/usr/lib/squid3/basic_msnt_multi_domain_auth is in squid3 3.4.8-6+deb8u5.
This file is owned by root:root, with mode 0o755.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 | #!/usr/bin/perl
#if you define this, debugging output will be printed to STDERR.
#$debug=1;
#to force using some DC for some domains, fill in this hash.
#the key is a regexp matched against the domain name
# the value is an array ref with PDC and BDC.
# the order the names are matched in is UNDEFINED.
#i.e.:
# %controllers = ( "domain" => ["pdc","bdc"]);
#%controllers = ( ".*" => ["pdcname","bdcname"]);
#define this if you wish to use a WINS server. If undefined, broadcast
# will be attempted.
#$wins_server="winsservername";
# Some servers (at least mine) really really want to be called by address.
# If this variable is defined, we'll ask nmblookup to do a reverse DNS on the
# DC addresses. It might fail though, for instance because you have a crappy
# DNS with no reverse zones or records. If it doesn't work, you'll have to
# fall back to the %controllers hack.
$try_reverse_dns=1;
# Some servers (at least mine) don't like to be called by their fully
# qualified name. define this if you wish to call them ONLY by their
# hostname.
$dont_use_fqdn=1;
#no more user-serviceable parts
use Authen::Smb;
#variables:
# %pdc used to cache the domain -> pdc_ip values. IT NEVER EXPIRES!
$|=1;
while (<>) {
chomp;
if (! m;^(\S+)(/|%5c)(\S+)\s(\S+)$; ) { #parse the line
print "ERR\n";
next;
}
$domain=$1;
$user=$3;
$pass=$4;
$domain =~ s/%([0-9a-f][0-9a-f])/pack("H2",$1)/gie;
$user =~ s/%([0-9a-f][0-9a-f])/pack("H2",$1)/gie;
$pass =~ s/%([0-9a-f][0-9a-f])/pack("H2",$1)/gie;
print STDERR "domain: $domain, user: $user, pass=$pass\n"
if (defined ($debug));
# check out that we know the PDC address
if (!$pdc{$domain}) {
($pdc,$bdc)=&discover_dc($domain);
if ($pdc) {
$pdc{$domain}=$pdc;
$bdc{$domain}=$bdc;
}
}
$pdc=$pdc{$domain};
$bdc=$bdc{$domain};
if (!$pdc) {
#a pdc was not found
print "ERR\n";
print STDERR "No PDC found\n" if (defined($debug));
next;
}
print STDERR "querying '$pdc' and '$bdc' for user '$domain\\$user', ".
"pass $pass\n" if (defined($debug));
$result=Authen::Smb::authen($user,$pass,$pdc,$bdc,$domain);
print STDERR "result is: $nt_results{$result} ($result)\n"
if (defined($debug));
if ($result == NTV_NO_ERROR) {
print STDERR ("OK for user '$domain\\$user'\n") if (defined($debug));
print ("OK\n");
} else {
print STDERR "Could not authenticate user '$domain\\$user'\n";
print ("ERR\n");
}
}
#why do Microsoft servers have to be so damn picky and convoluted?
sub discover_dc {
my $domain = shift @_;
my ($pdc, $bdc, $lookupstring, $datum);
foreach (keys %controllers) {
if ($domain =~ /$_/) {
print STDERR "DCs forced by user: $_ => ".
join(',',@{$controllers{$_}}).
"\n" if (defined($debug));
return @{$controllers{$_}};
}
}
$lookupstring="nmblookup";
$lookupstring.=" -R -U $wins_server" if (defined($wins_server));
$lookupstring.=" -T" if (defined($try_reverse_dns));
$lookupstring.=" '$domain#1c'";
print STDERR "Discovering PDC: $lookupstring\n"
if (defined($debug));
#discover the PDC address
open(PDC,"$lookupstring|");
while (<PDC>) {
print STDERR "response line: $_" if (defined($debug));
if (m|(.*), (\d+\.\d+\.\d+\.\d+)|) {
$datum=$1;
print STDERR "matched $datum\n" if (defined($debug));
if (defined($dont_use_fqdn) && $datum =~ /^([^.]+)\..*/) {
$datum=$1;
print STDERR "stripped domain name: $datum\n" if (defined($debug));
}
} elsif (m|^(\d+\.\d+\.\d+\.\d+)|) {
$datum=$1;
} else {
#no data here, go to next line
next;
}
if ($datum) {
if ($pdc) {
$bdc=$datum;
print STDERR "BDC is $datum\n" if (defined($debug));
last;
} else {
$pdc=$datum;
print STDERR "PDC is $datum\n" if (defined($debug));
}
last;
}
}
close(PDC);
return ($pdc,$bdc) if ($pdc);
return 0;
}
|