Re: [squid-users] squid 2.7 on windows 2008 and ntlm authentication

Bob_P wrote:
> I have installed squid 2.7 on windows 2008 r2 server. any time I try to
> access an external site I get a credentials log in box and I'm unable to get
> past it. Eventually it errors out with "Cache Access Denied. Sorry, you are
> not currently allowed to request." Below is my squid.conf. If anyone can
> tell me what I'm doing wrong I would greatly appreciate it.
>
> Thanks
> Bob
>

Your squid.conf is very mucked up. Below are some changes you need to
make to correct it.

>
> # WELCOME TO SQUID 2.7.STABLE8
> # ----------------------------
>
> #Recommended minimum configuration:
> acl all src all
> acl manager proto cache_object
> acl localhost src 127.0.0.1/32
> acl to_localhost dst 127.0.0.0/8 0.0.0.0/32
>
> auth_param ntlm program c:/squid/libexec/mswin_ntlm_auth.exe
> auth_param ntlm children 5
>
> acl localnet proxy_auth REQUIRED src 10.0.0.0/8

The above line means that the usernames "src" and "10.0.0.0/8" are
permitted to login. As long as they present valid NTLM tokens accepted
by your mswin_ntlm_auth.exe.

What you are trying to do is this:

   acl authenticated proxy_auth REQUIRED
   acl localnet src 10.0.0.0/8

   http_access allow localnet authenticated

That should also all be down further in the config underneath the
security rule about preventing unsafe CONNECT tunnels.

>
> http_access allow localnet
>

The above line needs to be remove now.

> acl SSL_ports port 443
> acl Safe_ports port 80 # http
> acl Safe_ports port 21 # ftp
> acl Safe_ports port 443 # https
> acl Safe_ports port 70 # gopher
> acl Safe_ports port 210 # wais
> acl Safe_ports port 1025-65535 # unregistered ports
> acl Safe_ports port 280 # http-mgmt
> acl Safe_ports port 488 # gss-http
> acl Safe_ports port 591 # filemaker
> acl Safe_ports port 777 # multiling http
> acl CONNECT method CONNECT
>
> http_access allow manager localhost
> http_access deny manager
>
> # Deny requests to unknown ports
> http_access deny !Safe_ports
>
> # Deny CONNECT to other than SSL ports
> http_access deny CONNECT !SSL_ports
> http_access allow localnet
>
> #http_access deny all

Uncomment this again. It's there to make an explicit ban on non-LAN
users accessing your proxy.

After making those changes if you still are stuck on the login box you
will need to check up on the persistent connections. NTLM requires them
to be on.

Amos

-- 
Please be using
   Current Stable Squid 2.7.STABLE9 or 3.1.5