MSNT Auth v2.0.3-squid.1
Squid web proxy NT authentication module
Antonino Iannella, Stellar-X Pty Ltd
Sun Sep 2 15:01:58 CST 2001
Modified by the Squid HTTP Proxy team
Wed Jun 26 21:16:32 CEST 2002

Contents

Introduction

This is an authentication module for the Squid proxy server to authenticate users on an NT domain.

It originates from the Samba and SMB packages by Andrew Tridgell and Richard Sharpe. This version is sourced from the Pike authentication module by William Welliver (hwellive@intersil.com).

Usage is simple. It accepts a username and password on standard input. It will return OK if the username/password is valid for the domain, or ERR if there was some problem. Check syslog messages for reported problems.

Msntauth is released under the GNU General Public License and is available from http://www.tripod.com/stellarx. It also ships with the Squid web proxy, http://www.squid-proxy.org.

Msntauth has not been tested with Windows 2000 domains yet.

Installation

Make any changes to the source code you need.

If you are using the source provided with Squid, then Msntauth will be compiled when you compile Squid. Refer to Squid documentation for details.

If you have downloaded Msntauth from the Stellar-X website, then copy Makefile.MSNT to Makefile. Review the Makefile, and modify based on target platform or site requirements.

Type 'make', then 'make install', then 'make clean'.

To avoid using the makefile, it may compile with gcc -O2 -s -o msntauth *.c

'Make install' will put 'msntauth' into /usr/local/squid/bin by default.

Hopefully nobody has problems compiling msntauth.

Issues when compiling

The Makefile uses the GCC compiler, and assumes that it is in the current PATH. Msntauth is known to compile properly on Redhat Linux 6, and FreeBSD 3.1 without problems. Other operating systems are untested, but use a recent copy of the GNU C compiler. In Smbencrypt.c, '#include ' only gets included when compiled with Solaris.

When compiling under Solaris, the socket libraries must be linked to. In the Makefile, hash the default CFLAGS line, and unhash the Solaris CFLAGS line. It always helps to have /usr/ccs/bin in your path prior to compiling.

For Digital Unix/Tru64, review the INSTALL line in the makefile.

Configuration file

Msntauth uses a configuration file as of version 2. The file is /usr/local/squid/etc/msntauth.conf. If this path needs to be changed, it is defined in confload.c -

  #define CONFIGFILE   "/usr/local/squid/etc/msntauth.conf"

An example configuration file is provided. It looks like

# Sample MSNT authenticator configuration file
# Antonino Iannella, Stellar-X Pty Ltd
# Tue Sep 26 17:26:59 CST 2000

server my_PDC           my_BDC          my_NTdomain
server other_PDC        other_BDC       otherdomain

denyusers       /usr/local/squid/etc/denyusers
allowusers      /usr/local/squid/etc/allowusers

All comments start with '#'.

NT servers are used to query user accounts. The 'server' lines are used for this, with the PDC, BDC, and NT domain as parameters. Up to 5 servers/domains can be queried. If this is not enough, modify the MAXSERVERS define in confload.c. At least one server must be specified, or msntauth will not run. Server names must be resolvable by the system. If not, msntauth reports an error. If you can't ping it, you might have a host resolution problem. You can't use NetBIOS hostnames, nor IP addresses.

When a user provides a username/password, each of these servers will be queried to authenticate the username. It stops after a user has been successfully authenticated, so it makes sense to specify the most commonly queried server first. Make sure the servers can be reached and are active, or else msntauth will start failing user accounts!

The 'denyusers' and 'allowusers' lines give the absolute path to files of user accounts. They can be used to deny or allow access to the proxy. Do not use these directives if you do not need these features.

Denying users

Users who are not allowed to access the web proxy can be added to the denied user list. This list is read around every minute, or when the msntauth process receives a SIGHUP signal.

The denied user file is set using the 'denyusers' directive in msntauth.conf. The denied user file contains a list of usernames in no particular structure or form. If the file does not exist, no users are denied. The file must be readable by the web proxy user.

Msntauth will send syslog messages if a user was denied, at LOG_USER facility.

Allowing users

Similar to denying users, you can allow users to access the proxy by username. This is useful if only a number of people are allowed supposed to be accessing a proxy.

The allowed user file is set using the 'allowusers' directive in msntauth.conf. If the file does not exist or if empty, all users are allowed.

You could make use of the SHOWMBRS tool in Microsoft Technet. This gives you a list of users which are in a particular NT Domain Group. This list can be made into the allowed users file.

Some other rules -

  1. The operation of the denied user file is independent of the allowed user file. The former file is checked first.
  2. You can use none, one, or both files.
  3. If a username appears in the denied user file, they will be denied, even if they are in the allowed user file.
  4. If a username is not in either file, they will be denied, because they have not been allowed.
  5. If the allowed user file is in use and is empty, all users will be allowed.

Hopefully this wasn't too confusing.

Squid.conf changes

Refer to Squid documentation for the required changes to squid.conf. You will need to set the following lines to enable authentication for your access list -

  acl  proxy_auth REQUIRED
  http_access allow password
  http_access allow 
  http_access deny all

You will also need to review the following directives. The number of msntauth children spawned is set with authenticate_children. The number of children needed is site-dependent, so some experimentation may be required to find the best number. There should be no visible delay in performance with Squid once msntauth is in use. As an example, a firm with 1500 users and a T1 internet connection required a value of 30.-

  proxy_auth_realm enterprise web gateway
  authenticate_program /usr/local/squid/bin/msntauth
  authenticate_ttl 5
  authenticate_children 20

Testing

I strongly urge that Msntauth is tested prior to being used in a production environment. It may behave differently on different platforms. To test it, run it from the command line. Enter username and password pairs separated by a space.

It should behave in the following way -

 - Press ENTER to get an OK or ERR message.
 - Make sure pressing CTRL-D behaves the same as a carriage return.
 - Make sure pressing CTRL-C aborts the program.
 - Test that entering no details does not result in an OK or ERR message.
 - Test that entering an invalid username and password results in
   an ERR message. Note that if NT guest user access is allowed on
   the PDC, an OK message may be returned instead of ERR.
 - Test that entering an valid username and password results in an OK message.
   Try usernames which are and aren't in the denied/allowed user files,
   if they're in use.
 - Test that entering a guest username and password returns the correct response.

If the above didn't work as expected, you may need to modify the main() function in msntauth.c. Inform the maintainer of any problems.

Usernames cannot have whitespace in them, but passwords can.

As of version 2.0.3, the msntauth version can be found in the executable. Type this to retrieve it -

  strings msntauth | grep -i msntauth

Contact details

To contact the maintainer of this package, email Antonino Iannella at antonino@rager.com.au, or antonino.iannella@santos.com.au, or ring +61 8408 800 007.

The latest version may be found on http://members.tripod.com/stellarx. It is also distributed as part of Squid.

Reported problem

For an unknown username, Msntauth returns OK. This is because the PDC returns guest access for unknown users, even if guest access is disabled. This problem was reported by Mr Vadim Popov (vap@iilsr.minsk.by). I am not able to replicate this.

The tested environment consisted of PDC on Windows NT 4, SP 6. Squid 2.3 and Msntauth was tested on SuSe, RedHat, and Debian Linux. A fix was provided in case you have this problem. Apply the provided patch before compiling, using

  patch smblib.c < smblib.c.patch

Revision history

The following sequence of changes have been made to improve msntauth. I have not had a chance to do too much testing due to lack of resources. There should be no problems, though.

Hopefully msntauth and Squid prove to be a valuable auditing combination. Feel free to send me success or problem stories.