1

Ubuntu 16.04.3 64bit LTS squid proxy server problem:

ntlm_auth helpers began infinitely storming Windows Server 2008R2 AD DC with SMB auth requests, when some Windows client starts Chrome with a lot of tabs opened at once. Meanwhile, client's browser freezes opening web pages. Packet dump didn't show any difference except requests rate between normal behavior and auth request storm. CPU load didn't show any anomalies. Debug in cache.log didn't show any errors or difference with normal behavior except requests rate.

killall ntlm_auth sometimes help, more oftenly helps systemctl restart squid.

What could it be?

Windows clients - Windows 8.1 64 bit, Chrome version - 60, Squid version: 3.5.12-1ubuntu7.4, Samba server version - 2:4.3.11+dfsg-0ubuntu0.16.04.9. All updates on ubuntu server are installed.

root@proxy05:~# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 16.04.3 LTS
Release:        16.04
Codename:       xenial

Auth config from squid.conf:

auth_param negotiate program /usr/lib/squid/negotiate_wrapper_auth \
        --kerberos /usr/lib/squid/negotiate_kerberos_auth -i -r -d \
        -s "HTTP/proxy05.hq.verita.local@HQ.VERITA.LOCAL" \
        -s GSS_C_NO_NAME \
        --ntlm /usr/bin/ntlm_auth \
        --helper-protocol=squid-2.5-ntlmssp \
        --domain=HQ \
        -s GSS_C_NO_NAME
auth_param negotiate children 40 startup=5 idle=10
auth_param negotiate keep_alive on

auth_param basic program /usr/lib/squid/basic_ldap_auth -v 3 -P -R \
        -b "dc=hq,dc=verita,dc=local" \
        -D "proxy05-SQUIDkrb@hq.verita.local" \
        -W /etc/squid/ldappass.conf \
        -f "sAMAccountName=%s" -h dc01.hq.verita.local
auth_param basic children 30
auth_param basic realm "proxy05 SQUID Proxy Server Basic authentication!"
auth_param basic credentialsttl 2 hours

authenticate_cache_garbage_interval 8 hour
authenticate_ttl 4 hour

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.