Howto: Squid proxy authentication using ncsa_auth helper

marco,

You cannot use Proxy Authentication transparently

“Is htpasswd is available for download for FreeBSD. (pkg_add requires many components) Is their anyother way to generate password file like htpasswd?”

- For me on ubuntu I installed apache2-utils, must be something similar on FreeBSD. E.g.:

apt-cache search htpasswd, yields:

apache2-utils – util…
…

Awesome article btw! Got me up and running with no problems! Thanks!

htpasswd is part of Apache package under FreeBSD. To install goto ports

cd /usr/ports/www/apache22/
make install clean

using squid 2.6
i used the setting above …

acl ncsa_i proxy_auth REQUIRED
http_access allow ncsa_i
if i use this two lines in conf file ..squid fails to restart
i can’t understand were is the bug

hey !! i had problems with the iptables….

you also chack that …

i restored it to original

Dear all
Thanks for reply.
What I have done,I have configured only squid.conf with following line , I hv not configured iptable , firewall.

auth_param basic program /usr/lib/squid/ncsa_auth /etc/squid/squid_passwd
#auth_param basic realm squid proxy-caching web server
auth_param basic realm Rhel.Mail.com
auth_param basic casesensitive off

acl ncsa_users proxy_auth REQUIRED
http_access allow ncsa_users

Can u help me in detail what component I hv to configured I have just enter the ncsa_auth line in squid.conf that’s it

Dear anant Thanks
for your prompt reply , I want to tell you more thing I hv not installed squid separately I hv installed linux with squid and that /etc/squid/squid.conf I am using.
I have created 2(two) user in that files with help of htpasswd the file permission as below
-rw-r–r– 1 root root 40 Sep 14 02:29 squid_passwd

Waiting for your reply.

Dear raja
thanks for reply,

it is notworking

password not acepting

[root@rhel squid]# cat squid_passwd
test:ueu4r5eSydxzM
[root@rhel squid]#

or if you are useing gtalk so we can talk online pls give me your email id. here i am giving my gmail id for fast comunication thakershyamal@gmail.com

waiting for your reply.

hey onme liast thing is ur iprange in series of
192.168.1.*. in not then i think you have to still play with ACL.

Worked perfect, thanks for the article

Hello guys, I just want to say: THANK YOU! :-)
I tried to configure squid since two days, with your tutorial it works. Thanks a lot and a happy new year ;-)

Regards, Christian

Hi

i’ve configured my squid as above, but squid cannot start anyway, can you trace where my fault is?
here is my conf :
#ACL’s
acl login_user proxy_auth REQUIRED
http_access allow login_user

#proxy_auth program
auth_param basic program /usr/lib/squid/ncsa_auth /etc/squid/password
auth_param basic children 5
auth_param basic realm Proxy Badilag
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off

and here is the error comment :
> service squid restart
Stopping squid: [OK]
Starting squid: [FAILED]
2009/01/30 02:16:07| Processing Configuration File: /etc/squid/squid.conf (depth 0)
2009/01/30 02:16:07| Starting Authentication on port 0.0.0.0:14348
2009/01/30 02:16:07| Disabling Authentication on port 0.0.0.0:14348 (interception enabled)
2009/01/30 02:16:07| Can’t use proxy auth because no authentication schemes are fully configured.
FATAL: ERROR: Invalid ACL: acl login_user proxy_auth REQUIRED

Squid Cache (Version 3.0.STABLE10): Terminated abnormally.
CPU Usage: 0.007 seconds = 0.003 user + 0.004 sys
Maximum Resident Size: 0 KB
Page faults with physical i/o: 0

thanks before….

How do you control auth user for blocking some host, i try to limit with acl but it won’t work.

eg. auth user cannot access google.com but other site are ok

If you guys having this error:

Invalid Proxy Auth ACL 'acl ncsa_users proxy_auth REQUIRED' because no authentication schemes are fully configured.

Just make sure that the code below is set after all the auth_param


acl ncsa_users proxy_auth REQUIRED
http_access allow ncsa_users


Hope this helps.

Hello,
I’ve the same problem than Hedwig, i followed the instruction (and it succeed).
however, when i try to browse sites through internet explorer, the authorization doesn’t come up.
why?

thanks in advance

I have a Linux server & under that i have 150+ client, i want set authentication user name & password of a website in proxy. Just example my http://www.abc.com website login user name :test & password :test123 , when any client brows www,abc.com then it automatically login that site no required to put user & password.

There is a way to get only htpasswd program.

You can just run
make -C /usr/ports/www/apache22

then copy the binary and lib files from the work directory like this:


mkdir /usr/local/sbin/.libs
cp /usr/ports/www/apache22/work/httpd-2.2.11/support/htpasswd /usr/local/sbin/
cp /usr/ports/www/apache22/work/httpd-2.2.11/support/.libs/htpasswd /usr/local/sbin/.libs/


Also you can run
make -C /usr/ports/www/apache22 clean
for cleaning all compiled files. (But you can’t use htpasswd again)

That’s all.

Regarding
`Hello,
I’ve the same problem than Hedwig, i followed the instruction (and it succeed).
however, when i try to browse sites through internet explorer, the authorization doesn’t come up.
why?`

put:

http_access allow ncsa_users

above any other similar lines like:

http_access allow localnet
http_access allow localhost

For those following tutorial and having problems with basic ncsa_auth
check your permissions on /etc/squid/passwd file – proxy or squid should be able to read it, and if you are not running squid as root authentication is going to fail.

search for bind. this is DNS server for Linux..

hope this helps

http://www.yssdragil.com

Dear all,
How to do WPAD(Web Proxy Auto Discovery)
Pls tell me about
Thanks

yeah i got it running! but how can i restrict user account to use only once. because the username i created can use multiple times… like if the account is already in use.. the next user with the same account well be denied..