From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Message-ID: <4451C25B.3080301@aaanet.ru> Date: Fri, 28 Apr 2006 11:20:59 +0400 From: Igo User-Agent: Thunderbird 1.5.0.2 (Windows/20060308) MIME-Version: 1.0 To: ALT Linux Community Content-Type: text/plain; charset=KOI8-R; format=flowed Content-Transfer-Encoding: 8bit Subject: [Comm] smb squid AD X-BeenThere: community@lists.altlinux.org X-Mailman-Version: 2.1.7 Precedence: list Reply-To: altlinux@aaanet.ru, ALT Linux Community List-Id: ALT Linux Community List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Apr 2006 07:21:03 -0000 Archived-At: List-Archive: List-Post: Привет всем! Никак нехочет авторизировать пользователей в группе если пишу auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp то так пускает всех пользователей домена а если auth_param ntlm program /usr/bin/ntlm_auth --require-membership-of=S-1-5-21-57989841-2147032053-725345543-1117 --helper-protocol=squid-2.5-ntlmssp или auth_param ntlm program /usr/bin/ntlm_auth --require-membership-of="DOMAIN\\http" --helper-protocol=squid-2.5-ntlmssp то никого не пускает и в логах [2006/04/28 10:29:49, 3] libsmb/ntlmssp.c:ntlmssp_server_auth(615) Got user=[USER] domain=[DOMAIN] workstation=[PC] len1=24 len2=24 [2006/04/28 10:29:49, 3] utils/ntlm_auth.c:winbind_pw_check(435) Login for user [DOMIN]\[USER]@[PC] failed due to [Logon failure] [2006/04/28 10:29:49, 10] utils/ntlm_auth.c:manage_squid_ntlmssp_request(613) NTLMSSP NT_STATUS_LOGON_FAILURE КОНФИГ smb.conf [global] workgroup = domain server string = Samba server on %h (v. %v) netbios name = linux log file = /var/log/samba/log.%m max log size = 50 log level = 10 hosts allow = 192.168.0. 127. security = ads password server = pdc.domain.ru realm = domain.ru username level = 8 encrypt passwords = yes smb passwd file = /etc/samba/smbpasswd winbind uid = 10000-20000 winbind gid = 10000-20000 winbind separator = + winbind use default domain = yes winbind enum users = yes winbind enum groups = yes template homedir = /home/winnt/%D/%U template shell = /bin/bash socket options = TCP_NODELAY dns proxy = no use sendfile = yes [homes] comment = Home Directory for '%u' browseable = no writable = yes КОНФИГ squid acl QUERY urlpath_regex cgi-bin \? no_cache deny QUERY ftp_user anonymous auth_param ntlm program /usr/bin/ntlm_auth --require-membership-of=S-1-5-21-57989841-2147032053-725345543-1117 --helper-protocol=squid-2.5-ntlmssp auth_param ntlm children 10 auth_param ntlm max_challenge_reuses 0 auth_param ntlm max_challenge_lifetime 2 minutes auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic auth_param basic children 10 auth_param basic realm Squid proxy-caching web server auth_param basic credentialsttl 2 hours auth_param basic casesensitive off refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern . 0 20% 4320 acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl squid_users proxy_auth REQUIRED acl to_localhost dst 127.0.0.0/8 acl Safe_ports port 80 8080 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 563 # https, snews acl CONNECT method CONNECT http_access allow squid_users http_access allow manager localhost http_access deny manager http_access allow localhost http_access deny all http_reply_access allow all error_directory /usr/share/squid/errors/Russian-1251