<html><head></head><body><div style="color:#000; background-color:#fff; font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px"><div id="yui_3_16_0_ym19_1_1495846827670_2833"><span id="yui_3_16_0_ym19_1_1495846827670_2892">Yes, I sort of pieced together what I found online, which is probably dangerous. I really need to become familiar with how exactly this works for security's sake if nothing else.</span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1495846827670_2834"><br><br></div><div class="yahoo_quoted" id="yui_3_16_0_ym19_1_1495846827670_2943" style="display: block;"> <div style="font-family: Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 13px;" id="yui_3_16_0_ym19_1_1495846827670_2942"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1495846827670_2941"> <div dir="ltr" id="yui_3_16_0_ym19_1_1495846827670_2940"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Amos Jeffries <squid3@treenet.co.nz><br> <b><span style="font-weight: bold;">To:</span></b> j m <acctforjunk@yahoo.com>; "squid-users@lists.squid-cache.org" <squid-users@lists.squid-cache.org> <br> <b><span style="font-weight: bold;">Sent:</span></b> Friday, May 26, 2017 2:53 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [squid-users] TCP_DENIED/407 accessing webserver on same machine as squid<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_ym19_1_1495846827670_2944"><br><div dir="ltr" id="yui_3_16_0_ym19_1_1495846827670_2945">Ah, your problem seems to be a misunderstanding of how authentication works.<br clear="none"><br clear="none">What Squid receives on messages can have three forms:<br clear="none"><br clear="none"> 1) no credentials at all<br clear="none"> 2) correct credentials<br clear="none"> 3) invalid credentials<br clear="none"><br clear="none">Your definition of the auth_users ACL using "REQUIRED" takes care of the <br clear="none">(1) situation. Squid will respond with 407 to get credentials from any <br clear="none">client that does not send any. This is what you are seeing on that <br clear="none">second log line of your previous post, and the popup in your tests.<br clear="none"><br clear="none">Now the "http_access allow auth_users" line only takes care of situation <br clear="none">(2), permitting valid users.<br clear="none"><br clear="none">Which leaves situation (3) undefined. ... All other traffic continues on <br clear="none">to the next http_access line, which is "allow all", ouch.<br clear="none"><br clear="none"><br clear="none">This is why best practice is to use a "deny" line like so:<br clear="none"> http_access deny !auth_users<br clear="none"><br clear="none">... which makes it clear what is happening for every non-authenticated <br clear="none">thing, both situation (1) and (2) traffic.<br clear="none"><br clear="none">Rules permitting things through without authenticating go above that <br clear="none">http_access line, and things applying to authenticated users go below it.<div class="yqt6086043234" id="yqtfd39901"><br clear="none"><br clear="none">Amos<br clear="none"><br clear="none"></div></div><br><br></div> </div> </div> </div></div></body></html>