Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Squid+Dansguardian with Active Directory (NTLM) Single Sign On WORKING!!!

    Cache/Proxy
    44
    135
    124.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      damasceno
      last edited by

      fedetehue I have the same problem, I also have two more problems: https://forum.pfsense.org/index.php?topic=82765.0

      Does anyone have any idea? I don't know how to solve that  :-\

      1 Reply Last reply Reply Quote 0
      • P
        psob
        last edited by

        i'm newbie
        PC 2.1.5-RELEASE x64, Dansguardian 2.12.0.3_2 pkg v.0.1.12

        installed from this manual, it's work, but no automatic

        i set Default group to banned mode, and AD group update frequency = 1m
        after changes group's members in AD - dansguardian Users tab normaly updated
        but Users Counter's in header tabs no refresh, and new added users blocking
        after manualy press Save button on Users tab, Counter's refreshed and new users start working.

        it's normal after every edit AD group, i must save dansguardian Users tab?

        2fedetehue,
        dansguardian_ldap.php checks 2 argv
        try variant your chose in LDAP group name source (by field name or field description)
        php /usr/local/www/dansguardian_ldap.php name inettest
        php /usr/local/www/dansguardian_ldap.php description "inet-group"

        1 Reply Last reply Reply Quote 0
        • N
          neophyteJJ
          last edited by

          Thanks for the input.

          I have a problem in step 13.

          Login via SSH using PuTTY, home income ADMIN pfSense Firewall?
          Or should enter the MYADMIN@MYDOMAIN.LOCAL account?

          Login with MYADMIN@MYDOMAIN.LOCAL not accept the password.

          to enter with pfSense Firewall Local ADMIN if income perfectly. Running / usr / local / bin / kinit myadmin net ads join-U myadmin
          Result:

          myadmin@MYDOMAIN.LOCAL.'s Password:

          When entering the password, it gives the following error:
          kinit: krb5_get_init_creds: unable to reach any KDC in realm mydomain.local.

          NOTE: I have a DC with mydomain.local domain and create a user myadmin

          Who can help me validate that I like to check and validate against the server.

          2.1.5-RELEASE (amd64)
          built on Mon Aug 25, 2014 7:44:45 EDT
          FreeBSD 8.3-RELEASE-p16

          Package Name               Category Package Version
          Dansguardian               Services 2.12.0.3_2 pkg v.0.1.12
          Shellcmd                       Services 0.5
          squid3-dev                       Network 3.3.10 pkg 2.2.6

          AD Windows 2012 Server

          Gracias por el aporte.

          Tengo un problema, en el paso 13.

          Ingresar vía SSH usando PuTTY, ingreso como ADMIN local del Firewall PFSENSE ?
          O deberia ingresar con la cuenta  MYADMIN@MYDOMAIN.LOCAL ?

          Login con MYADMIN@MYDOMAIN.LOCAL no acepta la contraseña.

          al ingresar con ADMIN local del Firewall PFSENSE si ingreso, perfectamente. Al ejecutar /usr/local/bin/kinit myadmin net ads join -U myadmin
          Resultado:

          myadmin@MYDOMAIN.LOCAL.'s Password:

          Al ingresar la Contraseña, da el siguiente error:
          kinit: krb5_get_init_creds: unable to reach any KDC in realm MYDOMAIN.LOCAL.

          NOTA: Tengo un DC con el dominio MYDOMAIN.LOCAL y cree un usuario myadmin

          Quien me puede ayudar a validar que debo verificar y como para que se valide contra el servidor.

          2.1.5-RELEASE (amd64)
          built on Mon Aug 25 07:44:45 EDT 2014
          FreeBSD 8.3-RELEASE-p16

          Package Name               Category Package Version
          Dansguardian               Services 2.12.0.3_2 pkg v.0.1.12
          Shellcmd                       Services 0.5
          squid3-dev                       Network 3.3.10 pkg 2.2.6

          AD Windows 2012 Server

          1 Reply Last reply Reply Quote 0
          • T
            tk
            last edited by

            I had similar issues and I simply replaced the hostnames with their IPs.

            1 Reply Last reply Reply Quote 0
            • X
              xalex1977
              last edited by

              PfSense 2.2 + squid3 + squidguard-devel integration with Active Directory
              works this configuration?
              can anyone help me?

              1 Reply Last reply Reply Quote 0
              • marcellocM
                marcelloc
                last edited by

                you will need a samba3 or 4 compiled on freebsd to use it.

