Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've just created a Squid based proxy server, which is functioning just great with a default configuration. However I don't want it to be accessible by everyone. I want to set up username/password access on Squid. I've been informed this is relatively straight-forward. So far I've done the following:

sudo htpasswd -c /etc/squid/passwd A    

And added the following to  /etc/squid/squid.conf 
auth_param basic program /usr/lib/squid/ncsa_auth /etc/squid/passwd

acl AUser proxy_auth A
http_access allow AUser

I believe this is the correct approach? Initially I got an error message about "can't use proxy auth because no authentication schemes are fully configured", but I resolved this by placing the auth_param basic program... line before the acl line. However when I restarted the squid service and entered the proxy IP address and port into my Browser (Chrome), it failed to load a page or indeed ask for a username/password. I then tracked this down to the fact I shouldn't have "http_access deny all" in the squid.conf file. I'm not sure if this is the best setup or indeed whether I'm creating any security issues, however it does seem to be working ok for me now.

Many thanks!

share|improve this question
up vote 3 down vote accepted

You simply need to check the authentication feature doc for squid which is available at

http://wiki.squid-cache.org/Features/Authentication

There are a number of authentication methods available with squid and everything is well documented in the above link. Go through it and choose the appropriate one for you.

share|improve this answer
    
Thanks that was very useful, though as my revised questions above explains I'm still experiencing problems getting it to work – trican Sep 11 '11 at 10:15
    
I've now solved the remaining problems I was experiencing, and I've detailed these above which hopefully might be useful for some one else. – trican Sep 11 '11 at 11:45
    
glad to hear that you made it working. cheers !! – SparX Sep 11 '11 at 18:40

Just came across this old post while I was facing same problem. I belive there is no need to commnet or disable "http_access deny all". All you need to do is instead of specifying single user undre ACL, specify broader group. Some thing like

acl ncsa_users proxy_auth REQUIRED
http_access allow ncsa_users

Here are some addtional tuning for autharization.

#This line defines the file holding the authentication details and also the program to check those details
auth_param basic program /usr/lib64/squid/ncsa_auth /etc/squid/password

#Define the maximum number of child process to spawn for authentication
auth_param basic children 5

#user will see this message "Squid proxy-caching web server" in authentication box
auth_param basic realm Squid proxy-caching web server

#time to live after a successful authentication
auth_param basic credentialsttl 2 hours

#to make username case insensitive
auth_param basic casesensitive off

that will do trick.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.