Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Kerberos Squid without authentication?

    Scheduled Pinned Locked Moved Cache/Proxy
    39 Posts 3 Posters 5.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      killmasta93 @mcury
      last edited by

      @mcury
      Thanks again for the reply, so im trying another machine which is in the domain but same issue

      aed2b95d-d81f-417c-b591-85de356c47f9-image.png

      32bd5b2a-74ea-4215-ab8b-4c65081e31db-image.png

      Tutorials:

      https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

      M 1 Reply Last reply Reply Quote 0
      • M
        mcury @killmasta93
        last edited by

        Did you create the user and enabled it in AD ?

        8cbf2dcb-d511-4859-a23d-79155901eca4-image.png

        dead on arrival, nowhere to be found.

        K 1 Reply Last reply Reply Quote 0
        • K
          killmasta93 @mcury
          last edited by

          @mcury
          Thanks for the reply, correct already did that
          on the Service principal name

          f9688ac1-9018-4ebd-8b50-23e2c29f4c76-image.png

          Tutorials:

          https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

          M 1 Reply Last reply Reply Quote 0
          • M
            mcury @killmasta93
            last edited by mcury

            Maybe you are facing the same problem as this guy was, take a look:

            http://squid-web-proxy-cache.1019090.n4.nabble.com/squid-kerb-auth-received-type-1-NTLM-token-td2131613.html

            Quote:
            You should see a request from the client to Active Directory asking for a TGS for HTTP/<fqdn of proxy>. If that does not happen or get refused by AD the client will fall back to NTLM (wrapped into the Negotiate response) which is waht you see on the proxy.

            I would set a packet capture like that guy did to check, port 88

            dead on arrival, nowhere to be found.

            K 1 Reply Last reply Reply Quote 0
            • K
              killmasta93 @mcury
              last edited by

              @mcury
              Finally got it to authenticate but im still getting the popup

              525feae3-d657-4d22-b5de-aa1e3611b3fd-image.png

              Tutorials:

              https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

              M 1 Reply Last reply Reply Quote 0
              • M
                mcury @killmasta93
                last edited by mcury

                Why are you authenticating as administrador@CASA.LOCAL ?
                The user should be appearing there and not administrator. Should be user@CASA.LOCAL

                The user need to be member of the group used in ldapusersearch in Squidguard

                dead on arrival, nowhere to be found.

                K 1 Reply Last reply Reply Quote 0
                • K
                  killmasta93 @mcury
                  last edited by killmasta93

                  @mcury
                  its because im opening the chrome inside of the windows server which im logged on as administrador

                  this is another user

                  68db97a0-6e2f-4ab8-b790-b01fded9a4c1-image.png

                  Tutorials:

                  https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

                  M 1 Reply Last reply Reply Quote 0
                  • M
                    mcury @killmasta93
                    last edited by

                    Ok, in this last screenshot, the username is Windows10?
                    Is this user a member of the group used in ldapusersearch?

                    You are almost there.. soon we will find the problem

                    dead on arrival, nowhere to be found.

                    K 1 Reply Last reply Reply Quote 0
                    • K
                      killmasta93 @mcury
                      last edited by

                      @mcury
                      thanks for the reply,
                      so on the squidguard

                      ldapusersearch ldap://apolo.casa.local:3268/dc=casa,dc=local?userPrincipalName?sub?(&(memberof=%2cCN=Users%2cDC=casa%2cDC=local)(userPrincipalName=%s))

                      and the user is located in

                      CN=windows10,CN=Users,DC=casa,DC=local

                      Tutorials:

                      https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

                      M 1 Reply Last reply Reply Quote 0
                      • M
                        mcury @killmasta93
                        last edited by mcury

                        ldapusersearch ldap://apolo.casa.local:3268/dc=casa,dc=local?userPrincipalName?sub?(&(memberof=%2cCN=Users%2cDC=casa%2cDC=local)(userPrincipalName=%s))

                        You used a %2c in the wrong place (It means a ',')

                        It should be:

                        ldapusersearch ldap://apolo.casa.local:3268/dc=casa,dc=local?userPrincipalName?sub?(&(memberof=CN=Users%2cDC=casa%2cDC=local)(userPrincipalName=%s))

                        It's important to notice that you are not filtering users by group in this case..
                        I would create a group, like internet, add the members to this group, and then filter like this:

                        ldapusersearch ldap://apolo.casa.local:3268/dc=casa,dc=local?userPrincipalName?sub?(&(memberof=CN=internet%2cCN=Users%2cDC=casa%2cDC=local)(userPrincipalName=%s))

                        dead on arrival, nowhere to be found.