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • P
                  percyiii
                  last edited by

                  Ok so tried updating to 2.2
                  my squid custom integretion

                  http_access allow whitelist
                  acl_uses_indirect_client on
                  follow_x_forwarded_for allow localhost
                  auth_param ntlm program /usr/local/bin/ntlm_auth –use-cached-creds --helper-protocol=squid-2.5-ntlmssp
                  auth_param ntlm children 10
                  auth_param ntlm keep_alive on
                  acl password proxy_auth REQUIRED
                  http_access allow password

                  Squid will now not start because of
                  auth_param ntlm program /usr/local/bin/ntlm_auth --use-cached-creds --helper-protocol=squid-2.5-ntlmssp

                  Shared object "libcrypto.so.6" not found, required by "ntlm_auth" which was part of squid 2.5 isntall i believe..

                  Any ideas.. I take that line out and authentication fails

                  1 Reply Last reply Reply Quote 0
                  • P
                    percyiii
                    last edited by

                    Ok so found out that samba36;samba-devel;heimdal were uninstalled..
                    So reinstalled samba36;samba4(this isn't samba-devel;heimdal..
                    Had to copy smb.conf to smb4.conf
                    but get an error when starting squid..
                    ERROR: auth_param ntlm program /usr/local/bin/ntlm_auth: (2) No such file or directory FATAL: auth_param ntlm program /usr/local/bin/ntlm_auth: (2) No such file or directory
                    But the directory exists..
                    I would think passing windows username would be this difficult.. Looked at the Squidtrust article.. but didnt look as simple as let on..
                    Not too concerned with someone spoofing the username..
                    Just need to pass it to squid…
                    Thx

                    1 Reply Last reply Reply Quote 0
                    • A
                      alex.g 0
                      last edited by

                      Thanks for this thread! Now my sso is running on pfsense 2.1.
                      But now 2.2 is out and I also would like to upgrade to 2.2. Anyone can help?
                      I have the sam problems like percyiii. Already described in my german thread https://forum.pfsense.org/index.php?topic=86972.msg477384#msg477384 and described in the squid-forum:
                      http://squid-web-proxy-cache.1019090.n4.nabble.com/ntlm-No-such-file-or-directory-td4669085.html

                      Would be very nice to get help, if I can do anything to help, I would do it.

                      Greetings Alex

                      1 Reply Last reply Reply Quote 0
                      • marcellocM
                        marcelloc
                        last edited by

                        On 2.2, try install packages from freebsd repo using  pkg install instead of pkg_add from my repo.

                        Samba 3 does not have ad options compiled but samba4 may have.

                        Treinamentos de Elite: http://sys-squad.com

                        Help a community developer! ;D

                        1 Reply Last reply Reply Quote 0
                        • A
                          alex.g 0
                          last edited by

                          Ok, it looks not so bad.
                          Have done the complete procedure on pfsense 2.2 but with "pkg install samba4" and "pkg install heimdal".
                          Somewhere I had to use samba4 insted of samba.
                          The squid Problem with " /usr/local/bin/ntlm_auth: (2) No such file or directory" is gone. squid is running.
                          The Ldap-Informations about groupmembers are working. Also wbinfo -u and wbinfo -g working correct.

                          But I don't see the domain username in the dansguardian-log. So I think sso is not functional in the moment. But one step further today.
                          Will have a look tomorrow again.

                          1 Reply Last reply Reply Quote 0
                          • K
                            kelsen
                            last edited by

                            pfSense 2.2 broke my squid ntlm authentication too.
                            installing samba4, heimdal didn't solve the "No such file or directory" problem for me.

                            1 Reply Last reply Reply Quote 0
                            • P
                              percyiii
                              last edited by

                              @alex.g:

                              Ok, it looks not so bad.
                              Have done the complete procedure on pfsense 2.2 but with "pkg install samba4" and "pkg install heimdal".
                              Somewhere I had to use samba4 insted of samba.
                              The squid Problem with " /usr/local/bin/ntlm_auth: (2) No such file or directory" is gone. squid is running.
                              The Ldap-Informations about groupmembers are working. Also wbinfo -u and wbinfo -g working correct.

                              But I don't see the domain username in the dansguardian-log. So I think sso is not functional in the moment. But one step further today.
                              Will have a look tomorrow again.

