Name | Last modified | Size | Description | |
---|---|---|---|---|
Parent Directory | - | |||
md4.h | 2002-06-23 07:28 | 71 | ||
smbencrypt.h | 2002-06-23 07:28 | 235 | ||
usersfile.h | 2002-06-19 18:54 | 259 | ||
valid.h | 2001-01-07 18:36 | 278 | ||
smbdes.h | 2002-06-23 07:28 | 290 | ||
msntauth.h | 2002-06-23 07:28 | 372 | ||
msntauth.conf.default | 2002-06-26 14:44 | 421 | ||
msntauth-v2.0.lsm | 2002-04-11 15:14 | 488 | ||
valid.c | 2002-06-23 07:28 | 929 | ||
allowusers.c | 2011-03-26 19:39 | 1.0K | ||
rfcnb-io.h | 2001-01-07 18:36 | 1.0K | ||
rfcnb-common.h | 2001-01-07 18:36 | 1.1K | ||
std-includes.h | 2001-01-07 18:36 | 1.2K | ||
std-defines.h | 2001-01-07 18:36 | 1.2K | ||
Makefile.am | 2005-05-17 12:56 | 1.3K | ||
rfcnb.h | 2002-06-23 07:28 | 1.5K | ||
rfcnb-util.h | 2001-01-07 18:36 | 1.5K | ||
rfcnb-error.h | 2002-06-23 07:28 | 2.3K | ||
denyusers.c | 2011-03-26 19:39 | 2.5K | ||
byteorder.h | 2001-01-07 18:36 | 3.0K | ||
smblib.h | 2005-10-23 11:20 | 3.1K | ||
msntauth.c | 2002-08-12 12:58 | 3.8K | ||
rfcnb-priv.h | 2001-01-07 18:36 | 3.9K | ||
usersfile.c | 2005-05-17 12:56 | 4.4K | ||
md4.c | 2002-06-23 07:28 | 4.6K | ||
smbencrypt.c | 2005-05-17 12:56 | 4.7K | ||
smblib-common.h | 2001-01-07 18:36 | 6.4K | ||
confload.c | 2011-03-26 19:39 | 6.7K | ||
session.c | 2002-06-23 07:28 | 8.0K | ||
smbdes.c | 2002-06-23 07:28 | 8.9K | ||
rfcnb-io.c | 2002-06-23 07:28 | 9.1K | ||
rfcnb-util.c | 2005-05-17 12:56 | 12K | ||
smblib.c | 2005-10-23 11:20 | 13K | ||
smblib-util.c | 2005-05-17 12:56 | 15K | ||
COPYING-2.0 | 2001-01-07 18:36 | 18K | ||
Makefile.in | 2010-12-02 02:31 | 20K | ||
smblib-priv.h | 2002-06-23 07:28 | 26K | ||
This is an authentication module for the Squid proxy server to use an NT domain server.
It originates from the Samba and SMB packages by Andrew Tridgell and Richard Sharpe. It is sourced from the Pike authentication module by William Welliver (hwellive@intersil.com), and the SMB 1.0.1 libraries. Releases up to version 2.0.3 were created by Antonino Iannella (antonino@rager.com.au, http://stellarx.tripod.com). The module is now distributed with Squid, and is maintained by the Squid proxy team as an Open Source effort. Msntauth is released under the GNU General Public License.
Usage is simple. It accepts a username and password on standard input. It will return OK if the username/password is valid for the domain, or ERR if there was some problem. Check syslog messages for reported problems.
Msntauth works in environments with NT domain controllers on
Windows (TM) NT 4, 2000, and Samba.
Msntauth will be compiled when you compile Squid, using
their autoconf system.
Refer to Squid documentation for details.
If the build is suitable, you can skip this section.
Alternatively, a supplementary makefile is also provided for manual compiling.
Review Makefile.MSNT, and modify it based on the target platform or
site requirements.
Make any necessary changes to the source code.
Copy Makefile.MSNT to Makefile.
Type 'make', then 'make install', then 'make clean'.
To avoid using the makefile, it may compile with
gcc -O2 -s -o msntauth *.c
'Make install' will put 'msntauth' into
/usr/local/squid/bin.
The Makefile uses your C compiler (usually GCC), assuming it's in your PATH.
Msntauth is known to compile properly on Linux, FreeBSD, and Solaris.
When compiling under Solaris, link to the NSL and socket libraries.
In the Makefile, enable the alternative CFLAGS line for Solaris.
Ensure /usr/ccs/bin is in your PATH.
In Smbencrypt.c, '#include
For Digital Unix/Tru64, review the INSTALL line in the makefile.
The install-bsd command is used to place files in their target location.
Msntauth uses a configuration file, usually
/usr/local/squid/etc/msntauth.conf.
To change this, edit the following line in confload.c -
An example configuration file is provided -
All comments start with '#'.
NT servers are used to query user accounts. The 'server' lines
are used for this, with the PDC, BDC, and NT domain as parameters.
