[Samba] Enhancing NTLM Authentication to Remote Site Active Directory server

Oguz Yilmaz oguzyilmazlist at gmail.com
Tue Nov 1 03:56:39 MDT 2011


Hi,

We use NLTM Authentication with Squid is some setups.On those setup,
local machine joins active directory and squid ntlm_auth helper
authenticate through local samba service. Users transparently
authenticate through NTLM authentication handshake on HTTP without
entering any password in their browser.

However, in some cases, branch offices has no local active directory
server. Branch office is connected to the headquarters through a IPSEC
vpn. I can make branch office samba to join to the headquarter active
directory domain and set NTLM authentication on Squid up correctly.

This setup has a weakness inherited from high latency, packet loss
ofsome other things that I dont know about samba. 3-4 times in a
dayusers get prompted with user name password authentication popup
ontheir browser. Sometimes this recovered naturally in a few
minutes.However, it requires rejoining to the domain in come cases.
(wbinfo -tgives error and wbinfo -l can not list users).

I have made some tunings in samba:
  getwd cache = yes
  winbind cache time = 3000
  ldap connection timeout = 10
  ldap timeout = 120

Which other tunings can I do on samba and squid? I need your experiences.

Best Regards,


squid.conf:

auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 20
auth_param ntlm keep_alive off

auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
auth_param basic children 20
auth_param basic realm Squid AD Auth
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off



/etc/samba/smb.conf:

[global]
  netbios name = SQUID
  realm = MY.DOM
  workgroup = my.dom
  security = ads
  encrypt passwords = yes
  password server = 172.16.5.10
  log level = 3
  log file = /var/log/samba.log
  ldap ssl = no
  idmap uid = 10000-20000
  idmap gid = 10000-20000

  winbind separator = /
  winbind enum users = yes
  winbind enum groups = yes
  winbind use default domain = yes

  domain master = no
  local master = no
  preferred master = no

  template shell = /sbin/nologin

  getwd cache = yes
  winbind cache time = 3000
  ldap connection timeout = 10
  ldap timeout = 120



/etc/krb5.conf:

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = MY.DOM
 default_tkt_enctypes = rc4-hmac des-cbc-crc
 default_tgs_enctypes = rc4-hmac des-cbc-crc
# dns_lookup_realm = false
# dns_lookup_kdc = false

 dns_lookup_realm = false
 dns_lookup_kdc = false
[realms]
 MY.DOM = {
 kdc = 172.16.5.10
 admin_server = 172.16.5.10
 default_domain = MY.DOM
 }

[domain_realm]
 .ronesans.hol = MY.DOM
 ronesans.hol = MY.DOM


More information about the samba mailing list