При организации прокси сервера с авторизацией в Active Directory руководствуясь ресурсом http://www.lissyara.su/?id=1375 все-таки возникли проблемы, не решившиеся гуглением и поиском по опеннету.
FreeBSD 7.2-release, Squid 3.0.19, Samba 3.0.37,1
1) не проходит NTLM аутентификация доменных пользователей в Squid, даже если п. 2 не имеет места случиться, НО
на команду
Код: Выделить всё
ntlm_auth --helper-protocol=squid-2.5-basic --require-membership-of="kolos\www" -d10 -I /tmp2) периодически пропадает связь с доменом:
Работает kinit, но работает судя по всему он один
Код: Выделить всё
[root@GW /]# wbinfo -p
Ping to winbindd succeeded on fd 4
[root@GW /]# wbinfo -g
Error looking up domain groups
[root@GW /]# wbinfo -u
Error looking up domain users
[root@GW /]# wbinfo -a oP%my_pass
plaintext password authentication failed
error code was NT_STATUS_ACCESS_DENIED (0xc0000022)
error messsage was: Access denied
Could not authenticate user oP%my_pass with plaintext password
challenge/response password authentication failed
error code was NT_STATUS_ACCESS_DENIED (0xc0000022)
error messsage was: Access denied
Could not authenticate user oP with challenge/response
Конфиги:
smb.conf
Код: Выделить всё
[root@GW /]# more /usr/local/etc/smb.conf
[global]
workgroup = KOLOS
security = ADS
password server = KOLOS.LOCAL
realm = KOLOS.LOCAL
netbios name = SQUID
server string = Proxy server of kolos.local
log level = 10
log file = /var/log/samba/%m.%U.log
max log size = 50000
winbind uid = 10000-20000
winbind gid = 10000-20000
winbind use default domain = yes
display charset = koi8-r
unix charset = koi8-r
dos charset = 866
template homedir = /usr/home/%D/%U
template shell=/bin/csh
[printers]
comment = All Printers
path = /var/spool/samba
printable = Yes
browseable = No
use client driver = yes
public = No
Код: Выделить всё
[root@GW /]# more /etc/krb5.conf
[libdefaults]
default_realm = KOLOS.LOCAL
[realms]
KOLOS.LOCAL = {
kdc = AD.KOLOS.LOCAL
admin_server = AD.KOLOS.LOCAL
}
[domain_realm]
.kolos.local = KOLOS.LOCAL
[logging]
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmin.log
default = FILE:/var/log/krb5lib.log
Код: Выделить всё
[root@GW /]# more /etc/nsswitch.conf
group: files winbind
passwd: files winbind
group_compat: nis
passwd_compat: nis
hosts: files dns
networks: files
shells: files
Код: Выделить всё
auth_param ntlm program /usr/local/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 40
auth_param basic program /usr/local/bin/ntlm_auth --helper-protocol=squid-2.5-basic
auth_param basic children 9
auth_param basic realm Proxy server of kolos.local
auth_param basic credentialsttl 2 hours
external_acl_type ntgroup %LOGIN /usr/local/libexec/squid/wbinfo_group.pl
acl KOLOS proxy_auth REQUIRED
acl www external ntgroup www
acl icq external ntgroup icq
acl allowwww external ntgroup allowww
acl net src 10.0.0.0/255.255.255.0
http_access allow KOLOS mydomain_site
http_access allow allowwww net
http_access deny bad_url
http_access deny deny_domains
http_access allow www net
log.winbindd-dc-connect
Код: Выделить всё
[2009/10/27 13:14:44, 1] libads/cldap.c:recv_cldap_netlogon(219)
no reply received to cldap netlogonКод: Выделить всё
