Welcome to this demo clip, User Authentication with Squid. In
this clip, we'll first show how to configure Squid for user
authentication. You'll discover how to set Squid up for basic
authentication. And finally,
we'll cover some of the advanced authentication
mechanisms that are available for you to use.
Let's get started.
So, first let's talk about authentication basics with Squid.
User authentication in Squid is done by using the right access control element
and by designating and configuring an authentication program.
Squid ships with a lot of different authentication programs that you can use.
Some of these include LDAP, database, specifically MySQL,
POP3, if you want to use an email server, and basic
authentication mechanisms, among others.
In this demo, we'll be using the getpwnam program, which uses
the good old UNIX password file to authenticate users against
local user accounts on the server.
The first thing you need to do when setting up user authentication in
Squid is, of course, build out an access control list.
We'll simply use the localnet access control lists, which have
already been built for us, but we'll need to change the access
control list element we're using. We'll need to specify the
proxy_auth ACL element so that we can tell Squid to make sure to use
an auth program for these IP addresses.
With that done, we now need to tell Squid what authentication program we
want to use. This can be done with the auth_param directive. We want to
use basic authentication, and we want to use an external program to
authenticate. Now we just need to tell Squid which program we want to use
by specifying the program path.
In this case, we wanted to use the basic getpwnam_auth program. Now, we can
configure the authentication program. This time, we'll tell the auth_param
directive that for basic auth, we want to spawn five different authentication
processes on startup with one running afterwards.
This can be useful if you have many users that are
authenticating at the same time.
There are several authentication configuration directives that
we can use to provide further customization.
Here's an example of one such directive, the authenticate_ttl directive. This
forces users to reauthenticate after a certain period of time.
Now, we'll require that all users on the localnet need to
authenticate by passing in the REQUIRED option.
You can also specify individual users, if you so
choose. With that out of the way,
let's test that user authentication works appropriately. First,
let's build our Docker image using this command.
Remember, if this is your first time building this image,
you'll have to be patient while Squid is built from
source, as this can take some time.
Now, let's create a container from the image using this
command. We'll make sure to expose port 3128, as that is the
port that Squid runs on by default.
Now let's try to access github.com by way of our running proxy.
If we try without authentication, like this,
you can see that we get this ERR_CACHE_ACCESS_DENIED. That's coming from Squid.
Now let's pass in our basic auth credentials.
We'll pass in the username, testuser,
a user that we have prepopulated inside the running
container, using this command.
And as you can see,
we've successfully authenticated and reached github.com
by way of our running Squid proxy.
This is just one example of how to implement authentication with Squid.
For a full listing of authentication options, check out
this website. And that's it for this demo.
You can now be confident when it comes to implementing the
NIST PR.AC‑4 subcategory, identity management,
authentication, and access control using Squid.