I have a Squid server (3.0) and a LDAP server and the network setup looks like this:
Internet | | | Users <=====> [SQUID-Server] <====> [LDAP-Server]
I want to deny internet access to anonymous users and force authentication.
The users provided credentials will be passed to a local LDAP server and it authenticates their username/password and response to SQUID server to allow/deny that user.
The channel between SQUID and LDAP server is a local intranet and there is no problem with it.
The problem is the user sends its user/pass in plain-text format (encoded in Based64) to SQUID server and a someone can sniff the channel between Users and SQUID server to find the credentials (I think it is called The Basic-Authentication method).
One unpractical solution:
One solution to this problem is using a Samba server between SQUID and LDAP Server. something like this:
Internet | | | Users <=====> [SQUID-Server] <====> [SAMBA-Server] <====> [LDAP-Server]
and using the NTLM authentication in SQUID server to solve this problem.
I really don't think I need (or want) a SAMBA-Server.
Ideals for a good Solution:
It should secure the connection between
SQUID-Server. Securing connection between
LDAP-Serveris not required.
It possibly just need some configuration in
SQUID-Serverand no configuration in
LDAP-Serverif it is possible. But it must not need any other server (like Samba).