Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have squid running on a gateway machine & I am trying to integrate it with Active Directory for authentication.

I am able to authentication by using ldap_auth & having this in squid.conf.

/usr/lib/squid/ldap_auth -b OU=my,DC=company,DC=com -h ldapserver -f sAMAccountName=%s -D "CN=myadmin,OU=Unrestricted Users,OU=my,DC=company,DC=com" -w mypwd

However, I am worried about the fact that I have the admin password in cleartext in squid.conf.

Is there a way that I can avoid this?

Squid is running on a debian machine.

share|improve this question

2 Answers 2

up vote 0 down vote accepted

Please use the -W file option instead of the -w option. This will allow you to specify a file where the password is located. If you run squid as per your example and you do a ps -ax, you will see the -w password in the process viewer. Any user will be able to see the password.

Secure the file with the correct permisions, eg 400 and change the owner to the squid process user.

Secondly, you only need a user that can query Active directory, this user should not have admin rights.

share|improve this answer
    
What kind of user can query Active Directory? i.e. if I need to substitute the admin user with a regular user - where should I create this user & what kind of permissions do I need to give him in Active Directory? –  Genboy Feb 21 '11 at 9:17
1  
Any normal AD user should work, it is only used to bind to AD. –  Francois Wolmarans Feb 21 '11 at 10:24

You can chmod squid config file to be something like 600. So, it will be readable+writable only by the owner user such as proxy user. But, you have to be sure to run squid process as proxy user to be able to read the configuration file. This way only the system admin root will be able to read your squid config file.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.