                              Agreed only thing I changed after install of samba4 was copied smb.conf to smb4.conf
                              Ldap info there but not authenticating..

                              1 Reply Last reply Reply Quote 0
                              • G
                                ghosterius
                                last edited by

                                @kelsen:

                                pfSense 2.2 broke my squid ntlm authentication too.
                                installing samba4, heimdal didn't solve the "No such file or directory" problem for me.

                                You'll have to "copy" the ntlm_auth into the directory /usr/pbi/squid-amd64/bin/ and change that in the configuration accordingly. That solved the "No such file or directory" issue for me.

                                Now, machine is in AD, can see users and groups and what not, but the authentication prompts me for password and doesn't seem to work at all :(

                                1 Reply Last reply Reply Quote 0
                                • marcellocM
                                  marcelloc
                                  last edited by

                                  Check cache.log may be related to winbind_privileged file permissions.

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    alex.g 0
                                    last edited by

                                    Yesterday I thought the "No such file" error is solved. But today squid was not starting because of this error. Now I tried the solution from ghosterius, and the error is gone, squid is running.
                                    In the systemlog I see:
                                    Jan 29 12:19:47 pfSense22 dansguardian[60493]: NTLM - Invalid message of length 42, message was: NTLMSSP
                                    Jan 29 12:19:47 pfSense22 dansguardian[60493]: Auth plugin returned error code: -3
                                    (I got an authentication-windows when I want to surf with the proxy, authentication not working and this errors in the log)

                                    And in /var/squid/logs/cache.log:
                                    2015/01/29 12:36:19 kid1| ipcCreate: /usr/pbi/squid-amd64/bin/: (13) Permission denied
                                    2015/01/29 12:36:19 kid1| WARNING: ntlmauthenticator #Hlpr0 exited

                                    1 Reply Last reply Reply Quote 0
                                    • G
                                      ghosterius
                                      last edited by

                                      @alex.g:

                                      Yesterday I thought the "No such file" error is solved. But today squid was not starting because of this error. Now I tried the solution from ghosterius, and the error is gone, squid is running.
                                      In the systemlog I see:
                                      Jan 29 12:19:47 pfSense22 dansguardian[60493]: NTLM - Invalid message of length 42, message was: NTLMSSP
                                      Jan 29 12:19:47 pfSense22 dansguardian[60493]: Auth plugin returned error code: -3
                                      (I got an authentication-windows when I want to surf with the proxy, authentication not working and this errors in the log)

                                      And in /var/squid/logs/cache.log:
                                      2015/01/29 12:36:19 kid1| ipcCreate: /usr/pbi/squid-amd64/bin/: (13) Permission denied
                                      2015/01/29 12:36:19 kid1| WARNING: ntlmauthenticator #Hlpr0 exited

                                      I have exactly the same behaviour, except that the error is not the same. mine says the following in cache.log:
                                      2015/01/29 11:13:29 kid1| WARNING: ntlmauthenticator #Hlpr0 exited
                                      Shared object "libpopt_samba3.so" not found, required by "ntlm_auth"

                                      What permissions do you have under /usr/pbi/squid-amd64/bin ? Also, are you using pfSense on x64 or x86? Because if it is on 32bit you should adapt that directory accordingly.

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        alex.g 0
                                        last edited by

                                        What permissions do you have under /usr/pbi/squid-amd64/bin ?

                                        rwxr-xr-x proxy proxy
                                        and same for ntlm_auth in this directory

                                        Also, are you using pfSense on x64 or x86?

                                        x64

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          alex.g 0
                                          last edited by

                                          ok, I had a silly error in my "Squid Integrations"!!!
                                          So my error is exactly the same as written by ghosterius
                                          WARNING: ntlmauthenticator #Hlpr0 exited
                                          Shared object "libpopt_samba3.so" not found, required by "ntlm_auth"

                                          1 Reply Last reply Reply Quote 0
                                          • A
                                            alex.g 0
                                            last edited by

                                            Ok, this problem is because libpopt_samba3.so and many other libs can not be found because they are in the path /usr/local/lib/samba
                                            so you should add this path to the ldconfig-path or copy/link the libraries where they could be find. But now I have the error

                                            Shared object "libintl.so.8" not found, required by "libpopt.so.0"

                                            And I cannot find libintl.so on my pfsense. So what I have to install to get this shared object?

                                            Thanks in advance
                                            Alex

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post