[Samba] ntlm authentication issues

Fri Jul 31 06:46:23 UTC 2020

Not really a samba call, but it's closely related. ;-) So here you go.

I use this : 

You need this in smb.conf 
# Added for freeradius or squid proxy support
# Obligated to set on both AD-DC and Member server.
ntlm auth = mschapv2-and-ntlmv2-only 

And this or something like that, i have more working auth setups for squid, 
But i use this primarly. 

auth_param negotiate program /usr/lib/squid/negotiate_wrapper_auth \
    --kerberos /usr/lib/squid/negotiate_kerberos_auth -k /etc/squid/HTTP.keytab \
    -s HTTP/proxy1.internal.domain.tld at REALM \
    --ntlm /usr/bin/ntlm_auth --helper-protocol=gss-spnego --domain=NTDOM

Dont forget to add the HTTP spn. 
ADS KEYTAB ADD_UPDATE_ADS HTTP/proxy1.internal.domain.tld -UAdministrator
Also, A+PTR records are a must for the proxy with kerberos auth. 

And do remove from smb.conf : 
>     winbind enum users = yes
>     winbind enum groups = yes
Or set these to no. 

I use that on Debian 10 with now squid 4.12. (ssl enabled)
(since debian 8 and squid 3.x ) 
There are more options here, but start with above.

My setup does, in this order. 
Negotiated Kerberos/NTLM auth with LDAP auth as fall back.

Beside these few small point, your setup looks great. 

Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Marcio Demetrio Bacci via samba
> Verzonden: donderdag 30 juli 2020 22:41
> Aan: sambalist
> Onderwerp: [Samba] ntlm authentication issues
> 
> Hi,
> 
> I set up Squid 4.6 on Debian 10 and I'm having problems with browser
> authentication on a Windows station.
> 
> I did the tests on the command line and apparently it's OK.
> 
> root at proxy:/etc/squid/acls# /usr/bin/ntlm_auth
> --helper-protocol=squid-2.5-basic
> Registered MSG_REQ_POOL_USAGE
> Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED
> lp_load_ex: refreshing parameters
> Initialising global parameters
> rlimit_max: increasing rlimit_max (1024) to minimum Windows 
> limit (16384)
> Processing section "[global]"
> EMPRESA+mane XXXXX
> NT_STATUS_OK: The operation completed successfully. (0x0)
> OK
> 
> Here are my configuration files:
> 
> #/ETC/SAMBA/SMB.CONF
> [global]
>     netbios name = PROXY
>     workgroup = EMPRESA
>     security = ADS
>     realm = EMPRESA.COM.BR
>     encrypt passwords = yes
>     username map = /etc/samba/user.map
> 
>     log file = /var/log/samba/%m.log
>     log level = 3 passdb:5 auth:5
> 
>     idmap config * : backend = tdb
>     idmap config * : range = 3000-7999
> 
>     idmap config EMPRESA:backend = ad
>     idmap config EMPRESA:schema_mode = rfc2307
>     idmap config EMPRESA:range = 10000-999999
>     idmap config EMPRESA:unix_nss_info = yes
>     idmap config EMPRESA:unix_primary_group = yes
> 
>     winbind refresh tickets = Yes
>     winbind use default domain = yes
>     winbind separator = +
>     winbind enum users = yes
>     winbind enum groups = yes
> 
>     vfs objects = acl_xattr
>     map acl inherit = yes
>     store dos attributes = yes
> 
>     template shell = /bin/bash
>     template homedir = /home/%U
> 
>     dedicated keytab file = /etc/krb5.keytab
>     kerberos method = secrets and keytab
> 
>     load printers = no
>     printing = bsd
>     printcap name = /dev/null
>     disable spoolss = yes
> 
> 
> #ETC/NSSWITCH.CONF
> # /etc/nsswitch.conf
> #
> # Example configuration of GNU Name Service Switch functionality.
> # If you have the `glibc-doc-reference' and `info' packages 
> installed, try:
> # `info libc "Name Service Switch"' for information about this file.
> 
> passwd:         compat winbind
> group:          compat winbind
> shadow:         compat
> gshadow:        files
> 
> hosts:          files dns
> networks:       files
> 
> protocols:      db files
> services:       db files
> ethers:         db files
> rpc:            db files
> 
> netgroup:       nis
> 
> 
> #/ETC/KRB5.CONF
> [libdefaults]
>     dns_lookup_realm = false
>     dns_lookup_kdc = true
>     default_realm = EMPRESA.COM.BR
> 
> 
> #/ETC/SQUID/SQUID.CONF
> 
> http_port 3128
> 
> cache_mem 512 MB
> cache_swap_low 80
> cache_swap_high 90
> 
> maximum_object_size 512 MB
> minimum_object_size 0 KB
> 
> maximum_object_size_in_memory 4096 KB
> 
> cache_replacement_policy heap LFUDA
> memory_replacement_policy heap LFUDA
> 
> quick_abort_min -1 KB
> 
> detect_broken_pconn on
> 
> fqdncache_size 1024
> 
> refresh_pattern ^ftp: 1440 20% 10080
> refresh_pattern ^gopher: 1440 0% 1440
> refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
> refresh_pattern . 0 20% 4320
> 
> access_log /var/log/squid/access.log
> cache_log /var/log/squid/cache.log
> 
> cache_dir aufs /var/spool/squid 600 16 256
> 
> auth_param ntlm program /usr/bin/ntlm_auth 
> --helper-protocol=squid-2.5-basic
> auth_param ntlm children 20 startup=0 idle=1
> auth_param ntlm keep_alive on
> 
> visible_hostname "Monitoramento de Acesso à Internet"
> ### acls
> #acl manager proto cache_object
> acl localhost src 192.168.1.17/32
> acl to_localhost dst 192.168.1.17/32
> acl SSL_ports port 22 80 3456 443 563 587 993 2811 3001 3322 
> 7071 8443 9191
> 10000 23000
> acl Safe_ports port 21 # ftp
> acl Safe_ports port 70 # gopher
> acl Safe_ports port 80 # http
> acl Safe_ports port 88 # kerberos
> acl Safe_ports port 123 # ntp
> acl Safe_ports port 210 # wais
> acl Safe_ports port 280 # http-mgmt
> acl Safe_ports port 3456 # Siafi
> acl Safe_ports port 389 # ldap
> acl Safe_ports port 443 # https
> acl Safe_ports port 488 # gss-http
> acl Safe_ports port 563 # snews
> acl Safe_ports port 591 # filemaker
> acl Safe_ports port 777 # multiling http
> acl Safe_ports port 3001         # imprenssa nacional
> acl Safe_ports port 8080 # http
> acl Safe_ports port 8443 # http
> acl Safe_ports port 1025-65535 # unregistered ports
> 
> acl purge method PURGE
> acl CONNECT method CONNECT
> 
> # ---- Windows Update ----
> acl microsoft url_regex "/etc/squid/acls/ms-update"
> acl atualizacoes dstdomain microsoft.com
> http_access allow microsoft
> http_access allow atualizacoes
> 
> http_access allow localhost
> http_access allow purge localhost
> http_access deny purge
> http_access deny !Safe_ports
> http_access deny CONNECT !SSL_ports
> 
> acl autenticados proxy_auth REQUIRED
> http_access deny !autenticados
> 
> acl sites_liberados url_regex -i "/etc/squid/acls/sites-permitidos"
> http_access allow sites_liberados
> 
> acl extensoes_bloqueadas url_regex -i 
> "/etc/squid/acls/extensoes-proibidas"
> http_access deny extensoes_bloqueadas
> 
> ### Bloqueia sites por URL
> acl sites_bloqueados url_regex -i "/etc/squid/acls/sites-proibidos"
> http_access deny sites_bloqueados
> 
> ### Rede LAN #####
> acl rede_usuarios src 192.168.0.0/24
> 
> http_access allow rede_usuarios
> acl extensoes_bloqueadas url_regex -i 
> "/etc/squid/acls/extensoes-proibidas"
> acl sites_liberados url_regex -i "/etc/squid/acls/sites-permitidos"
> http_access allow sites_liberados
> http_access deny extensoes_bloqueadas
> http_access allow autenticados
> http_access deny all
> 
> error_directory /usr/share/squid/errors/pt-br
> 
> coredump_dir /var/spool/squid
> 
> Can anybody help me?
> 
> Regards,
> 
> Márcio Bacci
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
> 