I'm working on a Squid proxy which needs to authenticate users against an Active Directory domain; this works fine, Samba was correctly set up and Squid authenticates users via ntlm_auth. Relevant lines in squid.conf:

auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 5
auth_param ntlm keep_alive on
acl Authenticated proxy_auth REQUIRED
http_access allow Authenticated
http_access deny all

Now, I need a way to allow access to users which don't have a domain account. I know I could create an "internet user" account in the domain, but this would allow access, although limited, to domain resources (file shares, etc.); I need something that will allow only Internet access.

The ideal solution would be using a local account on the proxy server, either a Linux account or a Squid one; I know Squid supports this, but I'm unable to have it use both domain authentication and Squid/local authentication if domain auth is unsuccesful.

Can this be done? How?

2 Answers 2


Now, I need a way to allow access to users which don't have a domain account. Can this be done?



You can use an "external" ACL helper, which allows you to roll your own mechanism. See the Squid wiki "Multiple Source" entry for more details. This bit of pseudo-code lifted straight from there:

auth_param basic program /usr/local/bin/my-auth.pl
external_acl_type myAclType %SRC %LOGIN %{Proxy-Authorization} /usr/local/bin/my-acl.pl
acl MyAcl external myAclType
http_access allow MyAcl

... where my-auth.pl is a bit of perl script that performs the actual authentication, and returns OK or ERR as the result.

  • I had actually thouthg about this... but I'd like to know if there was some built-in way to do it.
    – Massimo
    Jun 7, 2010 at 19:08
  • There are several helper modules in /usr/lib/squid (or /usr/lib64/squid for 64-bit) that may be of interest to you. Unfortunately, the one that looked to be most promising - squid_unix_group - requires that you not be using shadow passwords, which I'm assuming at this point you probably are (most installations do this out-of-the-box). If you have an LDAP install separate from AD, squid_ldap_auth might be promising too. Jun 8, 2010 at 2:17

create a restricted domain user (isolated OU). from squid, create a squid ldap auth that will allow the user to use internet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.