If you fix stuff like this then please lodge a Squid Bugzilla bug entry!
Adrian
On Tue, Sep 11, 2007, Stefano Fraccaro wrote:
> <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
> <html>
> <head>
> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
> </head>
> <body bgcolor="#ffffff" text="#000000">
> Hi,<br>
> in my installation I have resolved the same problem... the script
> receive 3 parameters (0 user group) than the 2 expected (user, group)
> ... I have resolved adding a trash variable and ignoring the first
> parameter (always zero) <br>
> <br>
> ;-)<br>
> <br>
> Stefano <br>
> <br>
> <br>
> <br>
> Adrian Chadd ha scritto:
> <blockquote cite="mid:20070911081617.GA24709@skywalker.creative.net.au"
> type="cite">
> <pre wrap="">Its entirely possible you've just found and squished a bug! Cool!
>
> Just throw it into the Squid Bugzilla (linked off the squid
> home page - <a class="moz-txt-link-freetext" href="http://www.squid-cache.org/">http://www.squid-cache.org/</a>) and someone will review
> and commit changes if needed.
>
> thanks!
>
>
>
>
> Adrian
>
> On Mon, Sep 10, 2007, Isnard Delacoste Jaquet Junior wrote:
> </pre>
> <blockquote type="cite">
> <pre wrap="">Hello,
>
> I'm using wbinfo_group.pl script and it works like a charm, but I ran
> into a condition where it reveals a false positive.
>
> The situation is as follows:
>
> I have squid 2.6-15 running with samba 3.0.22 authenticating against a
> AD forest which let's me authenticate users from domains other then my
> own (I'm one of the branches), but it's not able to verify the user
> groups. I think that's just the way it's configured. No complains.
> Now... I found an interesting problem when I have people from other
> domains trying to surf through squid within my domain branch. They get
> authenticated (which is fine), and when the request gets to the point
> where it has to verify the groups listed at the external acl and I if I
> get an invalid group name to be verified (I mistyped the group's name in
> squid.conf) wbinfo_group.pl runs the code bellow and returns OK instead
> of ERR:
>
>
> sub check {
> local($user, $group) = @_;
> $groupSID = `wbinfo -n "$group" | cut -d" " -f1`;
> chop $groupSID;
> $groupGID = `wbinfo -Y "$groupSID"`;
> chop $groupGID;
> &debug( "User: -$user-\nGroup: -$group-\nSID:
> -$groupSID-\nGID: -$groupGID-");
> # Verifica se wbinfo -r retorna grupos do usu?rio ou nada
> return 'OK' if(`wbinfo -r \Q$user\E` =~ /^$groupGID$/m);
> return 'ERR';
> }
>
>
> Well, I think it happens because when it runs "wbinfo -n "$group" | cut
> -d" " -f1`" and the group can't be verified it returns an empty string
> to the variable groupSID, which in turn returns an empty string to the
> variable groupGID when it runs `wbinfo -Y "$groupSID"`. Since the
> command "`wbinfo -r \Q$user\E`", which will return the groups to a given
> user can't verify it (because of the way the forest is configured -
> can't verify groups from different domains), and it compares with the
> value of the groupSID variable, it matches, cause they are both empty
> variables.
>
> I altered very little of the script to be able to verify it and return
> the right code to squid.
>
> It goes like this:
>
> sub check {
> local($user, $group) = @_;
> $groupSID = `wbinfo -n "$group" | cut -d" " -f1`;
> chop $groupSID;
> $groupGID = `wbinfo -Y "$groupSID"`;
> chop $groupGID;
> &debug( "User: -$user-\nGroup: -$group-\nSID:
> -$groupSID-\nGID: -$groupGID-");
> return 'ERR' if($groupGID eq ""); # Verify if groupGID variable
> is empty.
> return 'ERR' if(`wbinfo -r \Q$user\E` eq ""); # Verify if
> "wbinfo -r" command returns no value.
> return 'OK' if(`wbinfo -r \Q$user\E` =~ /^$groupGID$/m);
> return 'ERR';
> }
>
>
> I know it comes from a broken configuration (I mistyped the group name),
> but it might happen to others as well and perhaps go unnoticed.
>
> Is it a samba thing? Am I even supposed to be talking to them instead of
> you guys?
>
> Any comments will be greatly appreciated.
>
> Thanks in advance.
>
> Regards,
>
> Isnard Jaquet
>
>
>
> </pre>
> </blockquote>
> <pre wrap=""><!---->
> </pre>
> </blockquote>
> <br>
> </body>
> </html>
-- - Xenion - http://www.xenion.com.au/ - VPS Hosting - Commercial Squid Support - - $25/pm entry-level bandwidth-capped VPSes available in WA -Received on Tue Sep 11 2007 - 06:11:17 MDT
This archive was generated by hypermail pre-2.1.9 : Mon Oct 01 2007 - 12:00:02 MDT