[squid-users] ncsa_auth problem

Hi,

I'm running squid 2.5.9 with debian sarge
I'm having a problem with ncsa authentication: popup window appears in
browser but user doesn't get authenticated though the test of ncsa_auth lib
works ok.

relevant config options are:

auth_param basic program /usr/lib/squid/ncsa_auth /etc/squid/squid_passwd
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off

acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl localnet src 192.168.128.0/24
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 563 # https, snews
acl SSL_ports port 873 # rsync
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 631 # cups
acl Safe_ports port 873 # rsync
acl Safe_ports port 901 # SWAT
acl purge method PURGE
acl CONNECT method CONNECT
acl authenticated_users proxy_auth REQUIRED

http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

http_access allow localhost
http_access allow localnet authenticated_users

http_access deny all

My cache.log file:

2007/03/13 17:13:18| Starting Squid Cache version 2.5.STABLE9 for
i386-debian-linux-gnu...
2007/03/13 17:13:18| Process ID 7978
2007/03/13 17:13:18| With 1024 file descriptors available
2007/03/13 17:13:18| DNS Socket created at 0.0.0.0, port 32880, FD 9
2007/03/13 17:13:18| Adding nameserver 193.125.180.2 from /etc/resolv.conf
2007/03/13 17:13:18| Adding nameserver 193.124.169.49 from /etc/resolv.conf
2007/03/13 17:13:18| Adding nameserver 212.192.168.18 from /etc/resolv.conf
2007/03/13 17:13:18| helperOpenServers: Starting 5 'ncsa_auth' processes
2007/03/13 17:13:22| User-Agent logging is disabled.
2007/03/13 17:13:22| Referer logging is disabled.
2007/03/13 17:13:22| Unlinkd pipe opened on FD 19
2007/03/13 17:13:22| Swap maxSize 102400 KB, estimated 7876 objects
2007/03/13 17:13:22| Target number of buckets: 393
2007/03/13 17:13:22| Using 8192 Store buckets
2007/03/13 17:13:22| Max Mem size: 8192 KB
2007/03/13 17:13:22| Max Swap size: 102400 KB
2007/03/13 17:13:22| Local cache digest enabled; rebuild/rewrite every
3600/3600 sec
2007/03/13 17:13:22| Rebuilding storage in /var/spool/squid (CLEAN)
2007/03/13 17:13:22| Using Least Load store dir selection
2007/03/13 17:13:22| Set Current Directory to /var/spool/squid
2007/03/13 17:13:22| Loaded Icons.
2007/03/13 17:13:24| Accepting HTTP connections at 192.168.128.1, port 3128,
FD 21.
2007/03/13 17:13:24| Accepting ICP messages at 0.0.0.0, port 3130, FD 22.
2007/03/13 17:13:24| HTCP Disabled.
2007/03/13 17:13:24| WCCP Disabled.
2007/03/13 17:13:24| Ready to serve requests.
2007/03/13 17:13:24| Done reading /var/spool/squid swaplog (9 entries)
2007/03/13 17:13:24| Finished rebuilding storage from disk.
2007/03/13 17:13:24| 9 Entries scanned
2007/03/13 17:13:24| 0 Invalid entries.
2007/03/13 17:13:24| 0 With invalid flags.
2007/03/13 17:13:24| 9 Objects loaded.
2007/03/13 17:13:24| 0 Objects expired.
2007/03/13 17:13:24| 0 Objects cancelled.
2007/03/13 17:13:24| 0 Duplicate URLs purged.
2007/03/13 17:13:24| 0 Swapfile clashes avoided.
2007/03/13 17:13:24| Took 2.1 seconds ( 4.3 objects/sec).
2007/03/13 17:13:24| Beginning Validation Procedure
2007/03/13 17:13:24| Completed Validation Procedure
2007/03/13 17:13:24| Validated 9 Entries
2007/03/13 17:13:24| store_swap_size = 292k
2007/03/13 17:13:25| storeLateRelease: released 0 objects
2007/03/13 17:14:38| aclCheckFast: list: 0x824a4c8
2007/03/13 17:14:38| aclMatchAclList: checking all
2007/03/13 17:14:38| aclMatchAcl: checking 'acl all src 0.0.0.0/0.0.0.0'
2007/03/13 17:14:38| aclMatchIp: '192.168.128.88' found
2007/03/13 17:14:38| aclMatchAclList: returning 1
2007/03/13 17:14:38| aclCheck: checking 'http_access allow purge localhost'
2007/03/13 17:14:38| aclMatchAclList: checking purge
2007/03/13 17:14:38| aclMatchAcl: checking 'acl purge method PURGE'
2007/03/13 17:14:38| aclMatchAclList: no match, returning 0
2007/03/13 17:14:38| aclCheck: checking 'http_access deny purge'
2007/03/13 17:14:38| aclMatchAclList: checking purge
2007/03/13 17:14:38| aclMatchAcl: checking 'acl purge method PURGE'
2007/03/13 17:14:38| aclMatchAclList: no match, returning 0
