Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Situation:

I have a Squid server (3.0) and a LDAP server and the network setup looks like this:

                 Internet
                    |
                    |
                    |
Users <=====> [SQUID-Server] <====> [LDAP-Server]

I want to deny internet access to anonymous users and force authentication.

The users provided credentials will be passed to a local LDAP server and it authenticates their username/password and response to SQUID server to allow/deny that user.


The Problem:

The channel between SQUID and LDAP server is a local intranet and there is no problem with it.

The problem is the user sends its user/pass in plain-text format (encoded in Based64) to SQUID server and a someone can sniff the channel between Users and SQUID server to find the credentials (I think it is called The Basic-Authentication method).


One unpractical solution:

One solution to this problem is using a Samba server between SQUID and LDAP Server. something like this:

                 Internet
                    |
                    |
                    |
Users <=====> [SQUID-Server] <====> [SAMBA-Server] <====> [LDAP-Server]

and using the NTLM authentication in SQUID server to solve this problem.

I really don't think I need (or want) a SAMBA-Server.


Ideals for a good Solution:

  1. It should secure the connection between Users and SQUID-Server. Securing connection between SQUID-Server and LDAP-Server is not required.

  2. It possibly just need some configuration in SQUID-Server and no configuration in LDAP-Server if it is possible. But it must not need any other server (like Samba).

share|improve this question
    
Possible dupe of this post: serverfault.com/questions/151672/… Hint: the answer is to use Digest (unless you're in an IE only environment, and then use NTLM) –  gravyface Aug 5 '10 at 13:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.