                        K 1 Reply Last reply Reply Quote 0
                        • K
                          killmasta93 @mcury
                          last edited by

                          @mcury said in Kerberos Squid without authentication?:

                          ldapusersearch ldap://apolo.casa.local:3268/dc=casa,dc=local?userPrincipalName?sub?(&(memberof=CN=internet%2cCN=Users%2cDC=casa%2cDC=local)(userPrincipalName=%s))

                          Thanks again for the reply, so i changed to

                          ldapusersearch ldap://apolo.casa.local:3268/dc=casa,dc=local?userPrincipalName?sub?(&(memberof=CN=internet%2cCN=Users%2cDC=casa%2cDC=local)(userPrincipalName=%s))

                          then created group called internet added windows10 and administrador but same issue with popup

                          CN=internet,CN=Users,DC=casa,DC=local

                          Im thinking its a squid issue but dont know what else to do :(

                          Tutorials:

                          https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

                          M 1 Reply Last reply Reply Quote 0
                          • M
                            mcury @killmasta93
                            last edited by

                            Try port 389 instead of 3268.. Who knows..

                            dead on arrival, nowhere to be found.

                            K 1 Reply Last reply Reply Quote 0
                            • K
                              killmasta93
                              last edited by killmasta93

                              @mcury

                              Thanks for the reply,
                              so on squid i had to remove

                              http_access allow deny

                              now i got to squidguard i see this log

                              (squidGuard): ldap_search_ext_s failed: Operations error (params: dc=casa,dc=local, 2, (&(memberof=CN=internet,CN=Users,DC=casa,DC=local)(userPrincipalName=administrador)),

                              i also had to configure on squidguard
                              21f45554-d0d5-41a6-9fb8-52ef0216d7ff-image.png

                              Tutorials:

                              https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

                              M 1 Reply Last reply Reply Quote 0
                              • M
                                mcury @killmasta93
                                last edited by

                                So, is it working now ?

                                if not, I would focus on the ldapusersearch..

                                dead on arrival, nowhere to be found.

                                1 Reply Last reply Reply Quote 0
                                • K
                                  killmasta93 @mcury
                                  last edited by

                                  thanks for the reply,
                                  so correct its navigating with the user now i need to block but i see the log on squidguard

                                  12.05.2021 19:45:34	(squidGuard): ldap_search_ext_s failed: Operations error (params: DC=casa,DC=local, 2, (&(memberof=CN=internet,CN=Users,DC=casa,DC=local)(userPrincipalName=administrador)), userPrincipalName)

                                  Tutorials:

                                  https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

                                  M 1 Reply Last reply Reply Quote 0
                                  • M
                                    mcury @killmasta93
                                    last edited by mcury

                                    Try to tick that option in squidguard: Strip NT domain name.
                                    If ticking it doesn't work, undo it..

                                    dead on arrival, nowhere to be found.

                                    M 1 Reply Last reply Reply Quote 0
                                    • M
                                      mcury @mcury
                                      last edited by

                                      Test this:

                                      1 - Disable Squidguard authentication tab
                                      2 - Enable Squid authentication tab with the following details:

                                      Squid Authentication LDAP Settings > LDAP Base Domain:
                                      DC=casa,DC=local -R

                                      (-R option will enable the recursive search in domain).

                                      Note: keep the ldapusersearch the same as before, using port 3268

                                      Then try again and post here in case it works.

                                      dead on arrival, nowhere to be found.

                                      K 1 Reply Last reply Reply Quote 0
                                      • K
                                        KaP
                                        last edited by

                                        Google Chrome and other browsers from a certain version onwards (I can't say from which one) don't allow "Transparent" authentication without the Pop Up window appearing.
                                        So I don't think you will be able to accomplish what you intended.

                                        If I am wrong can you correct me please.

                                        1 Reply Last reply Reply Quote 0
                                        • K
                                          killmasta93 @mcury
                                          last edited by

                                          @mcury
                                          Thanks for the reply, so got it working, i used the pf2ad script
                                          but on ldap for squidguard how to add a group with a space the group is called domain users

                                          ldapusersearch ldap://apolo.casa.local:3268/DC=casa,DC=local?sAMAccountName?sub?(&(sAMAccountName=%s)(memberOf=CN=domain users%2cCN=Users%2cDC=casa%2cDC=local))

                                          Tutorials:

                                          https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.