Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I use Squid and the users must authenticate. The users are authenticating in cleartext. I found tutorials about stunnel (http://www.jeffyestrumskas.com/?page_id=3), but the clients also need this software.

Is there no possibility that for user authentication SSL (or some other encryption technology) can be used?.

Thanks.

share|improve this question

3 Answers 3

You could use HTTP Digest authentication with squid. This way the passwords would not be passed clear-text. This is quite easy to configure, no certificated needed, little overhead. I have successfully used it for some time in a small company.

There are some problems with this approach, though:

  • Many HTTP clients have digest authentication implementation broken.
  • You will probably not be able to use your current ('encrypted') password database.
share|improve this answer
up vote 1 down vote accepted

See http://squid-web-proxy-cache.1019090.n4.nabble.com/Simple-Kerberos-Squid-configuration-received-type-1-NTLM-token-td2553379.html#a2553379.

Using SSO (Kerberos) with Firefox as client (on a Windows Xp client and Linux server with Kerberos and no AD and no LDAP if not needed) is a solution.

share|improve this answer

You can create an ACL using the user_cert ACL Type in squid.conf.

acl ssl_authentication user_cert somecertattributevalue

Then create filters using that ACL.

http_access deny all
http_access allow ssl_authentication
share|improve this answer
    
Can you give more information? Where must the "user_cert" option be used. Nothing on the internet about this, besides the few paragrpahes int he documentation (visolve.com/squid/squid26/accesscontrols.php#user_cert). –  user28362 Jan 28 '10 at 14:16
    
@barbarossa12d: sorry, I forgot to include that! It goes in the acl directive. I've edited to include. –  squillman Jan 28 '10 at 15:32
    
I have: "acl myacl user_cert src 192.168.1.5" It gives at startup the following error: aclParseAclLine: Invalid ACL type 'user_cert'. I am using Squid 2.7 on Debian. Thanks for your help. –  user28362 Jan 29 '10 at 7:49
    
Anyone? Just an example will do it. –  user28362 Feb 3 '10 at 10:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.