Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm wondering if replacing a squid proxy server for a heterogeneous network that permits traffic by IP addresses by one that authenticates usernames is viable, having in mind all those different softwares out there that may or may not work OK with authentication. What are your experiences? Am I asking for troubles?

share|improve this question
Squid can authenticate and permit connections by usernames too. – topdog Sep 6 '12 at 14:21
yes, I know, hence my question – Peter von Nostrand Sep 6 '12 at 14:31
Sorry i did not understand your question the first time, anyway your question is way to broad. A better question would be i am running software x and y while they be able to work with an authenticated proxy or not ? You surely do not expect this to be come a list of software that works or does not work thru and authenticated proxy thread. – topdog Sep 6 '12 at 14:35
Sure I wont expect a list of software. Just if experienced users had walked through proxy authentication and how was that, when working with different browsers, antivirus updates, scripts using wget, curl, and a lot of other apps that now works more on internet that on local network. – Peter von Nostrand Sep 6 '12 at 14:45

Depends on the software, and the authentication, and how much pain your users are willing to eat.

I am assuming it's traditional, rather than transparent proxy. Adding authentication to a transparent proxy is harder.

If you enable "proxy auth", everyone will get a popup for each browsing session. This will irritate some users, encourage others to save their password (may be a problem, maybe not) but on the other hand, most software will let you put authentication in. You will find things "just don't work" and you will spend a few weeks helping users add auth to software that likes to have its own proxy settings. Most stuff will eventually play ball though. It's not hugely painful, and the benefits of having auth can be worth it.

You could use NTLM or Kerberos, but you say your network is heterogeneous, so its unlikely (m)any of your machines are on a domain, so the "SSO" advantages are likely to be few.

There are other options, like captive portal, but this is harder to implement.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.