Sunan mai masaukai na proxy wani bangare ne na shiga Kerberos

Tabbatar da yankin kai tsaye ga HTTP proxy na iya amfani da Negotiate da Kerberos. Abokin ciniki yana buƙatar tikitin sabis ɗin proxy, ba kawai kalmar sirri ta yanar gizo da aka tuna ba.

Ga proxy da aka sanar da shi a matsayin proxy.example.net, service principal na iya samun wannan siffa:

HTTP/[email protected]

Sunan mai masaukai da abokin ciniki ke amfani da shi, service principal ɗin da aka yi rijista da keytab ɗin proxy dole su dace da turawar. Tsarin Kerberos na Squid yana rubuta HTTP service principal da yadda mataimakin ke amfani da wannan kayan maɓalli.

Yin amfani da adireshin IP ko wani laƙabi na iya canza zaɓin sunan sabis na yau da kullum. Kafin canza kalmomin sirri na masu amfani, gano wane sunan proxy ne abokin ciniki ya yi amfani da shi a zahiri da wace hanyar tabbatarwa ta cika ko ta kasa.

Negotiate hanya ce ta tattaunawa. Windows na iya zaɓar Kerberos ko koma zuwa NTLM a cikin sharuɗɗan da suka dace; ganin kalmar Negotiate ba ya tabbatar da cewa musayar Kerberos ta yi nasara.

Riƙe amfani da takaddun shaida kai tsaye cikin manufofin abokin ciniki da yanki da aka yi nufi ga wannan proxy. Zaman burauza na yau da kullum da sabis da ke gudana a ƙarƙashin wani asusu na iya samun takaddun shaida da sakamakon izini daban-daban.