On Mon, 4 Oct 2004, David wrote:
[2004/10/04 10:13:36, 1] libsmb/ntlmssp.c:ntlmssp_server_auth(549) ntlmssp_server_auth: failed to parse NTLMSSP:
I've seen this asked before in the archives but have yet to see any resolution. Am I just being blind? Does anyone know what is causing this and have a fix for it?
There is two possible caused by this:
a) A client sent a malformed NTLMSSP authentication packet to your Squid, maybe in attempt to exploit bugs in other NTLMSSP implementations or by application error..
b) You have clients sending largeish NTLMSSP packets and your Squid is not in shape to deal with this <url:http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE6-ntlmtruncated>
If 'b' I would guess authentication is not successful for such clients.
If you see these very often then you should be able to make a pattern of which clients is causing this by matching the cache.log timestamps with requests in access.log (/407)
Regards Henrik
