negotiate_kerberos_auth(8)

📦
version 7.7 · 2 versions
, in alpine 3.22, alpine 3.23, alpine 3.24, arch rolling, centos-stream 10, debian trixie, fedora 43, fedora 44, opensuse-leap 16.0, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

✨ negotiate_kerberos_auth(8) ✨

okay so bestie, welcome to the manual page for negotiate_kerberos_auth — it's a System Manager's Manual kinda situation, and it is literally version 3.0.4sq. Yes, that's the version. No, I'm not making it up. 💅

🎀 NAME 🎀

negotiate_kerberos_auth — the Squid kerberos based authentication helper.

Version 3.0.4sq, if you missed it the first time. She's got a version number and she's proud of it. 🌸

⭐ SYNOPSIS ⭐

negotiate_kerberos_auth [-h] [-d] [-i] [-r] [-s Service-Principal-Name]
[-k Keytab-Name] [-c Replay-Cache-Directory] [-t Replay-Cache-Type]

That's the whole vibe check right there. Let's break it down. 🦋

🦋 DESCRIPTION 🦋

negotiate_kerberos_auth is an installed binary, bestie. It's not some abstract concept — it's really out here on your filesystem doing the work. And what work? It lets Squid authenticate users via the Negotiate protocol and Kerberos. That's the whole job. That's the assignment and she ATE. 👑

💅 OPTIONS 💅

  • -h — Shows you the binary help and the command line syntax info, and it writes that out using stderr. Yes, stderr. Not stdout. That's just how she does it. 🙈
  • -d — Writes debug messages to stderr. For when you wanna see everything, fr fr. 🔥
  • -i — Writes informational messages to stderr. Chill little updates. Not debug-level chaos. ✨
  • -r — Removes the realm from the username before returning that username to squid. Just strips it off, no big deal. 🎀
  • -s Service-Principal-name — Provides the Service Principal Name. You hand it over, she uses it. Iconic. ⭐
  • -k Keytab-Name — Provides the Kerberos Keytab Name. Default: /etc/krb5.keytab 💖
  • -c Replay-Cache-Directory — Provides the Replay Cache Directory. Default: /var/tmp 🌸
  • -t Replay-Cache-Type — Provides the Replay Cache Type. Default: dfl 🦋

🌈 CONFIGURATION 🌈

This helper is meant to be used as an authentication helper in squid.conf. Like, that's her whole purpose in life, and honestly? Main character energy. 💖

auth_param negotiate program /path/to/negotiate_kerberos_auth
auth_param negotiate children 10
auth_param negotiate keep_alive on
NOTE: The following squid startup file modification may be required. ⚠️

Add the following lines to the squid startup script to point squid to a keytab file which contains the HTTP/fqdn service principal for the default Kerberos domain. The keytab name can also be provided by the -k <keytab name> option. The fqdn must be the proxy name set in IE or firefox. You can not use an IP address. Like, seriously, don't. It's giving "I didn't read the manual" and not in a cute way. 😭

KRB5_KTNAME=/etc/squid/HTTP.keytab export KRB5_KTNAME

If you use a different Kerberos domain than the machine itself is in, you can point squid to the separate Kerberos config file by setting the following environment variable in the startup script. 💜

KRB5_CONFIG=/etc/krb5-squid.conf export KRB5_CONFIG

Kerberos can keep a replay cache to detect the reuse of Kerberos tickets (usually only possible in a 5 minute window). If squid is under high load with Negotiate(Kerberos) proxy authentication requests, the replay cache checks can create high CPU load. If the environment does not require high security, the replay cache check can be disabled for MIT based Kerberos implementations by adding the below to the startup script, or use the -t none option. 🔥

KRB5RCACHETYPE=none export KRB5RCACHETYPE

If negotiate_kerberos_auth doesn't determine the right service principal for some reason, you can provide it with -s HTTP/fqdn. ✨

If you serve multiple Kerberos realms, add a HTTP/fqdn@REALM service principal per realm to the HTTP.keytab file, and use the -s GSS_C_NO_NAME option with negotiate_kerberos_auth. 🦋

💜 AUTHOR 💜

This program was written by Markus Moeller <markus_moeller@compuserve.com> 🌸

This manual was written by Markus Moeller <markus_moeller@compuserve.com> 🌸

Same person, both times. We love a self-sufficient legend. 👑

* Copyright (C) 1996-2014 The Squid Software Foundation and
contributors
*
* Squid software is distributed under GPLv2+ license and includes
* contributions from numerous individuals and organizations.
* Please see the COPYING and CONTRIBUTORS files for details.

This program and documentation is copyright to the authors named above.

Distributed under the GNU General Public License (GNU GPL) version 2 or later (GPLv2+). ⭐

🧚 QUESTIONS 🧚

Questions on the usage of this program can be sent to the Squid Users mailing list <squid-users@lists.squid-cache.org> 💖

💀 REPORTING BUGS 💀

Bug reports need to be made in English. See https://wiki.squid-cache.org/SquidFaq/BugReporting for details of what you need to include with your bug report. 🙈

Report bugs or bug fixes using http://bugs.squid-cache.org/ 🔥

Report serious security bugs to Squid Bugs <squid-bugs@lists.squid-cache.org> 🚨

Report ideas for new improvements to the Squid Developers mailing list <squid-dev@lists.squid-cache.org> ✨

👑 SEE ALSO 👑

and that's the whole page bestie!! 🫶 you made it to the end of negotiate_kerberos_auth(8), version 3.0.4sq — she's a Squid Software Foundation girlie through and through. now go authenticate something responsibly, ily, bye!! 💖✨🎀🦋🌸💅

📦 where this page comes from