up vote 4 down vote favorite
share [g+] share [fb]

I use Squid and the users must authenticate. The users are authenticating in cleartext. I found tutorials about stunnel (http://www.jeffyestrumskas.com/?page_id=3), but the clients also need this software.

Is there no possibility that for user authentication SSL (or some other encryption technology) can be used?.

Thanks.

link|improve this question
69% accept rate
feedback

3 Answers

up vote 2 down vote

You could use HTTP Digest authentication with squid. This way the passwords would not be passed clear-text. This is quite easy to configure, no certificated needed, little overhead. I have successfully used it for some time in a small company.

There are some problems with this approach, though:

  • Many HTTP clients have digest authentication implementation broken.
  • You will probably not be able to use your current ('encrypted') password database.
link|improve this answer
feedback
up vote 1 down vote accepted

See http://squid-web-proxy-cache.1019090.n4.nabble.com/Simple-Kerberos-Squid-configuration-received-type-1-NTLM-token-td2553379.html#a2553379.

Using SSO (Kerberos) with Firefox as client (on a Windows Xp client and Linux server with Kerberos and no AD and no LDAP if not needed) is a solution.

link|improve this answer
feedback
up vote 0 down vote

You can create an ACL using the user_cert ACL Type in squid.conf.

acl ssl_authentication user_cert somecertattributevalue

Then create filters using that ACL.

http_access deny all
http_access allow ssl_authentication
link|improve this answer
Can you give more information? Where must the "user_cert" option be used. Nothing on the internet about this, besides the few paragrpahes int he documentation (visolve.com/squid/squid26/accesscontrols.php#user_cert). – user28362 Jan 28 '10 at 14:16
@barbarossa12d: sorry, I forgot to include that! It goes in the acl directive. I've edited to include. – squillman Jan 28 '10 at 15:32
I have: "acl myacl user_cert src 192.168.1.5" It gives at startup the following error: aclParseAclLine: Invalid ACL type 'user_cert'. I am using Squid 2.7 on Debian. Thanks for your help. – user28362 Jan 29 '10 at 7:49
Anyone? Just an example will do it. – user28362 Feb 3 '10 at 10:22
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.