Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm connected to a squid proxy that does digest authentication , and I have installed another squid proxy on my centOS 6.4 and configured it to use the upper proxy .

The problem is that I need another PC to connect to my proxy without authentication and that means the authentication must be done in my proxy somewhere in squid.conf

Any ideas?

share|improve this question
    
Can you further elaborate your question or some sort of figure. As i think it is hard to get what you are trying to achieve –  Ali Ahmad Aug 27 '13 at 10:04
    
assume there are two proxies A and B , A is using digest , I want to connect B to A "this will need authentication" , so any user access to the internet using B will not need authenticating . –  Emado Aug 27 '13 at 10:14

1 Answer 1

up vote 1 down vote accepted

This page states that the cache_peer configuration command is used to set an "upper proxy", and that command accepts the login=user:password option to handle authentication with that upper proxy. Note the following:

  • In HTTP authentication, the client (here, your own proxy) does not know beforehand what kind of authentication the server (here, the upper proxy) requires; if the upper proxy wants to do Digest authentication, it will tell it to your proxy dynamically (with a WWW-Authenticate header).

  • Your squid proxy must necessarily "know" your password, since it must be able to use it to authenticate with the upper proxy (either by sending it directly, with "Basic" authentication, or by computing hashes over the concatenation of the password and a challenge with "Digest" authentication). This implies that your password will be stored "as is" in the configuration file for your Squid. You'd better protect it correctly. I also encourage you to check whether writing down your password in a file is legally/contractually compatible with the rules which are in force at your organization.

  • If you allow "the other PC" to connect to your Squid without authentication, then you may open a door which allows everybody to connect to your Squid without authentication. There again, your local sysadmins may frown upon these things. Caution is advised.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.