From e38bd70f80a101c8eb4d24bb48cc7a84e17b330a Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Sun, 28 Sep 2003 02:35:29 +0000 Subject: Start to put some real 'meat' into the ntlm_auth docs. Andrew Bartlett (This used to be commit 227c7daf36f82f6b7935add09b37f44a9965335b) --- docs/docbook/manpages/ntlm_auth.1.xml | 140 +++++++++++++++++++++++++++++----- 1 file changed, 122 insertions(+), 18 deletions(-) (limited to 'docs') diff --git a/docs/docbook/manpages/ntlm_auth.1.xml b/docs/docbook/manpages/ntlm_auth.1.xml index 77794f0f3f..d769297c8f 100644 --- a/docs/docbook/manpages/ntlm_auth.1.xml +++ b/docs/docbook/manpages/ntlm_auth.1.xml @@ -34,11 +34,28 @@ ntlm_auth is a helper utility that authenticates users using NT/LM authentication. It returns 0 if the users is authenticated successfully and 1 if access was denied. ntlm_auth uses winbind to access - the user and authentication data for a domain. This utility - is only to be used by other programs (currently squid). + the user and authentication data for a domain. This utility + is only indended to be used by other programs (currently squid). + + OPERATIONAL REQUIREMENTS + + + The winbindd + 8 daemon must be operational + for many of these commands to function. + + Some of these commands also require access to the directory + winbindd_privileged in + $LOCKDIR. This should be done either by running + this command as root or providing group access + to the winbindd_privileged directory. For + security reasons, this directory should not be world-accessable. + + + OPTIONS @@ -47,49 +64,106 @@ --helper-protocol=PROTO - Operate as a stdio-based helper - - - - + Operate as a stdio-based helper. Valid helper protocols are: + + + + squid-2.4-basic + + Server-side helper for use with Squid 2.4's basic (plaintext) + authentication. + + + + squid-2.5-basic + + Server-side helper for use with Squid 2.5's basic (plaintext) + authentication. + + + + squid-2.5-ntlmssp + + Server-side helper for use with Squid 2.5's NTLMSSP + authentication. + Requires access to the directory + winbindd_privileged in + $LOCKDIR. The protocol used is + described here: http://devel.squid-cache.org/ntlm/squid_helper_protocol.html + + + + + + gss-spengo + + Server-side helper that implements GSS-SPNEGO. This + also uses the same as + squid-2.5-ntlmssp and is described + here: + http://devel.squid-cache.org/ntlm/squid_helper_protocol.html + + + + + + gss-spengo-client + + Client-side helper that implements GSS-SPNEGO. This + also uses a protocol similar to the above helpers, but + is currently undocumented. + + + + + + + + --username=USERNAME Specify username of user to authenticate - - - + + + + --domain=DOMAIN Specify domain of user to authenticate - + - + --workstation=WORKSTATION Specify the workstation the user authenticated from - + --challenge=STRING - challenge (HEX encoded) + NTLM challenge (in HEXADECIMAL) + --lm-response=RESPONSE - LM Response to the challenge (HEX encoded) + LM Response to the challenge (in HEXADECIMAL) --nt-response=RESPONSE - NT or NTLMv2 Response to the challenge (HEX encoded) + NT or NTLMv2 Response to the challenge (in HEXADECIMAL) --password=PASSWORD - User's plaintext password + User's plaintext passwordIf + not specified on the command line, this is prompted for when + required. @@ -102,12 +176,41 @@ Request NT key + + --diagnostics + Perform Diagnostics on the authentication + chain. Uses the password from --password + or prompts for one. + + + &popt.common.samba; &stdarg.help; + + EXAMPLE SETUP + + To setup ntlm_auth for use by squid 2.5, with both basic and + NTLMSSP authentication, the following + should be placed in the squid.conf file. + +auth_param ntlm program ntlm_auth --helper-protocol=squid-2.5-ntlmssp +auth_param basic program ntlm_auth --helper-protocol=squid-2.5-basic +auth_param basic children 5 +auth_param basic realm Squid proxy-caching web server +auth_param basic credentialsttl 2 hours + + +This example assumes that ntlm_auth has been installed into your + path, and that the group permissions on + winbindd_privileged are as described above. + + + + VERSION @@ -123,7 +226,8 @@ by the Samba Team as an Open Source project similar to the way the Linux kernel is developed. - The ntlm_auth manpage was written by Jelmer Vernooij. + The ntlm_auth manpage was written by Jelmer Vernooij and + Andrew Bartlett. -- cgit