2007/03/13 17:14:38| aclCheck: checking 'http_access deny !Safe_ports'
2007/03/13 17:14:38| aclMatchAclList: checking !Safe_ports
2007/03/13 17:14:38| aclMatchAcl: checking 'acl Safe_ports port
80 # http'
2007/03/13 17:14:38| aclMatchAclList: no match, returning 0
2007/03/13 17:14:38| aclCheck: checking 'http_access deny CONNECT
!SSL_ports'
2007/03/13 17:14:38| aclMatchAclList: checking CONNECT
2007/03/13 17:14:38| aclMatchAcl: checking 'acl CONNECT method CONNECT'
2007/03/13 17:14:38| aclMatchAclList: no match, returning 0
2007/03/13 17:14:38| aclCheck: checking 'http_access allow localhost'
2007/03/13 17:14:38| aclMatchAclList: checking localhost
2007/03/13 17:14:38| aclMatchAcl: checking 'acl localhost src
127.0.0.1/255.255.255.255'
2007/03/13 17:14:38| aclMatchIp: '192.168.128.88' NOT found
2007/03/13 17:14:38| aclMatchAclList: no match, returning 0
2007/03/13 17:14:38| aclCheck: checking 'http_access allow localnet
authenticated_users'
2007/03/13 17:14:38| aclMatchAclList: checking localnet
2007/03/13 17:14:38| aclMatchAcl: checking 'acl localnet src
192.168.128.0/24'
2007/03/13 17:14:38| aclMatchIp: '192.168.128.88' found
2007/03/13 17:14:38| aclMatchAclList: checking authenticated_users
2007/03/13 17:14:38| aclMatchAcl: checking 'acl authenticated_users
proxy_auth REQUIRED'
2007/03/13 17:14:38| authenticateAuthenticate: broken auth or no proxy_auth
header. Requesting auth header.
2007/03/13 17:14:38| aclMatchAcl: returning 0 sending authentication
challenge.
2007/03/13 17:14:38| aclMatchAclList: no match, returning 0
2007/03/13 17:14:38| aclCheck: requiring Proxy Auth header.
2007/03/13 17:14:38| aclCheck: match found, returning 2
2007/03/13 17:14:38| aclCheckCallback: answer=2
2007/03/13 17:14:38| The request GET http://nsu.ru/ is DENIED, because it
matched 'authenticated_users'
2007/03/13 17:14:41| aclCheck: checking 'http_access allow purge localhost'
2007/03/13 17:14:41| aclMatchAclList: checking purge
2007/03/13 17:14:41| aclMatchAcl: checking 'acl purge method PURGE'
2007/03/13 17:14:41| aclMatchAclList: no match, returning 0
2007/03/13 17:14:41| aclCheck: checking 'http_access deny purge'
2007/03/13 17:14:41| aclMatchAclList: checking purge
2007/03/13 17:14:41| aclMatchAcl: checking 'acl purge method PURGE'
2007/03/13 17:14:41| aclMatchAclList: no match, returning 0
2007/03/13 17:14:41| aclCheck: checking 'http_access deny !Safe_ports'
2007/03/13 17:14:41| aclMatchAclList: checking !Safe_ports
2007/03/13 17:14:41| aclMatchAcl: checking 'acl Safe_ports port
80 # http'
2007/03/13 17:14:41| aclMatchAclList: no match, returning 0
2007/03/13 17:14:41| aclCheck: checking 'http_access deny CONNECT
!SSL_ports'
2007/03/13 17:14:41| aclMatchAclList: checking CONNECT
2007/03/13 17:14:41| aclMatchAcl: checking 'acl CONNECT method CONNECT'
2007/03/13 17:14:41| aclMatchAclList: no match, returning 0
2007/03/13 17:14:41| aclCheck: checking 'http_access allow localhost'
2007/03/13 17:14:41| aclMatchAclList: checking localhost
2007/03/13 17:14:41| aclMatchAcl: checking 'acl localhost src
127.0.0.1/255.255.255.255'
2007/03/13 17:14:41| aclMatchIp: '192.168.128.88' NOT found
2007/03/13 17:14:41| aclMatchAclList: no match, returning 0
2007/03/13 17:14:41| aclCheck: checking 'http_access allow localnet
authenticated_users'
2007/03/13 17:14:41| aclMatchAclList: checking localnet
2007/03/13 17:14:41| aclMatchAcl: checking 'acl localnet src
192.168.128.0/24'
2007/03/13 17:14:41| aclMatchIp: '192.168.128.88' found
2007/03/13 17:14:41| aclMatchAclList: checking authenticated_users
2007/03/13 17:14:41| aclMatchAcl: checking 'acl authenticated_users
proxy_auth REQUIRED'
2007/03/13 17:14:41| authenticateAuthenticate: header Basic d3d3OjEyMw==.
2007/03/13 17:14:41| authenticateAuthenticate: This is a new checklist test
on FD:20
2007/03/13 17:14:41| authenticateAuthenticate: no connection authentication
type
2007/03/13 17:14:41| aclMatchAcl: returning 0 sending credentials to helper.
2007/03/13 17:14:41| aclMatchAclList: no match, returning 0
2007/03/13 17:14:41| aclCheck: checking password via authenticator

Just don't know what to do...
Received on Tue Mar 13 2007 - 05:45:35 MDT