Re: [squid-users] NTLM Authenticator with big requests number

Razvan Grigore wrote:
>> From: Serassio Guido <guido.serassio_at_dont-contact.us>
>> Date: Fri, 24 Jun 2005 09:37:06 +0200
>>
>> Hi,
>>
>> This behaviour is correct by Microsoft NTLM design. When negotiated,
>> NTLM authentication cannot be cached:
>> You are using "use_ntlm_negotiate on", so every Challenge/Response
>> request must be handled from Winbind.
>>
>> When using "use_ntlm_negotiate on", max_challenge_reuses and
>> max_challenge_lifetime are not (and cannot be) used.
>>
>> This is the only stable configuration using NTLM, disabling
>> use_ntlm_negotiate is a worst option.
>>
>> Regards
>>
>> Guido
>>
>
> Hello,
>
> I want to know if this is true.

Very high likelihood of being true. Guido is the author of the NTLM
negotiate code.

> I have Squid 3.0.STABLE10 on Centos
> and I successfully implemented an NTLM transparent authenticator for
> my proxy users.
>
> The problem is that my NTLM auth helper has very intense activity
> compared with my external acl helpers.
>
> Here's the details:
>
> NTLM Authenticator Statistics:
> program: /usr/bin/ntlm_auth
> number running: 10 of 10
> requests sent: 5539
> replies received: 5539
> queue length: 0
> avg service time: 0 msec
>
>
> while:
>
> External ACL Statistics: ad_group
> Cache size: 155
> program: /usr/lib/squid/squid_ldap_group
> number running: 5 of 5
> requests sent: 230
> replies received: 230
> queue length: 0
> avg service time: 3 msec
>
> and
>
> External ACL Statistics: host_ad_group
> Cache size: 112
> program: /usr/lib/squid/hostname.pl
> number running: 5 of 5
> requests sent: 162
> replies received: 162
> queue length: 0
> avg service time: 50 msec
>
>
> So I think the external ACL's can successffuly cache the requests
> while the ntlm auth can't.
>
> I specified in squid.conf
>
> authenticate_ttl 1 hour
> authenticate_ip_ttl 30 minutes
>
> and at the external acls ttl=1800.
>
> What is the problem? And how can I reduce the AD query number?
>
> Thank you!
> Razvan

-- 
Please be using
   Current Stable Squid 2.7.STABLE5 or 3.0.STABLE11
   Current Beta Squid 3.1.0.3