<html><head></head><body><div style="color:#000; background-color:#fff; font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px"><div id="yui_3_16_0_ym19_1_1493723874829_3827"><span>Also good information to know. I'll check into this. </span></div><div id="yui_3_16_0_ym19_1_1493723874829_3827"><span><br></span></div><div id="yui_3_16_0_ym19_1_1493723874829_3827"><span>I'm still finding my way through this and the next step is getting SSH to work over it....no luck with that yet.</span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1493723874829_3797"><br><br></div><div class="yahoo_quoted" id="yui_3_16_0_ym19_1_1493723874829_3982" style="display: block;"> <div style="font-family: Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 13px;" id="yui_3_16_0_ym19_1_1493723874829_3981"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1493723874829_3980"> <div dir="ltr" id="yui_3_16_0_ym19_1_1493723874829_3979"> <font size="2" face="Arial" id="yui_3_16_0_ym19_1_1493723874829_3983"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Amos Jeffries <squid3@treenet.co.nz><br> <b><span style="font-weight: bold;">To:</span></b> squid-users@lists.squid-cache.org <br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, May 1, 2017 7:06 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [squid-users] Tutorial for better authentication than basic<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_ym19_1_1493723874829_3985"><br><div dir="ltr" id="yui_3_16_0_ym19_1_1493723874829_3984">On 02/05/17 09:04, j m wrote:<br clear="none">> Wow, I didn't find that one. Not super secure, but better than clear <br clear="none">> text and I'm not too worried about someone sniffing my packets.<br clear="none">><br clear="none"><br clear="none">The security level with Digest depends on the nonce lifetime and reuse <br clear="none">counter, both of which you can tune to your liking. The shorter those <br clear="none">are the more secure, up to the point where it is a purely one-time <br clear="none">token. That said, some clients (most often browsers) have big trouble <br clear="none">managing nonces in correct order and with dozens of connections open to <br clear="none">the proxy - and then there are Squid bugs. So tuning those is not as <br clear="none">easy as it should be.<br clear="none"><br clear="none">NTLM does not work over the Internet. Kerberos might, but not very well. <br clear="none">They are connection-oriented authentication schemes designed for use in <br clear="none">LAN environments. So for your described situation they are not useful <br clear="none">even if you were willing to open the ports.<br clear="none"><br clear="none">Amos<br clear="none"><br clear="none">_______________________________________________<br clear="none">squid-users mailing list<div class="yqt0977048392" id="yqtfd81153"><br clear="none"><a shape="rect" ymailto="mailto:squid-users@lists.squid-cache.org" href="mailto:squid-users@lists.squid-cache.org" id="yui_3_16_0_ym19_1_1493723874829_3986">squid-users@lists.squid-cache.org</a></div><br clear="none"><a shape="rect" href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank" id="yui_3_16_0_ym19_1_1493723874829_3987">http://lists.squid-cache.org/listinfo/squid-users</a><div class="yqt0977048392" id="yqtfd97438"><br clear="none"></div></div><br><br></div> </div> </div> </div></div></body></html>