEM> CURRENTCONTROLSET> CONTROL> LSA> lmcomptatibiltylevel from [3 to 1] (Well thats the Vista fix for authentication anyhow!)

Fun fun fun.... indeed, I will have too, to diagnose the problem further. However, /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic at the terminal has no direct interfaction with squid, or am I mistaken?

Silly question I know, but is the NTP service configured to start at boot/startup? I know my debian machine doesn't for various reasons.

Regarding time: Are the 1 hours changes BST/GMT? check your /etc/timezone is configured as Europe/London Kerberos: krb5.conf [libdefaults] clockskew = 300 (gives you some leverage between times

Hi Geoff, Tried the above and got the following: NT_STATUS_OK: Success (0x0) Is there any other way I can diagnose this problem? I seem to be efficiently connected to the domain, authentication, lookups etc all seem to work effortlessly until I try ntlm_auth within squid.

Hi All, Its me again.... Anyhow, I seem to have a seriously frustrating problem at present. Having had to rebuild my squid box back up after pam.d corruption fried local login access, I can't seem to get ntlm_auth too work. ntlm_auth is working regards talking to the domain. WBINFO -T - Working WBINFO -G - Working WBINFO -U - Working WBINFO -A XXX\username%password - Working /usr/bin/ntlm_auth --username=username%password - Working /var/run/samba/winbindd_privelleged/ - Proxy has permissions /etc/squid/squid.conf - Cache effective user = Proxy All seems working, krb5.conf all setup, smb.conf all setup, nsswitch permissions are "files winbind lwidentity" all the above lead me to believe its all running perfectly fine, however running the following nothing happens /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic Returns nothing at all, adding the authenictation methods withing squid and it just sits there trying to load the page, but doesnt... What could be wrong?

http://www.centeris.com/products/likewise_open/index.php Is a good program, does all the Active Directory joining as well, configures your krb5.conf, smb.conf, nsswitch.conf, pam.d/* files etc for intergration, (and it never seems to fail)

Hi All, Wondering if anyone can point me in the right direction. Currently using Debian Etch as our proxy server, and remote access server, I.e. from home we can VNC into the machine and than remote desktop onto our windows servers, however this "single" remote desktop is not the one were looking for. Within Windows you have the default single remote desktop connection client, and than with server 2003 administrative tools you have the Remote Desktop consoles, these connections connect to the right session, where the Single version creates its own. Is there anyway to get onto the original instance of a remote desktop, rather than a new instance. Why: Lan Ranger, loaded onto the machines administrator sessions, and files locked, it cannot be opened onto a new remote session

Remove the server names as well, and use the IP addresses for a start, as this will ease any problems. Easier way to join as well is as follows: net ADS join -S 192.168.0.xx -U administrator%password Samba.conf: [global] netbios name = servername workgroup = name realm = school.somerset.sch.uk password server = primary DC IP_ADDR security = ADS winbind use default domain = yes krb5.conf [libdefaults] default_realm = SCHOOL.SOMERSET.SCH.UK clockskew = 300 [realms] SCHOOL.SOMERSET.SCH.UK = { kdc = DC IP address kdc = DC IP address as a failover admin_server = DC IP address default_domain = SCHOOL.SOMERSET.SCH.UK } Thats the absolute minimum requried for joining to a domain, please not CAPS ARE THERE FOR A REASON. Kerberbos and the k* programs are very strict on this fact, if prompted to enter domain name, ALWAYS ensure caps!

Thanks for the help Pete!

I see what you did there, and I doubt theres any problem routing that way. I can point my clients to ip_addr:8080 which DG will route into squid. Now whats to stop someone missing DG and going straight into squid?

Everything in linux is group based per se. It's fairly easy restricting access to most programs by configuring the users group memberships, there is a tutorial on linuxquestions.org Never add any user to the wheel group at any cost.

SpecialAgent; A recruiter often trawls the website, may be worth giving him a call and asking for advise. He recruits for the IT market and does alot of work for IT technicians and schools. It's worth a go mate: [email protected] or 08701 612 007 He may ask for an up-to date CV to throw out there into the abyss

Well I'd assume a company of Adobes stature would patch this in all revisions, but saying that, the new core code 9's meant to be coded with may not have this vulnerability. Who knows until it all goes belly up.

After finally completing my part in the Adobe Reader 9 test, including 5 different patches and feedback. I think we're ready to deploy across the school, before I even contemplate that; Has anyone entered the beta/evaluation for 9? Any thoughts, queries and qualms? The new security features, collab support are quite useful, and it seems to bypass existing problems within IE7, where loading a pdf will always force you too save it instead of opening the plugin and loading the pdf within the IE7 window.