Добрый день! Люди добрый помогите, не работает авторизация через kerberos. Имеется контроллер домена на samba4(Zentyal3.4). Настроил авторизацию через kerberos.
Конфиг сквида такой:
http_port 0.0.0.0:3128
# END_TAG # visible_hostname (frontal)dc.16sp.loc
coredump_dir /var/spool/squid3
cache_effective_user proxy
cache_effective_group proxy
access_log /var/log/squid3/access.log squid
cache_log /var/log/squid3/cache.log
cache_store_log /var/log/squid3/store.log pid_filename /var/run/squid3.pid cache_peer localhost parent 3129 0 no-query proxy-only login=*:nopassword auth_param negotiate program /usr/lib/squid3/negotiate_kerberos_auth -i -s HTTP/dc.16sp.loc@16SP.LOC
auth_param negotiate children 10
auth_param negotiate keep_alive on
acl_uses_indirect_client on
acl authorized proxy_auth REQUIRED acl from_localhost src 127.0.0.0/8 ::1
acl to_localhost dst 127.0.0.0/8 ::1 acl fltr1~df~dmn1 dstdomain .vk.com http_access allow to_localhost
follow_x_forwarded_for allow from_localhost
http_access allow from_localhost
forwarded_for on
log_uses_indirect_client on
always_direct allow to_localhost # force clients to use squid-external
never_direct allow all ##
## ACLs from model rules
##
acl longAcl~1 proxy_auth 123@16SP.LOC admin@16SP.LOC
##
## Access
## http_access deny longAcl~1 fltr1~df~dmn1
http_access allow longAcl~1 ##
## Default policy
##
# All acces denied by default if no other allow rule matchs
http_access deny all
# reply access allowed if not denied before
http_reply_access allow allcat /etc/squid3/squid.conf
В браузере в настройках прокси пишу dc.16sp.loc, открываю любую страницу и получаю ошибку cache acces denied
В логах сквида пишет:
2014/07/18 09:43:00| negotiate_kerberos_auth: INFO: User not authenticated
2014/07/18 09:43:00| ERROR: Negotiate Authentication validating user. Error returned 'BH gss_acquire_cred() failed: Unspecified GSS failure. Minor code may provide more information. '
2014/07/18 09:43:01| negotiate_kerberos_auth: INFO: User not authenticated
2014/07/18 09:43:01| ERROR: Negotiate Authentication validating user. Error returned 'BH gss_acquire_cred() failed: Unspecified GSS failure. Minor code may provide more information. '
cat /var/log/squid3/cache.log
1405666154.089 93 192.168.1.112 TCP_DENIED/407 23691 POST http://wi2geo.mobile.yandex.net/getlocation - HIER_NONE/- text/html[br]
1405666154.112 1 192.168.1.112 TCP_DENIED/407 26050 POST http://wi2geo.mobile.yandex.net/getlocation - HIER_NONE/- text/html[br]cat /var/log/squid3/access.log
В чем может проблема? Время на сервере и на виндовой машине одинаковые. Issued Expires Principal
Jul 18 11:29:04 2014 Jul 18 21:29:02 2014 krbtgt/16SP.LOC@16SP.LOC
Керберос вроде бы билеты получает:
root@dc:/# kinit 123
123@16SP.LOC's Password:
root@dc:/# klist
Credentials cache: FILE:/tmp/krb5cc_0
Principal: 123@16SP.LOC
