How to set up a squid Proxy with basic username and password authentication? [closed]

Question

I currently I use ip in acl, and I want to use username and password to do this.

Answer 1

Here's what I had to do to setup basic auth on Ubuntu 14.04 (didn't find a guide anywhere else)

Basic squid conf

/etc/squid3/squid.conf instead of the super bloated default config file

auth_param basic program /usr/lib/squid3/basic_ncsa_auth /etc/squid3/passwords auth_param basic realm proxy acl authenticated proxy_auth REQUIRED http_access allow authenticated  # Choose the port you want. Below we set it to default 3128. http_port 3128 

Please note the basic_ncsa_auth program instead of the old ncsa_auth

squid 2.x

For squid 2.x you need to edit /etc/squid/squid.conf file and place:

auth_param basic program /usr/lib/squid/digest_pw_auth /etc/squid/passwords auth_param basic realm proxy acl authenticated proxy_auth REQUIRED http_access allow authenticated 

Setting up a user

sudo htpasswd -c /etc/squid3/passwords username_you_like 

and enter a password twice for the chosen username then

sudo service squid3 restart 

squid 2.x

sudo htpasswd -c /etc/squid/passwords username_you_like 

and enter a password twice for the chosen username then

sudo service squid restart 

htdigest vs htpasswd

For the many people that asked me: the 2 tools produce different file formats:

• htdigest stores the password in plain text.
• htpasswd stores the password hashed (various hashing algos are available)

Despite this difference in format basic_ncsa_auth will still be able to parse a password file generated with htdigest. Hence you can alternatively use:

sudo htdigest -c /etc/squid3/passwords realm_you_like username_you_like 

Beware that this approach is empirical, undocumented and may not be supported by future versions of Squid.

On Ubuntu 14.04 htdigest and htpasswd are both available in the [apache2-utils][1] package.

MacOS

Similar as above applies, but file paths are different.

Install squid

brew install squid 

Start squid service

brew services start squid 

Squid config file is stored at /usr/local/etc/squid.conf.

Comment or remove following line:

http_access allow localnet 

Then similar to linux config (but with updated paths) add this:

auth_param basic program /usr/local/Cellar/squid/4.8/libexec/basic_ncsa_auth /usr/local/etc/squid_passwords auth_param basic realm proxy acl authenticated proxy_auth REQUIRED http_access allow authenticated 

Note that path to basic_ncsa_auth may be different since it depends on installed version when using brew, you can verify this with ls /usr/local/Cellar/squid/. Also note that you should add the above just bellow the following section:

# # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS # 

Now generate yourself a user:password basic auth credential (note: htpasswd and htdigest are also both available on MacOS)

htpasswd -c /usr/local/etc/squid_passwords username_you_like 

Restart the squid service

brew services restart squid