Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


I have a Squid server (3.0) and a LDAP server and the network setup looks like this:

Users <=====> [SQUID-Server] <====> [LDAP-Server]

I want to deny internet access to anonymous users and force authentication.

The users provided credentials will be passed to a local LDAP server and it authenticates their username/password and response to SQUID server to allow/deny that user.

The Problem:

The channel between SQUID and LDAP server is a local intranet and there is no problem with it.

The problem is the user sends its user/pass in plain-text format (encoded in Based64) to SQUID server and a someone can sniff the channel between Users and SQUID server to find the credentials (I think it is called The Basic-Authentication method).

One unpractical solution:

One solution to this problem is using a Samba server between SQUID and LDAP Server. something like this:

Users <=====> [SQUID-Server] <====> [SAMBA-Server] <====> [LDAP-Server]

and using the NTLM authentication in SQUID server to solve this problem.

I really don't think I need (or want) a SAMBA-Server.

Ideals for a good Solution:

  1. It should secure the connection between Users and SQUID-Server. Securing connection between SQUID-Server and LDAP-Server is not required.

  2. It possibly just need some configuration in SQUID-Server and no configuration in LDAP-Server if it is possible. But it must not need any other server (like Samba).

share|improve this question
Possible dupe of this post:… Hint: the answer is to use Digest (unless you're in an IE only environment, and then use NTLM) – gravyface Aug 5 '10 at 13:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.