<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office"><head><!--[if gte mso 9]><xml><o:OfficeDocumentSettings><o:AllowPNG/><o:PixelsPerInch>96</o:PixelsPerInch></o:OfficeDocumentSettings></xml><![endif]--></head><body><div style="color:#000; background-color:#fff; font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px"><div id="yui_3_16_0_ym19_1_1493728360870_2788" dir="ltr"><span id="yui_3_16_0_ym19_1_1493728360870_2943">Here's a question: if I use SSL or TLS encryption between squid and browser, would even the basic auth login be encrypted? </span></div><div id="yui_3_16_0_ym19_1_1493728360870_2788" dir="ltr"><span><br></span></div><div id="yui_3_16_0_ym19_1_1493728360870_2788" dir="ltr"><span id="yui_3_16_0_ym19_1_1493728360870_3077">I'm thinking that instead of trying to use the proxy to SSH through, I could use something like shellinabox over the proxy if the link is encrypted. This would be much easier and serve the purpose.</span></div><div id="yui_3_16_0_ym19_1_1493728360870_2788" dir="ltr"><span><br></span></div><div id="yui_3_16_0_ym19_1_1493728360870_2788" dir="ltr"><span id="yui_3_16_0_ym19_1_1493728360870_3078">According to this link, it seems pretty straightforward to get Firefox or Chrome to do it: <a href="http://wiki.squid-cache.org/Features/HTTPS#Chrome" id="yui_3_16_0_ym19_1_1493728360870_3124">wiki.squid-cache.org/Features/HTTPS#Chrome</a></span></div><div id="yui_3_16_0_ym19_1_1493728360870_2788" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1493728360870_2788" dir="ltr">Would the default config located at <a href="http://wiki.squid-cache.org/SquidFaq/ConfiguringSquid#Squid-3.5_default_config" id="yui_3_16_0_ym19_1_1493728360870_3269">wiki.squid-cache.org/SquidFaq/ConfiguringSquid#Squid-3.5_default_config</a> allow this?</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1493728360870_2787"><br><br></div><div class="yahoo_quoted" id="yui_3_16_0_ym19_1_1493728360870_2784" style="display: block;"> <div style="font-family: Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 13px;" id="yui_3_16_0_ym19_1_1493728360870_2783"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1493728360870_2782"> <div dir="ltr" id="yui_3_16_0_ym19_1_1493728360870_2781"> <font size="2" face="Arial" id="yui_3_16_0_ym19_1_1493728360870_2786"> <hr size="1" id="yui_3_16_0_ym19_1_1493728360870_2785"> <b><span style="font-weight:bold;">From:</span></b> Amos Jeffries <squid3@treenet.co.nz><br> <b><span style="font-weight: bold;">To:</span></b> squid-users@lists.squid-cache.org <br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, May 1, 2017 7:06 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [squid-users] Tutorial for better authentication than basic<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_ym19_1_1493728360870_2926"><br><div dir="ltr" id="yui_3_16_0_ym19_1_1493728360870_2927">On 02/05/17 09:04, j m wrote:<br clear="none">> Wow, I didn't find that one. Not super secure, but better than clear <br clear="none">> text and I'm not too worried about someone sniffing my packets.<br clear="none">><br clear="none"><br clear="none">The security level with Digest depends on the nonce lifetime and reuse <br clear="none">counter, both of which you can tune to your liking. The shorter those <br clear="none">are the more secure, up to the point where it is a purely one-time <br clear="none">token. That said, some clients (most often browsers) have big trouble <br clear="none">managing nonces in correct order and with dozens of connections open to <br clear="none">the proxy - and then there are Squid bugs. So tuning those is not as <br clear="none">easy as it should be.<br clear="none"><br clear="none">NTLM does not work over the Internet. Kerberos might, but not very well. <br clear="none">They are connection-oriented authentication schemes designed for use in <br clear="none">LAN environments. So for your described situation they are not useful <br clear="none">even if you were willing to open the ports.<br clear="none"><br clear="none">Amos<br clear="none"><br clear="none">_______________________________________________<br clear="none">squid-users mailing list<div class="yqt5597504276" id="yqtfd77729"><br clear="none"><a shape="rect" ymailto="mailto:squid-users@lists.squid-cache.org" href="mailto:squid-users@lists.squid-cache.org" id="yui_3_16_0_ym19_1_1493728360870_3270">squid-users@lists.squid-cache.org</a></div><br clear="none"><a shape="rect" href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank" id="yui_3_16_0_ym19_1_1493728360870_3271">http://lists.squid-cache.org/listinfo/squid-users</a><div class="yqt5597504276" id="yqtfd20055"><br clear="none"></div></div><br><br></div> </div> </div> </div></div></body></html>