Which version of squid are you running, default wheezy 3.1.x
and you did add proxy user to the winbindd_priv group?
I can suggest you recompile squid from jessie, its a pretty easy one.
there are know problems with ntlm auth, in at the point of testing that one
myself.
scheduled for next week.
I do already run 3.4.8 on my wheezy servers. 3.3.8 had some serious bugs.
* Urgency high due to security fixes
[ Amos Jeffries <amosjeffries at squid-cache.org> ]
* New upstream release (Closes: #737008)
- Fixes CVE-2014-6270: off by one in snmp subsystem (Closes: #761002)
- Fixes CVE-2014-CVE-2014-7141 and CVE-214-7142 (Closes: #760999)
+ pinger remote DoS vulnerabilities
- Fixes CVE-2014-0128: Denial of Service in SSL-Bump (Closes: #741312)
see also :
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=754339
Greetz,
Louis
>-----Oorspronkelijk bericht-----
>Van: jacques.serfontein at gmail.com
>[mailto:samba-bounces at lists.samba.org] Namens Jacques Serfontein
>Verzonden: maandag 17 november 2014 16:39
>Aan: samba at lists.samba.org
>Onderwerp: [Samba] Samba 4 Domain Provisioning
>
>Hi,
>
>I have been having issues with NTLMv2 on newly provisioned
>domains, using
>Samba 4.1 from backports on Debian Wheezy.
>
>Everything seems to be working fine, except for NTLMv2
>authentication with
>Squid and "ntlm_auth" on newer Windows versions.
>
>If I set "Lmcompatibility" down on the Windows PCs, then
authentication
>works, but that is temporary workaround at best.
>
>I have tried installing and reinstalling on numerous VMs,
>trying to isolate
>the cause, but to no avail, and I know the config is working,
>since copying
>a previously provisioned domain (/etc/samba/smb.conf +
>/var/lib/samba) to
>the new server works as expected.
>
>Increasing the log level yields to following:
>
>schannel_fetch_session_key_tdb: restored schannel info key
>SECRETS/SCHANNEL/SERVER
>schannel_store_session_key_tdb: stored schannel info with key
>SECRETS/SCHANNEL/SERVER
>auth_check_password_send: Checking password for unmapped user
>[PC001]\[Administrator]@[PC001]
>auth_check_password_send: mapped user is:
>[DOMAIN]\[Administrator]@[PC001]
>ntlm_password_check: NTLMv2 password check failed
>ntlm_password_check: Lanman passwords NOT PERMITTED for user
>Administrator
>ntlm_password_check: LM password, NT MD4 password in LM field and LMv2
>failed for user Administrator
>auth_check_password_recv: sam_ignoredomain authentication for user
>[DOMAIN\Administrator] FAILED with error NT_STATUS_WRONG_PASSWORD
>
>Any help would be greatly appreciated, since I have run out of ideas...
>
>Regards,
>Jacques
>--
>To unsubscribe from this list go to the following URL and read the
>instructions: https://lists.samba.org/mailman/options/samba
>
>