Re: [squid-users] ntlmssp_server_auth: failed to parse NTLMSSP

On Mon, 4 Oct 2004, David wrote:

> [2004/10/04 10:13:36, 1] libsmb/ntlmssp.c:ntlmssp_server_auth(549)
> ntlmssp_server_auth: failed to parse NTLMSSP:
>
> I've seen this asked before in the archives but have yet to see any
> resolution. Am I just being blind? Does anyone know what is causing this
> and have a fix for it?

There is two possible caused by this:

a) A client sent a malformed NTLMSSP authentication packet to your Squid,
maybe in attempt to exploit bugs in other NTLMSSP implementations or by
application error..

b) You have clients sending largeish NTLMSSP packets and your Squid is not
in shape to deal with this
<url:http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE6-ntlmtruncated>

If 'b' I would guess authentication is not successful for such clients.

If you see these very often then you should be able to make a pattern of
which clients is causing this by matching the cache.log timestamps with
requests in access.log (/407)

Regards
Henrik
Received on Mon Oct 04 2004 - 06:36:28 MDT