By Duncan Miriri and James Macharia

NAIROBI (Reuters) - Kenya said its security forces were in control of most of the Nairobi shopping mall where at least 68 people were killed by Somali al Shabaab Islamists, but gunmen still appeared to be holding hostages as the siege entered its third day on Monday.

Referring to an operation under way since early on Sunday, following the storming of the upmarket Westgate mall at lunchtime the previous day, a military spokesman said most of those who had been in the complex were now free.

He made no mention of killing or capturing militants but said commanders hoped to end the operation "very, very soon". Reuters journalists outside the mall heard only very occasional gunfire and an explosion. There was no clear word on the fate of people said to be held by a dozen or so gunmen in a supermarket.

Al Shabaab in Somalia said its fighters were demanding Kenya pull out troops from its northern neighbor, where they have put the al Qaeda-affiliated group on the defensive in the past two years.

"Most of the hostages have been released, and the Kenya Defence Forces has taken control of most parts of the building," Colonel Cyrus Oguna told local station KTN, giving no details. He told Britain's Sky News late on Sunday: "A large number of hostages have been rescued since this morning."

Earlier, as people continued to emerge from hiding while troops and police moved to secure the sprawling complex, officials said concern now focused on a large supermarket where Kenyan President Uhuru Kenyatta said 10 to 15 guerrillas, some possibly women, were holding an unspecified number of people.

Kenyatta declined to comment on whether captives there had been wired up to explosives.

Survivors' tales of Saturday's military-style, lunchtime assault by squads of gunmen hurling grenades and spraying automatic fire, left little doubt the hostage-takers are willing to kill. Previous such raids around the world suggest they may also be ready to die with their captives.

Story continues

Military spokesman Oguna said the government's position was clear: "We will not negotiate with terrorists."

It was unclear how many may be held by the guerrillas barricaded in the supermarket. A Kenyan TV station said it might be 30. A number of escapes on Sunday, by survivors who had spent up to a full day hiding in terror, suggested some people may be trapped but not captive.

Kenyatta, who himself lost a nephew in the killing, vowed to hold firm in what he called the "war on terror" in Somalia and said, cautiously, that Kenyan forces could end the siege.

"I assure Kenyans that we have as good a chance to successfully neutralize the terrorists as we can hope for," he said. Adding that more than 175 people were wounded, he pledged: "We will punish the masterminds swiftly and painfully."

But a military spokesman for al Shabaab told Reuters his group had nothing to fear. "Where will Uhuru Kenyatta get the power with which he threatened us?" said Sheikh Abdiasis Abu Musab.

SIEGE

It was unclear who the assailants were. Al Shabaab - the name means "The Lads" in Arabic - has thousands of Somali fighters but has also attracted foreigners to fight against Western and African Union efforts to establish stable government.

With the stocks of a major supermarket at their disposal - the Nakumatt store is part of one of Kenya's biggest chains - the gunmen could be in a position to hold on for a long time.

British Prime Minister David Cameron, confirming that at least three Britons were already among the dead, said: "We should prepare ourselves for further bad news."

U.S. President Barack Obama called Kenyatta to offer condolences and support. Officials in Israel, whose citizens own several stores in the mall and have been targeted by Islamists in Kenya before, said Israeli experts were also advising Kenyan forces.

Foreigners including a French mother and daughter and two diplomats, from Canada and Ghana, were killed. The Ghanaian, Kofi Awoonor, was also a renowned poet. Other victims came from China and the Netherlands. Five Americans were wounded.

Scores of Kenyans gathered on Sunday at a site overlooking the mall, awaiting what they expected to be a violent denouement. "They entered through blood, that's how they'll leave," said Jonathan Maungo, a private security guard.

Kenya's president, son of post-colonial leader Jomo Kenyatta, is facing his first major security challenge since being elected in March. He urged Western governments not to warn their tourists off visiting a country that needs their money.

The assault was the biggest single attack in Kenya since al Qaeda's East Africa cell bombed the U.S. Embassy in Nairobi in 1998, killing more than 200 people.

WARFARE

Al Shabaab's siege underlined its ability to cause major disruptions with relatively limited resources, even after Kenyan and other African troops drove it from Somali cities.

"While the group has grown considerably weaker in terms of being able to wage a conventional war, it is now ever more capable of carrying out asymmetric warfare," said Abdi Aynte, director of Mogadishu's Heritage Institute of Policy Studies.

The dead in Saturday's assault included children, and the wounded ranged in age from 2 to 78. More than 1,000 people were evacuated by security forces combing the mall, littered with shattered glass and pools of blood.

After emerging on Sunday morning from a hiding place under a vehicle in the basement car park, a woman, giving her name as Cecilia, told Reuters by telephone she had seen three of the attackers.

"They were shooting from the exit ramp, shooting everywhere," she said. "I saw people being shot all around me, some with blood pouring from bad wounds. I was just praying, praying 'God, keep me alive' and that my day hadn't come."

Witnesses said the attackers had AK-47 rifles and wore ammunition belts. One militant was shot and arrested early on in the siege, but died shortly afterwards.

For hours after the attack, the dead were strewn around tables of unfinished meals. At one burger restaurant, a man and woman lay in a final embrace, until their bodies were removed.

Kenya sent troops into Somalia in October 2011 to pursue militants whom it accused of kidnapping tourists and attacking its security forces.

Al Shabaab's last big attack outside Somalia was a twin assault in nearby Uganda, targeting people watching the World Cup final on television in Kampala in 2010, killing 77 people.

(Additional reporting by Edmund Blair, Richard Lough Drazen Jorgic, Humphrey Malalo and Kevin Mwanza in Nairobi, Pascal Fletcher in Johannesburg, Feisal Omar and Abdi Sheikh in Mogadishu; Writing by Edmund Blair and Alastair Macdonald; Editing by Kevin Liffey and Eric Beech)