Up to 5 servers/domains can be queried. If this is not enough,
modify the MAXSERVERS define in confload.c.
At least one server must be specified, or msntauth will not start.
Server names must be resolvable by the system. If not, msntauth
reports an error. If you can't ping it, you might have a host
resolution problem.
The name you specify is used in the NetBIOS protocol when
communicating with the target server.
The name must be resolvable by the local system, and it must be a
name that the target server uses.
You cannot simply invent a hostname.
You cannot use it IP address.
When a user provides a username/password, each of these
servers will be queried to authenticate the username.
It stops after a user has been successfully authenticated,
so it makes sense to specify the most commonly queried
server first. Make sure the servers can be reached and
are active, or else msntauth will report failures.
The 'denyusers' and 'allowusers' lines give the absolute path
to files of user accounts. They can be used to deny or allow
access to the proxy. Remove these directives if you
do not need these features.
Users who are not allowed to access the web proxy can be added to
the denied user list. This list is read around every minute, or when
the msntauth process receives a SIGHUP signal.
The denied user file is set using the 'denyusers' directive
in msntauth.conf. The denied user file
contains a list of usernames, one per line.
If the file does not exist, no users are denied.
The file must be readable by the web proxy user.
Msntauth will send syslog messages if a user was denied,
at LOG_USER facility. Check your syslog messages for clues.
Similar to denying users, you can allow users to access the proxy
by username. This is useful if only a number of people are
allowed to use a proxy.
The allowed user file is set using the 'allowusers' directive
in msntauth.conf.
If the file does not exist or if empty, all users are allowed.
You could make use of the SHOWMBRS tool in Microsoft Technet.
This gives you a list of users which are in a particular
NT Domain Group. This list can be made into the allowed users
file using sed or awk.
Some other rules -
Refer to Squid documentation for the required changes to squid.conf.
You will need to set the following lines to enable authentication for
your access list -
You will also need to review the following directives. The number of
msntauth children spawned is set with authenticate_children.
The number of children needed is site-dependent, so some
experimentation may be required to find the best number.
There should be no visible delay in performance with Squid once
msntauth is in use. As an example, a firm with 1500 users and a T1
internet connection required a value of 30.
I strongly urge that Msntauth is tested prior to being used in a
production environment. It may behave differently on different platforms.
To test it, run it from the command line. Enter username and password
pairs separated by a space.
It should behave in the following way -
If the above didn't work as expected, you may need to modify the main()
function in msntauth.c. Inform the Squid maintainers of any problems.
Usernames cannot have whitespace in them, but passwords can.
As of version 2.0.3, the msntauth version can be found in the executable.
Type this to retrieve it -
Refer to the Squid website at http://www.squid-cache.org.
Submit problems or fixes using their Bugzilla facility.
For an unknown username, Msntauth returns OK.
This is because the PDC returns guest access for unknown users,
even if guest access is disabled.
This problem was reported by Mr Vadim Popov (vap@iilsr.minsk.by).
The tested environment consisted of PDC on Windows NT 4, SP 6.
Squid 2.3 and Msntauth was tested on SuSe, RedHat, and Debian Linux.
A fix was provided in case you have this problem.
Apply the provided patch before compiling, using
The following sequence of changes have been made to improve msntauth.
A future improvement may be to cache accepted usernames and passwords,
to reduce network authentication traffic, and improve the Squid response time.
Installation
Issues when compiling
Configuration file
#define CONFIGFILE "/usr/local/squid/etc/msntauth.conf"
# Sample MSNT authenticator configuration file
# Antonino Iannella, Stellar-X Pty Ltd
# Tue Aug 26 17:26:59 GMT+9 2003
# NT domain hosts. Best to put the hostnames in /etc/hosts.
server myPDC myBDC myNTdomain
server otherPDC otherBDC otherdomain
# Denied and allowed users. Comment these if not needed.
denyusers /usr/local/squid/etc/denyusers
allowusers /usr/local/squid/etc/allowusers
Denying users
Allowing users
Squid.conf changes
acl yourACL proxy_auth REQUIRED
http_access allow password
http_access allow yourACL
http_access deny all
proxy_auth_realm enterprise web gateway
authenticate_program /usr/local/squid/bin/msntauth
authenticate_ttl 5
authenticate_children 20
Testing
- Press ENTER to get an OK or ERR message.
- Make sure pressing CTRL-D behaves the same as a carriage return.
- Make sure pressing CTRL-C aborts the program.
- Test that entering no details does not result in an OK or ERR message.
- Test that entering an invalid username and password results in
an ERR message. Note that if NT guest user access is allowed on
the PDC, an OK message may be returned instead of ERR.
- Test that entering an valid username and password results in an OK message.
Try usernames which are and aren't in the denied/allowed user files,
if they're in use.
- Test that entering a guest username and password returns the correct response.
strings msntauth | grep -i msntauth
Support details
Unknown username issue
patch smblib.c < smblib.c.patch
Revision history