Note: The information here is current for version 2.4.
Users will be authenticated if squid is configured to use proxy_auth ACLs (see next question).
Browsers send the user's authentication credentials in the Authorization request header.
If Squid gets a request and the http_access rule list gets to a proxy_auth ACL, Squid looks for the Authorization header. If the header is present, Squid decodes it and extracts a username and password.
If the header is missing, Squid returns an HTTP reply with status 407 (Proxy Authentication Required). The user agent (browser) receives the 407 reply and then prompts the user to enter a name and password. The name and password are encoded, and sent in the Authorization header for subsequent requests to the proxy.
Authentication is actually performed outside of main Squid process. When Squid starts, it spawns a number of authentication subprocesses. These processes read usernames and passwords on stdin, and reply with "OK" or "ERR" on stdout. This technique allows you to use a number of different authentication schemes, although currently you can only use one scheme at a time.
The Squid source code comes with a few authentcation processes. These include:
In order to authenticate users, you need to compile and install one of the supplied authentication modules, one of the others, or supply your own.
You tell Squid which authentcation program to use with the authenticate_program option in squid.conf. You specify the name of the program, plus any command line options if necessary. For example:
authenticate_program /usr/local/squid/bin/ncsa_auth /usr/local/squid/etc/passwd
Make sure that your authentication program is installed and working correctly. You can test it by hand.
Add some proxy_auth ACL entries to your squid configuration. For example:
acl foo proxy_auth REQUIRED acl all src 0/0 http_access allow foo http_access deny allThe REQURIED term means that any authenticated user will match the ACL named foo.
Squid allows you to provide fine-grained controls by specifying individual user names. For example:
acl foo proxy_auth REQUIRED acl bar proxy_auth lisa sarah frank joe acl daytime time 08:00-17:00 acl all src 0/0 http_access allow bar http_access allow foo daytime http_access deny allIn this example, users named lisa, sarah, joe, and frank are allowed to use the proxy at all times. Other users are allowed only during daytime hours.
Yes. Successful authentication lookups are cached for one hour by default. That means (in the worst case) its possible for someone to keep using your cache up to an hour after he has been removed from the authentication database.
You can control the expiration time with the authenticate_ttl option.
Squid stores cleartext passwords in itsmemory cache.
Squid writes cleartext usernames and passwords when talking to the external authentication processes. Note, however, that this interprocess communication occors over TCP connections bound to the loopback interface. Thus, its not possile for processes on other comuters to "snoop" on the authentication traffic.
Each authentication program must select its own scheme for persistent storage of passwords and usernames.