WEBVTT 00:00:01.240 --> 00:00:05.930 Welcome to this demo clip, User Authentication with Squid. In 00:00:05.930 --> 00:00:09.180 this clip, we'll first show how to configure Squid for user 00:00:09.180 --> 00:00:13.310 authentication. You'll discover how to set Squid up for basic 00:00:13.310 --> 00:00:15.350 authentication. And finally, 00:00:15.450 --> 00:00:17.600 we'll cover some of the advanced authentication 00:00:17.600 --> 00:00:19.860 mechanisms that are available for you to use. 00:00:20.740 --> 00:00:21.660 Let's get started. 00:00:22.440 --> 00:00:25.950 So, first let's talk about authentication basics with Squid. 00:00:26.640 --> 00:00:30.750 User authentication in Squid is done by using the right access control element 00:00:31.340 --> 00:00:34.850 and by designating and configuring an authentication program. 00:00:35.640 --> 00:00:39.660 Squid ships with a lot of different authentication programs that you can use. 00:00:40.240 --> 00:00:44.870 Some of these include LDAP, database, specifically MySQL, 00:00:44.870 --> 00:00:48.810 POP3, if you want to use an email server, and basic 00:00:48.810 --> 00:00:50.860 authentication mechanisms, among others. 00:00:52.040 --> 00:00:56.820 In this demo, we'll be using the getpwnam program, which uses 00:00:56.820 --> 00:01:00.280 the good old UNIX password file to authenticate users against 00:01:00.280 --> 00:01:02.260 local user accounts on the server. 00:01:02.840 --> 00:01:05.620 The first thing you need to do when setting up user authentication in 00:01:05.620 --> 00:01:08.750 Squid is, of course, build out an access control list. 00:01:09.440 --> 00:01:13.150 We'll simply use the localnet access control lists, which have 00:01:13.150 --> 00:01:16.800 already been built for us, but we'll need to change the access 00:01:16.800 --> 00:01:21.520 control list element we're using. We'll need to specify the 00:01:21.520 --> 00:01:26.870 proxy_auth ACL element so that we can tell Squid to make sure to use 00:01:26.870 --> 00:01:29.950 an auth program for these IP addresses. 00:01:31.740 --> 00:01:36.120 With that done, we now need to tell Squid what authentication program we 00:01:36.120 --> 00:01:43.170 want to use. This can be done with the auth_param directive. We want to 00:01:43.170 --> 00:01:47.410 use basic authentication, and we want to use an external program to 00:01:47.410 --> 00:01:52.770 authenticate. Now we just need to tell Squid which program we want to use 00:01:52.850 --> 00:01:54.850 by specifying the program path. 00:01:55.540 --> 00:02:03.320 In this case, we wanted to use the basic getpwnam_auth program. Now, we can 00:02:03.320 --> 00:02:08.570 configure the authentication program. This time, we'll tell the auth_param 00:02:08.570 --> 00:02:13.170 directive that for basic auth, we want to spawn five different authentication 00:02:13.170 --> 00:02:16.660 processes on startup with one running afterwards. 00:02:17.440 --> 00:02:20.380 This can be useful if you have many users that are 00:02:20.380 --> 00:02:22.150 authenticating at the same time. 00:02:23.240 --> 00:02:26.260 There are several authentication configuration directives that 00:02:26.260 --> 00:02:28.960 we can use to provide further customization. 00:02:29.940 --> 00:02:36.200 Here's an example of one such directive, the authenticate_ttl directive. This 00:02:36.200 --> 00:02:39.460 forces users to reauthenticate after a certain period of time. 00:02:41.340 --> 00:02:45.690 Now, we'll require that all users on the localnet need to 00:02:45.690 --> 00:02:48.750 authenticate by passing in the REQUIRED option. 00:02:49.440 --> 00:02:52.320 You can also specify individual users, if you so 00:02:52.320 --> 00:02:54.820 choose. With that out of the way, 00:02:54.830 --> 00:02:59.340 let's test that user authentication works appropriately. First, 00:02:59.340 --> 00:03:02.460 let's build our Docker image using this command. 00:03:05.240 --> 00:03:07.770 Remember, if this is your first time building this image, 00:03:07.850 --> 00:03:09.830 you'll have to be patient while Squid is built from 00:03:09.830 --> 00:03:11.860 source, as this can take some time. 00:03:12.640 --> 00:03:15.580 Now, let's create a container from the image using this 00:03:15.580 --> 00:03:21.930 command. We'll make sure to expose port 3128, as that is the 00:03:21.930 --> 00:03:24.060 port that Squid runs on by default. 00:03:24.640 --> 00:03:29.460 Now let's try to access github.com by way of our running proxy. 00:03:30.640 --> 00:03:33.850 If we try without authentication, like this, 00:03:39.140 --> 00:03:44.760 you can see that we get this ERR_CACHE_ACCESS_DENIED. That's coming from Squid. 00:03:45.340 --> 00:03:47.950 Now let's pass in our basic auth credentials. 00:03:48.440 --> 00:03:50.450 We'll pass in the username, testuser, 00:03:50.840 --> 00:03:53.550 a user that we have prepopulated inside the running 00:03:53.550 --> 00:03:55.550 container, using this command. 00:03:58.440 --> 00:03:59.750 And as you can see, 00:03:59.760 --> 00:04:03.200 we've successfully authenticated and reached github.com 00:04:03.210 --> 00:04:05.360 by way of our running Squid proxy. 00:04:06.540 --> 00:04:10.350 This is just one example of how to implement authentication with Squid. 00:04:10.840 --> 00:04:14.130 For a full listing of authentication options, check out 00:04:14.130 --> 00:04:17.360 this website. And that's it for this demo. 00:04:17.839 --> 00:04:20.800 You can now be confident when it comes to implementing the 00:04:20.800 --> 00:04:25.810 NIST PR.AC‑4 subcategory, identity management, 00:04:25.820 --> 00:04:29.360 authentication, and access control using Squid.