Setting up proxy authentication

dramacox · 06-27-2011, 04:20 AM

Pls i want to setup a proxy authentication on fedora 15 for minimum of 5 users using squid but i had successfully setup a proxy sever on my system and its working perfecly.# vi /etc/squid/squid.conf
this was the output.

# Recommended minimum configuration:
#
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl localnet src 10.0.0.0/8

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7 # RFC1918 possible internal network
acl localnet src fe80::/10 # RFC 4193 local private network range
acl SSL_ports port 443 # RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 10000
acl Safe_ports port 80 # Webmin
acl Safe_ports port 21 # http
acl Safe_ports port 443 # ftp
acl Safe_ports port 70 # https
acl Safe_ports port 210 # gopher
acl Safe_ports port 1025-65535 # wais
acl Safe_ports port 280 # unregistered ports
acl Safe_ports port 488 # http-mgmt
acl Safe_ports port 591 # gss-http
acl Safe_ports port 777 # filemaker
acl CONNECT method CONNECT # multiling http
acl bad_url dstdomain "/etc/squid/bad-sites.squid"

# Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost

# Deny requests to certain unsafe ports

# Deny CONNECT to other than secure SSL ports

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS

http_access deny manager
http_access deny bad_url
http_access deny !Safe_ports
http_access allow CONNECT !SSL_ports
http_access allow localnet
http_access allow localhost

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access deny all

# And finally deny all other access to this proxy

# Squid normally listens to port 3128
http_port 3128

# We recommend you to use at least the following line.
hierarchy_stoplist cgi-bin ?

# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /var/spool/squid 100 16 256

# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid

# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
cache_effective_user squid
cache_effective_group squid
visible_hostname sitaproxy
unique_hostname sitaproxy

where will i entered the configuration and what are the configuration?
please i need someone to help me out asap. Thanks

Lexus45 · 06-27-2011, 05:43 AM

1. Edit squid.conf:

Code:

auth_param basic program /usr/local/libexec/squid/ncsa_auth /usr/local/etc/squid/users
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours

2. Replace

Code:

http_access allow all

with:

Code:

acl users proxy_auth REQUIRED
http_access allow users
http_access deny all

3. Create /usr/local/etc/squid/users file and add users there.
If you don't have the file yet, do this:

Code:

htpasswd -c /usr/local/etc/squid/users bob
New password: *****
Re-type new password: *****
Adding password for user bob

If you already have the file and want to add another user, do this:

Code:

htpasswd /usr/local/etc/squid/users mary
New password: *****
Re-type new password: *****
Adding password for user mary

You may look through the file:

Code:

cat /usr/local/etc/squid/users
bob:0Q2rNA.AEfZOk

4. Reconfigure SQUID.

Code:

squid -k reconfigure

If you need two groups of users - those who are to be authenticated and those who are not, you need to create 2 ACLs, and then use 2 http_access rules. Yo may need to play with the order of http_access rules to achieve the result.

dramacox · 06-28-2011, 05:58 AM

Thanks i really appreciate ur reply. Am using fedora 15, will this configuration compatible?

Lexus45 · 06-29-2011, 12:48 AM

Quote:

Originally Posted by dramacox

Thanks i really appreciate ur reply. Am using fedora 15, will this configuration compatible?

Have a try and you will know

Of course it will.

dramacox · 06-29-2011, 03:48 AM

Tanx..it works