[2009/10/27 14:09:30, 1] nsswitch/winbindd_ads.c:ads_cached_connection(128)
ads_connect for domain KOLOS failed: Clients credentials have been revoked
[2009/10/27 14:17:00, 0] libsmb/nmblib.c:send_udp(793)
Packet send failed to 10.0.0.255(137) ERRNO=Permission denied
[2009/10/27 14:17:00, 0] libsmb/nmblib.c:send_udp(793)
Packet send failed to 192.168.6.255(137) ERRNO=Permission denied
[2009/10/27 14:17:00, 0] libsmb/nmblib.c:send_udp(793)
Packet send failed to 10.0.0.255(137) ERRNO=Permission denied
[2009/10/27 14:17:00, 0] libsmb/nmblib.c:send_udp(793)
Packet send failed to 192.168.6.255(137) ERRNO=Permission denied
[2009/10/27 14:17:00, 0] libsmb/nmblib.c:send_udp(793)
Packet send failed to 10.0.0.255(137) ERRNO=Permission denied
[2009/10/27 14:17:00, 0] libsmb/nmblib.c:send_udp(793)
Packet send failed to 192.168.6.255(137) ERRNO=Permission denied
[2009/10/27 14:17:00, 0] libsmb/nmblib.c:send_udp(793)
Packet send failed to 10.0.0.255(137) ERRNO=Permission denied
[2009/10/27 14:17:00, 0] libsmb/nmblib.c:send_udp(793)
Packet send failed to 192.168.6.255(137) ERRNO=Permission denied
[2009/10/27 14:17:00, 0] libsmb/nmblib.c:send_udp(793)
Packet send failed to 10.0.0.255(137) ERRNO=Permission denied
[2009/10/27 14:17:00, 0] libsmb/nmblib.c:send_udp(793)
Packet send failed to 192.168.6.255(137) ERRNO=Permission denied
[2009/10/27 14:27:28, 0] libads/kerberos.c:ads_kinit_password(228)
kerberos_kinit_password SQUID$@KOLOS.LOCAL failed: Clients credentials have been revoked
[2009/10/27 14:27:28, 1] nsswitch/winbindd_ads.c:ads_cached_connection(128)
ads_connect for domain KOLOS failed: Clients credentials have been revoked
[2009/10/27 14:32:30, 0] libads/kerberos.c:ads_kinit_password(228)
kerberos_kinit_password SQUID$@KOLOS.LOCAL failed: Clients credentials have been revoked
[2009/10/27 14:32:30, 1] nsswitch/winbindd_ads.c:ads_cached_connection(128)
ads_connect for domain KOLOS failed: Clients credentials have been revoked
[2009/10/27 14:47:33, 0] libads/kerberos.c:ads_kinit_password(228)
kerberos_kinit_password SQUID$@KOLOS.LOCAL failed: Clients credentials have been revoked
[2009/10/27 14:47:33, 1] nsswitch/winbindd_ads.c:ads_cached_connection(128)
ads_connect for domain KOLOS failed: Clients credentials have been revoked
[2009/10/27 14:53:30, 0] libads/kerberos.c:ads_kinit_password(228)
kerberos_kinit_password SQUID$@KOLOS.LOCAL failed: Clients credentials have been revoked
[2009/10/27 14:53:30, 1] nsswitch/winbindd_ads.c:ads_cached_connection(128)
ads_connect for domain KOLOS failed: Clients credentials have been revoked
[2009/10/27 15:03:30, 0] libads/kerberos.c:ads_kinit_password(228)
kerberos_kinit_password SQUID$@KOLOS.LOCAL failed: Clients credentials have been revoked
[2009/10/27 15:03:30, 1] nsswitch/winbindd_ads.c:ads_cached_connection(128)
ads_connect for domain KOLOS failed: Clients credentials have been revoked
[2009/10/27 15:08:33, 0] libads/kerberos.c:ads_kinit_password(228)
kerberos_kinit_password SQUID$@KOLOS.LOCAL failed: Clients credentials have been revoked
[2009/10/27 15:08:33, 1] nsswitch/winbindd_ads.c:ads_cached_connection(128)
ads_connect for domain KOLOS failed: Clients credentials have been revoked
