Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I need some advice with an error i am getting when trying to start Squid which has integrated NTLM / AD auth setup.

heres the back story:

I've followed this guide word for word on the setup, installation and config of the server. So far everything has gone smoothly and i feel like i'm minutes away from getting this system running.

I am able to-do

Wbinfo -a administrator
kinit Administrator
klist

each command gives a confirmation that it ran successfully and worked as expected.

The Linux box has successfully joined my domain and i can do AD lookup's on users and groups.

however when i attempt to startup the squid service i get the following from the CLI.

[root@squid ~]# service squid start
Starting squid: .                                          [  OK  ]

But then get connection errors from my browser saying the proxy refused the connection, further investigation inside the /var/log/squid/cache.log for squid shows the following error.

2013/07/31 09:57:30| StatefulHandleRead: no callback data registered
2013/07/31 09:57:30| helperHandleRead: unexpected read from basicauthenticator #2, 28 bytes 'NT_STATUS_OK: Success (0x0)
'
2013/07/31 09:57:30| helperHandleRead: unexpected read from basicauthenticator #3, 28 bytes 'NT_STATUS_OK: Success (0x0)
'
2013/07/31 09:57:30| helperHandleRead: unexpected read from basicauthenticator #4, 28 bytes 'NT_STATUS_OK: Success (0x0)
'
2013/07/31 09:57:30| helperHandleRead: unexpected read from basicauthenticator #5, 28 bytes 'NT_STATUS_OK: Success (0x0)
'
2013/07/31 09:57:30| WARNING: ntlmauthenticator #3 (FD 13) exited
2013/07/31 09:57:30| WARNING: ntlmauthenticator #1 (FD 9) exited
2013/07/31 09:57:30| WARNING: ntlmauthenticator #2 (FD 11) exited
2013/07/31 09:57:30| Too few ntlmauthenticator processes are running
2013/07/31 09:57:30| storeDirWriteCleanLogs: Starting...
2013/07/31 09:57:30|   Finished.  Wrote 0 entries.
2013/07/31 09:57:30|   Took 0.00 seconds (  0.00 entries/sec).
FATAL: The ntlmauthenticator helpers are crashing too rapidly, need help!

Squid Cache (Version 3.1.10): Terminated abnormally.
CPU Usage: 0.143 seconds = 0.038 user + 0.105 sys
Maximum Resident Size: 35040 KB
Page faults with physical i/o: 0
Memory usage for squid via mallinfo():
        total space in arena:    2788 KB
        Ordinary blocks:         2757 KB     13 blks
        Small blocks:               0 KB      0 blks
        Holding blocks:          1012 KB      4 blks
        Free Small blocks:          0 KB
        Free Ordinary blocks:      30 KB
        Total in use:            3769 KB 135%
        Total free:                30 KB 1%

Here is a capture of the squid config file.

auth_param ntlm program /usr/bin/ntlm_auth -–helper-protocol=squid-2.5-ntlm --username=admin --password=password
auth_param ntlm children 10 
auth_param basic program /usr/bin/ntlm_auth -–helper-protocol=squid-2.5-basic --username=admin --password=password
auth_param basic children 5
auth_param basic realm Domain Proxy Server
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off
authenticate_cache_garbage_interval 10 seconds
##
# Credentials past their TTL are removed from memory
authenticate_ttl 0 seconds
share|improve this question
    
rpm -q squid; cat /etc/*-release –  GioMac Aug 1 '13 at 0:51
    
p.s. this isn't complete SSO configuration, with SSO, "auth_param negotiate" part is required. –  GioMac Aug 1 '13 at 0:53

1 Answer 1

up vote 3 down vote accepted

Why are you specifying the --username and --password arguments to ntlm_auth? Those arguments aren't necessary and are likely causing thentlm_auth processes to terminate (which is, likely, the root cause of your failure).

share|improve this answer
    
The reason i was specifying them was down to a walkthrough i found about configuring NTLM_Auth that showed the username & password option, not having prior experience i had to make the guess that these were needed. –  Kristiaan Oct 25 '13 at 13:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.