pfSense » pfSense Packages

seems regression by https://redmine.pfsense.org/issues/9217

Ismael Peixoto Azambuja wrote:

pfsense 2.4.4p3 with all packages updated, using squid with LDAP authentication was working perfectly, server with 2 years or more of smooth operation in previous updates, after upgrading to 2.4.5 both LDAP and RADIUS permanently apply for authentication even using valid credentials. Diagnostic/authentication testing successfully validates users. Only the Squid that is not working properly.

Can you post "Squid - Cache Logs" content from the Squid realtime monitor page during authentication attempts?

---
No any radius auth changes since 0.4.44_9, so it doesn't seem to be https://redmine.pfsense.org/issues/9217
Most likely Squid 3 -> 4 specific issue

Cache.log

[2.4.4-RELEASE][admin@PFLog01.intra.uergs.rs]/var/squid/logs: cat cache.log
2020/03/27 10:29:52 kid1| Starting Squid Cache version 4.9 for amd64-portbld-freebsd11.3...
2020/03/27 10:29:52 kid1| Service Name: squid
2020/03/27 11:02:32 kid1| Starting new basicauthenticator helpers...

I have not found the problem yet, but I did test on an outdated server, 2.4.4p3 squid 0.4.44_8 and everything works perfectly... Authentication with LDAP, Custom ACLs, and all other settings I have. The LDAP Server is the same for all tests. What I can say for sure, are not the parameters I use that may be wrong or LDAP used.

Local and RADIUS auth works fine

LDAP auth fix:
https://github.com/pfsense/FreeBSD-ports/pull/811

Viktor Gurov wrote:

Local and RADIUS auth works fine

LDAP auth fix:
https://github.com/pfsense/FreeBSD-ports/pull/811

Hi, i test this fix, but dont work here...
0.4.44_8 OK : auth_param basic program /usr/local/libexec/squid/basic_ldap_auth -v 3 -b DC=UERGS,DC=RS -D CN=SQUID,OU=ADMINS,DC=UERGS,DC=RS -w password -f "sAMAccountName=%s" -u uid -P 172.16.0.16:389

0.4.44_15 Problem, I tried and it did not work here:

auth_param basic program /usr/local/libexec/squid/basic_ldap_auth -v 3 -b 'DC=UERGS,DC=RS' -D 'CN=SQUID,OU=ADMINS,DC=UERGS,DC=RS' '-w password' -f 'sAMAccountName=%s' -u 'uid' -P '172.16.0.16:389'

auth_param basic program /usr/local/libexec/squid/basic_ldap_auth -v 3 -b 'DC=UERGS,DC=RS' -D 'CN=SQUID,OU=ADMINS,DC=UERGS,DC=RS' -w 'password' -f 'sAMAccountName=%s' -u 'uid' -P '172.16.0.16:389'

auth_param basic program /usr/local/libexec/squid/basic_ldap_auth -v 3 -b DC=UERGS,DC=RS -D CN=SQUID,OU=ADMINS,DC=UERGS,DC=RS -w password -f sAMAccountName=%s -u uid -P 172.16.0.16:389

Ismael Peixoto Azambuja wrote:

Hi, i test this fix, but dont work here...

I have successfully tested this PR with Win2008R2 AD authentication.

Do you have any special symbols or special characters like æøå in you LDAP password?
Can you check it with simple password?
Or replace:

$password = (isset($settings['ldap_pass']) ? "-w " . escapeshellarg($settings['ldap_pass']) : '');

$password = (isset($settings['ldap_pass']) ? "-w {$settings['ldap_pass']}" : '');

I have the same problem after update.

I think the problem comes from the -w parameter. It should be done like this:

-w 'password'

and no
'-w password'

For my part I have another problem, I was using the -R parameter, in pfsense there is no area provided to check or add this parameter. So I use the LDAP field Base to add it, it worked before : Domain = dc = domain, dc = lan -R

But now it doesn't work anymore because of '' which includes the whole:
-b 'dc = domain, dc = lan -R'
when it should
-b 'dc = domain, dc = lan' -R

I change in squid.conf and restart squid, it works :

auth_param basic program /usr/local/libexec/squid/basic_ldap_auth -v 3 -b 'dc=...,dc=...' -R -D 'cn=...,cn=...,dc=...,dc=...' -w 'password' -f '(sAMAccountName=%s)' -u '' -P 'IP:389'

But I can't use the GUI to set parameters :-/

Thanks a lot

O 71 wrote:

I have the same problem after update.

I think the problem comes from the -w parameter. It should be done like this:

-w 'password'

and no
'-w password'

For my part I have another problem, I was using the -R parameter, in pfsense there is no area provided to check or add this parameter. So I use the LDAP field Base to add it, it worked before : Domain = dc = domain, dc = lan -R

PR fixes '-w password' issue,
+ now it adds

-R do not follow referrals

available update: 0.4.44_16, here all work perfect now.

do not know who to thank, but thanks for the correction!

Hi Ismael,

Can you give me the line write in the squid.conf file ?
If you check or uncheck "LDAP follow referrals" the "-R" parameter is added or not ?

I don't know why for me this paramter is always present.

Thanks

I test and it works if I modify the file /usr/local/pkg/squid.inc like this :

 $password = (isset($settings['ldap_pass']) ? "-w " . escapeshellarg($settings['ldap_pass']) : '');
 $noreferrals = ($settings['ldap_noreferrals'] == 'on' ? " -R" : '');
 $conf .= "auth_param basic program " . SQUID_LOCALBASE
         . "/libexec/squid/basic_ldap_auth -v {$settings['ldap_version']} -b " . escapeshellarg($settings['ldap_basedomain'])
         . $noreferrals
         . " -D " . escapeshellarg($settings['ldap_user']) . " " . $password
         . " -f " . escapeshellarg($settings['ldap_filter']) . " -u " . escapeshellarg($settings['ldap_userattribute'])
         . " -P " . escapeshellarg($settings['auth_server'] . $port) . "\n";
break;

Can you do the update of the pkg ?

Thanks a lot

Fix: https://github.com/pfsense/FreeBSD-ports/pull/814

O 71 wrote:

Hi Ismael,

Can you give me the line write in the squid.conf file ?
If you check or uncheck "LDAP follow referrals" the "-R" parameter is added or not ?

I don't know why for me this paramter is always present.

Thanks

Hi, after the update...(squid.conf)

auth_param basic program /usr/local/libexec/squid/basic_ldap_auth -v 3 -b 'DC=UERGS,DC=RS' -D 'CN=SQUID,OU=ADMINS,DC=UERGS,DC=RS' -w 'password' -f 'sAMAccountName=%s' -u 'uid' -P 'LDAP.UERGS.RS:389' -R

Ismael Peixoto Azambuja wrote:

O 71 wrote:

Hi Ismael,

Can you give me the line write in the squid.conf file ?
If you check or uncheck "LDAP follow referrals" the "-R" parameter is added or not ?

I don't know why for me this paramter is always present.

Thanks

Hi, after the update...(squid.conf)

auth_param basic program /usr/local/libexec/squid/basic_ldap_auth -v 3 -b 'DC=UERGS,DC=RS' -D 'CN=SQUID,OU=ADMINS,DC=UERGS,DC=RS' -w 'password' -f 'sAMAccountName=%s' -u 'uid' -P 'LDAP.UERGS.RS:389' -R

Thanks Ismael
Is the "-R" parameter at the end of the line not blocking for you? I don't understand why in my case it only works if this parameter is placed before the "-P" parameter.