Squid+Dansguardian with Active Directory (NTLM) Single Sign On WORKING!!!
-
I had similar issues and I simply replaced the hostnames with their IPs.
-
PfSense 2.2 + squid3 + squidguard-devel integration with Active Directory
works this configuration?
can anyone help me? -
you will need a samba3 or 4 compiled on freebsd to use it.
-
Ok so tried updating to 2.2
my squid custom integretionhttp_access allow whitelist
acl_uses_indirect_client on
follow_x_forwarded_for allow localhost
auth_param ntlm program /usr/local/bin/ntlm_auth –use-cached-creds --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 10
auth_param ntlm keep_alive on
acl password proxy_auth REQUIRED
http_access allow passwordSquid will now not start because of
auth_param ntlm program /usr/local/bin/ntlm_auth --use-cached-creds --helper-protocol=squid-2.5-ntlmsspShared object "libcrypto.so.6" not found, required by "ntlm_auth" which was part of squid 2.5 isntall i believe..
Any ideas.. I take that line out and authentication fails
-
Ok so found out that samba36;samba-devel;heimdal were uninstalled..
So reinstalled samba36;samba4(this isn't samba-devel;heimdal..
Had to copy smb.conf to smb4.conf
but get an error when starting squid..
ERROR: auth_param ntlm program /usr/local/bin/ntlm_auth: (2) No such file or directory FATAL: auth_param ntlm program /usr/local/bin/ntlm_auth: (2) No such file or directory
But the directory exists..
I would think passing windows username would be this difficult.. Looked at the Squidtrust article.. but didnt look as simple as let on..
Not too concerned with someone spoofing the username..
Just need to pass it to squid…
Thx -
Thanks for this thread! Now my sso is running on pfsense 2.1.
But now 2.2 is out and I also would like to upgrade to 2.2. Anyone can help?
I have the sam problems like percyiii. Already described in my german thread https://forum.pfsense.org/index.php?topic=86972.msg477384#msg477384 and described in the squid-forum:
http://squid-web-proxy-cache.1019090.n4.nabble.com/ntlm-No-such-file-or-directory-td4669085.htmlWould be very nice to get help, if I can do anything to help, I would do it.
Greetings Alex
-
On 2.2, try install packages from freebsd repo using pkg install instead of pkg_add from my repo.
Samba 3 does not have ad options compiled but samba4 may have.
-
Ok, it looks not so bad.
Have done the complete procedure on pfsense 2.2 but with "pkg install samba4" and "pkg install heimdal".
Somewhere I had to use samba4 insted of samba.
The squid Problem with " /usr/local/bin/ntlm_auth: (2) No such file or directory" is gone. squid is running.
The Ldap-Informations about groupmembers are working. Also wbinfo -u and wbinfo -g working correct.But I don't see the domain username in the dansguardian-log. So I think sso is not functional in the moment. But one step further today.
Will have a look tomorrow again. -
pfSense 2.2 broke my squid ntlm authentication too.
installing samba4, heimdal didn't solve the "No such file or directory" problem for me. -
Ok, it looks not so bad.
Have done the complete procedure on pfsense 2.2 but with "pkg install samba4" and "pkg install heimdal".
Somewhere I had to use samba4 insted of samba.
The squid Problem with " /usr/local/bin/ntlm_auth: (2) No such file or directory" is gone. squid is running.
The Ldap-Informations about groupmembers are working. Also wbinfo -u and wbinfo -g working correct.But I don't see the domain username in the dansguardian-log. So I think sso is not functional in the moment. But one step further today.
Will have a look tomorrow again.Agreed only thing I changed after install of samba4 was copied smb.conf to smb4.conf
Ldap info there but not authenticating.. -
pfSense 2.2 broke my squid ntlm authentication too.
installing samba4, heimdal didn't solve the "No such file or directory" problem for me.You'll have to "copy" the ntlm_auth into the directory /usr/pbi/squid-amd64/bin/ and change that in the configuration accordingly. That solved the "No such file or directory" issue for me.
Now, machine is in AD, can see users and groups and what not, but the authentication prompts me for password and doesn't seem to work at all :(
-
Check cache.log may be related to winbind_privileged file permissions.
-
Yesterday I thought the "No such file" error is solved. But today squid was not starting because of this error. Now I tried the solution from ghosterius, and the error is gone, squid is running.
In the systemlog I see:
Jan 29 12:19:47 pfSense22 dansguardian[60493]: NTLM - Invalid message of length 42, message was: NTLMSSP
Jan 29 12:19:47 pfSense22 dansguardian[60493]: Auth plugin returned error code: -3
(I got an authentication-windows when I want to surf with the proxy, authentication not working and this errors in the log)And in /var/squid/logs/cache.log:
2015/01/29 12:36:19 kid1| ipcCreate: /usr/pbi/squid-amd64/bin/: (13) Permission denied
2015/01/29 12:36:19 kid1| WARNING: ntlmauthenticator #Hlpr0 exited -
Yesterday I thought the "No such file" error is solved. But today squid was not starting because of this error. Now I tried the solution from ghosterius, and the error is gone, squid is running.
In the systemlog I see:
Jan 29 12:19:47 pfSense22 dansguardian[60493]: NTLM - Invalid message of length 42, message was: NTLMSSP
Jan 29 12:19:47 pfSense22 dansguardian[60493]: Auth plugin returned error code: -3
(I got an authentication-windows when I want to surf with the proxy, authentication not working and this errors in the log)And in /var/squid/logs/cache.log:
2015/01/29 12:36:19 kid1| ipcCreate: /usr/pbi/squid-amd64/bin/: (13) Permission denied
2015/01/29 12:36:19 kid1| WARNING: ntlmauthenticator #Hlpr0 exitedI have exactly the same behaviour, except that the error is not the same. mine says the following in cache.log:
2015/01/29 11:13:29 kid1| WARNING: ntlmauthenticator #Hlpr0 exited
Shared object "libpopt_samba3.so" not found, required by "ntlm_auth"What permissions do you have under /usr/pbi/squid-amd64/bin ? Also, are you using pfSense on x64 or x86? Because if it is on 32bit you should adapt that directory accordingly.
-
What permissions do you have under /usr/pbi/squid-amd64/bin ?
rwxr-xr-x proxy proxy
and same for ntlm_auth in this directoryAlso, are you using pfSense on x64 or x86?
x64
-
ok, I had a silly error in my "Squid Integrations"!!!
So my error is exactly the same as written by ghosterius
WARNING: ntlmauthenticator #Hlpr0 exited
Shared object "libpopt_samba3.so" not found, required by "ntlm_auth" -
Ok, this problem is because libpopt_samba3.so and many other libs can not be found because they are in the path /usr/local/lib/samba
so you should add this path to the ldconfig-path or copy/link the libraries where they could be find. But now I have the errorShared object "libintl.so.8" not found, required by "libpopt.so.0"
And I cannot find libintl.so on my pfsense. So what I have to install to get this shared object?
Thanks in advance
Alex -
Again, dont know what the error was. Tody I find the libintl.so.8 and the other needed libraries. But still not working. In /var/squid/logs/cache.log:
ntlm_auth: error opening config file /usr/local/etc/smb4.conf. Error was No such file or directory
Which file or directory? /usr/local/etc/smb4.conf is there and is readable for others.
-
May be related to pbi pseudo jail build.
Are you trying to run net ads join and getting this error?
-
no marcelloc, the net ads join is working.
I try to go into Internet with the browser over the proxy. The the Browser ask me for username and password - but he doesnt accept and I see this line in the log.Yes I think its related to the pseudeo jail buid. But i dont know anything about this till now.
