[squid-users] Re: User Authentication to parent proxy question

I forgot to say that I used 2.7 Stable 9

Markus

"Markus Moeller" <huaraz_at_moeller.plus.com> wrote in message
news:i3s86d$chg$1_at_dough.gmane.org...
>I tried the following simple configuration for the child proxy:
>
> acl all src all
> acl manager proto cache_object
> acl localhost src 127.0.0.1/32
> acl to_localhost dst 127.0.0.0/8 0.0.0.0/32
> acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
> acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
> acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
> acl SSL_ports port 443
> acl Safe_ports port 80 # http
> acl Safe_ports port 21 # ftp
> acl Safe_ports port 443 # https
> acl Safe_ports port 70 # gopher
> acl Safe_ports port 210 # wais
> acl Safe_ports port 1025-65535 # unregistered ports
> acl Safe_ports port 280 # http-mgmt
> acl Safe_ports port 488 # gss-http
> acl Safe_ports port 591 # filemaker
> acl Safe_ports port 777 # multiling http
> acl CONNECT method CONNECT
> http_access allow manager localhost
> http_access deny manager
> http_access deny !Safe_ports
> http_access deny CONNECT !SSL_ports
> http_access allow localnet
> http_access allow all
> http_access deny all
> icp_access allow localnet
> icp_access deny all
> http_port 3128
>
> cache_peer parent.company.com parent 8080 0 no-digest proxy-only no-query
> connection-auth=on http11 login=PASS
>
> hierarchy_stoplist cgi-bin ?
> access_log /var/log/squid/access.log squid
> debug_options ALL,9
> refresh_pattern ^ftp: 1440 20% 10080
> refresh_pattern ^gopher: 1440 0% 1440
> refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
> refresh_pattern . 0 20% 4320
> acl shoutcast rep_header X-HTTP09-First-Line ^ICY.[0-9]
> upgrade_http0.9 deny shoutcast
> acl apache rep_header Server ^Apache
> broken_vary_encoding allow apache
> cache_effective_user squid
> cache_effective_group nogroup
> coredump_dir /var/cache/squid
>
>
> and I see the following behaviour for NTLM
>
> Client -> child-proxy GET http://www.google.com HTTP/1.0
> Child-proxy -> parent-proxy GET http://www.google.com HTTP/1.0
> Parent-proxy -> child-proxy 407 Proxy-Authenticate: Negotiate ;
> Proxy-Authenticate: NTLM
> Child-proxy -> client 407 Proxy-Authenticate: Negotiate ; 407
> Proxy-Authenticate: NTLM ; connection: close
>
> Client -> child-proxy GET http://www.google.com HTTP/1.0 ;
> Proxy-Authorization NTLMSSP_NEGOTIATE
> Child-proxy -> parent-proxy GET http://www.google.com HTTP/1.0 ;
> Proxy-Authorization NTLMSSP_NEGOTIATE ; Proxy-connection: keep-alive
> Parent-proxy -> child-proxy 407 Proxy-Authenticate: NTLMSSP_CHALLENGE
> ; Proxy-connection: keep-alive
> Child-proxy -> client 407 Proxy-Authenticate: NTLMSSP_CHALLENGE
> ; connection: close
>
> Client -> child-proxy GET http://www.google.com HTTP/1.0 ;
> Proxy-Authorization NTLMSSP_AUTH; Proxy-connection: keep-alive
> Child-proxy -> client TCP RESET
>
> Why does the proxy reset the connection ? I could not see any obvious in
> the log (even with full debug)
>
> Thank you
> Markus
>
> "Markus Moeller" <huaraz_at_moeller.plus.com> wrote in message
> news:i2a6q1$caj$1_at_dough.gmane.org...
>> Hi,
>>
>> If I have a parent proxy which requires NTLM or Kerberos user
>> authentication can I use login=PASS to do that ?
>>
>> e.g.
>>
>> cache_peer parent.foo.net parent 3128 3130 proxy-only default
>> login=PASS
>>
>> Is it also possible that the child does not authenticate the user but
>> just hands the authentication through to the parent ?
>>
>> Thank you
>> Markus
>>
>>
>
>
>
Received on Tue Aug 10 2010 - 19:19:48 MDT