<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi all,<br>
<br>
I have a solution in place with a dedicated squid LXC container (v
3.1.20-2.2).<br>
Both http and https proxy run on default port 3128.<br>
Https in tunneled in http using CONNECT.<br>
There is no authentication in place and both are working fine.<br>
<br>
For testing purposes we also use an Apache (v 2.2.22-13) proxy
forwarder running on a different machine on port 80 as "aproxy".<br>
</p>
<p>Config below:<br>
<br>
<i># Authenticated proxy for testing purposes</i><i><br>
</i><i># We forward http/s requests to the local proxy server</i><i><br>
</i><i>ProxyRequests On</i><i><br>
</i><i>ProxyVia On</i><i><br>
</i><i>ProxyRemote http <a class="moz-txt-link-freetext" href="http://proxy.example.internal:3128">http://proxy.example.internal:3128</a></i><i><br>
</i><i>ProxyRemote https <a class="moz-txt-link-freetext" href="http://proxy.example.internal:3128">http://proxy.example.internal:3128</a></i><i><br>
</i><i>ProxyDomain .example.internal</i><i><br>
</i><i>NoProxy .example.internal 192.168.x.x/22</i><i><br>
</i><i><Proxy *></i><i><br>
</i><i> Order Deny,Allow</i><i><br>
</i><i> Deny from all</i><i><br>
</i><i> Allow from 192.168.x.x/22</i><i><br>
</i><i> AuthType Basic</i><i><br>
</i><i> AuthName ProxyAuth</i><i><br>
</i><i> AuthUserFile /etc/apache2/proxypasswd</i><i><br>
</i><i> Require valid-user</i><i><br>
</i><i></Proxy></i><br>
<br>
This is working as expected for http requests:<br>
<br>
1. Unauthenticated (failure):<br>
<br>
<i>$ http_proxy=<a class="moz-txt-link-freetext" href="http://aproxy:80">http://aproxy:80</a></i><i><br>
</i><i>$ wget <a class="moz-txt-link-freetext" href="http://example.com">http://example.com</a> 2>&1 | grep response</i><i><br>
</i><i>Proxy request sent, awaiting response... 407 Proxy
Authentication Required</i><br>
<br>
2. Username with password (success):<br>
<br>
<i>$ http_proxy=<a class="moz-txt-link-freetext" href="http://username1:password@aproxy:80">http://username1:password@aproxy:80</a></i><i><br>
</i><i>$ wget <a class="moz-txt-link-freetext" href="http://example.com">http://example.com</a> 2>&1 | grep response</i><i><br>
</i><i>Proxy request sent, awaiting response... 200 OK</i><br>
<br>
3. Username without password (success):<br>
<i><br>
</i><i>$ http_proxy=<a class="moz-txt-link-freetext" href="http://username2:@aproxy:80">http://username2:@aproxy:80</a></i><i><br>
</i><i>$ wget <a class="moz-txt-link-freetext" href="http://example.com">http://example.com</a> 2>&1 | grep response</i><i><br>
</i><i>Proxy request sent, awaiting response... 200 OK</i><br>
<br>
My <b>PROBLEM</b> is I can't find a way to use authentication for
proxied https requests.<br>
<br>
From a LAN client trying to establish connection:<br>
<br>
<i>$ echo $http_proxy</i><i><br>
</i><i><a class="moz-txt-link-freetext" href="http://username1:password@aproxy:80">http://username1:password@aproxy:80</a></i><i><br>
</i></p>
<p><i>$ echo $https_proxy</i><i><br>
</i><i><a class="moz-txt-link-freetext" href="http://username1:password@aproxy:80">http://username1:password@aproxy:80</a></i><i><br>
</i></p>
<p><i>$ wget --server-response <a class="moz-txt-link-freetext" href="https://example.com">https://example.com</a> 2>&1</i><i><br>
</i><i>--2018-03-29 15:20:44-- <a class="moz-txt-link-freetext" href="https://example.com/">https://example.com/</a></i><i><br>
</i><i>Resolving aproxy (aproxy)... 192.168.x.x</i><i><br>
</i><i>Connecting to aproxy (aproxy)|192.168.x.x|:80... connected.</i><i><br>
</i><i>Proxy tunneling failed: Service Temporarily
UnavailableUnable to establish SSL connection.</i><br>
<br>
On "aproxy" only one line in apache error log (even in debug
mode):<br>
<br>
<i>[Thu Mar 29 15:21:59 2018] [error] (111)Connection refused:
proxy: CONNECT: attempt to connect to 93.184.216.34:443
(example.com) failed</i><br>
<br>
Nothing is logged on squid "proxy" which is the next hop.<br>
<br>
What's the easiest way to enable authenticated https proxying?<br>
I don't want to enable it for our main production proxy:3128<br>
Or maybe it's already supposed to work but I'm missing something?<br>
<br>
Please advise.<br>
<br>
Thanks<br>
Adam<br>
</p>
</body>
</html>