Search squid archive

Re: kerberos auth failing behind a load balancer

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 2/28/2013 2:57 PM, Sean Boran wrote:
Hi,

I’ve received (kemp) load balancers to put in front of squids to
provide failover.
The failover / balancing  works fine until I enable Kerberos auth on the squid.
It seems to me like a basic LB problem since it's working on L7 and not L2.
Why do you use L7 LB and not L2 ?
it's less load less CPU etc..
you can use HAPROXY or even plain linux for that.

Eliezer


Test setup:
Browser ==> Kemp balancer     ==> Squid                          ==> Internet
                          proxy.example.com     proxy3.example.com

  The client in Windows7 in an Active Directory domain.
If the browser proxy is set to proxy3.example.com  (bypassing the LB),
Kerberos auth works just fine, but via the kemp (proxy.example.com)
the browser prompts for a username/password which is not accepted
anyway

Googling on Squid+LBs, the key is apparently to add a principal for the LB, e.g.
net ads keytab add HTTP/proxy.example.com

In the logs (below), one can see the client sending back a Krb ticket
to squid, but it rejects it:
"negotiate_wrapper: Return 'BH gss_accept_sec_context() failed:
Unspecified GSS failure.  "
When I searched on that. one user suggested changing the encryption in
/etc/krb5.conf . In /etc/krb5.conf   I tried with the recommended
squid settings (see below), and also with none at all. The results
were the same. Anyway, if encryption was the issue, it would not work,
via LB or directly.


Analysis:
-------------
When the client sent a request, squid replies with:

HTTP/1.1 407 Proxy Authentication Required
Server: squid
X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0
X-Cache: MISS from gsiproxy3.vptt.ch
Via: 1.1 gsiproxy3.vptt.ch (squid)

ok so far. the client answer with a kerberos ticket:

Proxy-Authorization: Negotiate YIIWpgYGKwYBXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

UserRequest.cc(338) authenticate: header Negotiate
YIIWpgYGKwYBXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
UserRequest.cc(360) authenticate: No connection authentication type
Config.cc(52) CreateAuthUser: header = 'Negotiate YIIWpgYGKwYBBQUCXXXX
auth_negotiate.cc(303) decode: decode Negotiate authentication
UserRequest.cc(93) valid: Validated. Auth::UserRequest '0x20d68d0'.
UserRequest.cc(51) authenticated: user not fully authenticated.
UserRequest.cc(198) authenticate: auth state negotiate none. Received
blob: 'Negotiate
YIIWpgYGKwYBBQUCoIIWmjCCFpagMDAuBgkqhkiC9xIBAXXXXXXXXXX
..
UserRequest.cc(101) module_start: credentials state is '2'
helper.cc(1407) helperStatefulDispatch: helperStatefulDispatch:
Request sent to negotiateauthenticator #1, 7740 bytes
negotiate_wrapper: Got 'YR YIIWpgYGKwYBBQXXXXXXXXXXXXXXX
negotiate_wrapper: received Kerberos token
negotiate_wrapper: Return 'BH gss_accept_sec_context() failed:
Unspecified GSS failure.  Minor code may provide more information.


Logs for a (successful) auth without LB:
      .. as above ....
      negotiate_wrapper: received Kerberos token
      negotiate_wrapper: Return 'AF oYGXXXXXXXXXXXXXXXXXXXXXXA== USER@xxxxxxxxxxx


----- configuration ---
Ubuntu 12.04 + std kerberod. Squid 3.2 bzr head from lat Jan.
- squid.conf:
- debug_options ALL,2 29,9             (to catch auth)
auth_param negotiate program
/usr/local/squid/libexec/negotiate_wrapper_auth -d --kerberos
/usr/local/squid/libexec/negotiate_kerberos_auth -s GSS_C_NO_NAME
--ntlm /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param negotiate children 20 startup=20  idle=20 auth_param
negotiate keep_alive on

- The LB is configured as a Generic Proxy (does not try to interpret
the HTTP stream), with with Layer 7 transparency
   (it forwards traffic to the squid, the squid see the real client IP,
and squid traffic is routed back though the LB)
    I've tried playing with the LB Layer 7 settings, to no avail.

Samba:
net ads join -U USER
net ads testjoin
   Join is OK

net ads keytab add HTTP -U USER
net ads keytab add HTTP/proxy.example.com  -U USER
chgrp proxy /etc/krb5.keytab
chmod 640 /etc/krb5.keytab
strings /etc/krb5.keytab           # check contents
net ads keytab list

/etc/krb5.conf
  [libdefaults]
     default_realm = EXAMPLE.NET
     kdc_timesync = 1
     ccache_type = 4
     forwardable = true
     proxiable = true
     fcc-mit-ticketflags = true
     default_keytab_name = FILE:/etc/krb5.keytab
     dns_lookup_realm = no
     ticket_lifetime = 24h

[realms]
     EXAMPLE.net = {
         kdc = ldap.EXAMPLE.net
         master_kdc = ldap.EXAMPLE.net
         admin_server = ldap.EXAMPLE.net
         default_domain = EXAMPLE.net
     }
[domain_realm]
     .corproot.net = EXAMPLE.NET
     corproot.net = EXAMPLE.NET


Any suggestions on where I could dig further?

Thanks in advance,

Sean Boran






[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux