Configure Squid to use authentication, but not require it

Question

I'm setting squid up with squidGuard to act as a content filter for a home network.

I'd like to configure squid so that by default users' web traffic flows through squidGuard. E.g. children browsing on a desktop, or a homework buddy brings a laptop over.

If the user optionally authenticates (somehow), then for a period of time their internet is unfiltered based on which user authenticated. E.g. a parent wants to browse the web.

Ideally I'd really like it if squid did not prompt for authentication at all. Requiring parents to visit a certain URL or some other method to authenticate while leaving the proxy as transparent to the children as possible is my design goal.

Some ideas I've seen so far include:

• Using Basic Authentication - I don't like this solution as it will pop up a login window for the kids.
• Writing a custom external_acl_type handler - I will if I have to, but I'd rather have an off-the-shelf solution.

Any advice on where to look next?

Answer 1

One way I could think of is certainly possible, but likely way to involved for a home network: Kerberos or something similar.

Set up either a Windows Server with Active Directory or a Samba Server with LDAP and Kerberos auth. Log your users into this, and use a compatible browser. Squid will detect the user is already authenticated and who he is and act accordingly.

There are config examples for this on the Squid site.

Answer 2

You could simply run two copies of Squid, with different rules, one with authentication and one without.