I use Squid and the users must authenticate. The users are authenticating in cleartext. I found tutorials about stunnel (http://www.jeffyestrumskas.com/?page_id=3), but the clients also need this software.

Is there no possibility that for user authentication SSL (or some other encryption technology) can be used?.



You could use HTTP Digest authentication with squid. This way the passwords would not be passed clear-text. This is quite easy to configure, no certificated needed, little overhead. I have successfully used it for some time in a small company.

There are some problems with this approach, though:

  • Many HTTP clients have digest authentication implementation broken.
  • You will probably not be able to use your current ('encrypted') password database.
| improve this answer | |

See http://squid-web-proxy-cache.1019090.n4.nabble.com/Simple-Kerberos-Squid-configuration-received-type-1-NTLM-token-td2553379.html#a2553379.

Using SSO (Kerberos) with Firefox as client (on a Windows Xp client and Linux server with Kerberos and no AD and no LDAP if not needed) is a solution.

| improve this answer | |

You can create an ACL using the user_cert ACL Type in squid.conf.

acl ssl_authentication user_cert somecertattributevalue

Then create filters using that ACL.

http_access deny all
http_access allow ssl_authentication
| improve this answer | |
  • Can you give more information? Where must the "user_cert" option be used. Nothing on the internet about this, besides the few paragrpahes int he documentation (visolve.com/squid/squid26/accesscontrols.php#user_cert). – user28362 Jan 28 '10 at 14:16
  • @barbarossa12d: sorry, I forgot to include that! It goes in the acl directive. I've edited to include. – squillman Jan 28 '10 at 15:32
  • I have: "acl myacl user_cert src" It gives at startup the following error: aclParseAclLine: Invalid ACL type 'user_cert'. I am using Squid 2.7 on Debian. Thanks for your help. – user28362 Jan 29 '10 at 7:49
  • Anyone? Just an example will do it. – user28362 Feb 3 '10 at 10:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.