basic_sspi_auth.exe(8)

NAME
basic_sspi_auth.exe - Basic authentication protocol

Version 2.0

SYNOPSIS
basic_sspi_auth.exe [-d] [-A Group Name ] [-D Group Name ] [-O Default Domain ]

DESCRIPTION
basic_sspi_auth.exe is a simple authentication module for the Squid proxy server running on Windows NT to authenticate users on an NT domain in native WIN32 mode.

Usage is simple. It accepts a username and password on standard input and will return OK if the username/password is valid for the domain/machine, or ERR if there was some problem. It is possible to authenticate against NT trusted domains specifying the username in the domain\username Microsoft notation.

OPTIONS

-A  A Windows Local Group name allowed to authenticate.

-d  Write debug info to stderr.

-D  A Windows Local Group name not allowed to authenticate.

-O  The default Domain against to authenticate.

CONFIGURATION

Users that are allowed to access the web proxy must have the Windows NT User Rights logon from the network and must be included in the NT LOCAL User Groups specified in the Authenticator's command line.

This can be accomplished creating a local user group on the NT machine, grant the privilege, and adding users to it.

You will need to set the following line in squid.conf to enable the authenticator:
    auth_param basic program c:/squid/libexec/basic_sspi_auth.exe [options]

You will need to set the following lines in squid.conf to enable authentication for your access list:
    acl aclName proxy_auth REQUIRED
    http_access allow aclName

You will need to specify the absolute path to basic_sspi_auth.exe in the auth_param basic program directive.

TESTING

I strongly urge that basic_sspi_auth.exe is tested prior to being used in a production environment. It may behave differently on different platforms. To test it, run it from the command line. Enter username and password pairs separated by a space. Press ENTER to get an OK or ERR message. Make sure pressing CTRL-D
 behaves the same as a carriage return. Make sure pressing CTRL-C
 aborts the program.

Test that entering no details does not result in an OK or ERR message.

Test that entering an invalid username and password results in an ERR message.

Note that if NT guest user access is allowed on the PDC, an OK message may be returned instead of ERR

Test that entering a valid username and password results in an OK message.

Test that entering a guest username and password returns the correct response for the site's access policy.

AUTHOR
This program was written by Guido Serassio <guido.serassio@acmeconsulting.it>

Based on prior work by Antonino Iannella (2000) Andrew Tridgell (1997) Richard Sharpe (1996) Bill Welliver (1999)

This manual was written by Guido Serassio <guido.serassio@acmeconsulting.it> Amos Jeffries <amosjeffries@squid-cache.org>

COPYRIGHT

 * Copyright (C) 1996-2023 The Squid Software Foundation and contributors
 *
 * Squid software is distributed under GPLv2+ license and includes
 * contributions from numerous individuals and organizations.
 * Please see the COPYING and CONTRIBUTORS files for details.

This program and documentation is copyright to the authors named above.

Distributed under the GNU General Public License (GNU GPL) version 2 or later (GPLv2+).

QUESTIONS
Questions on the usage of this program can be sent to the Squid Users mailing list <squid-users@lists.squid-cache.org>

REPORTING BUGS
Bug reports need to be made in English. See https://wiki.squid-cache.org/SquidFaq/BugReporting for details of what you need to include with your bug report.

Report bugs or bug fixes using https://bugs.squid-cache.org/

Report serious security bugs to Squid Bugs <squid-bugs@lists.squid-cache.org>

Report ideas for new improvements to the Squid Developers mailing list <squid-dev@lists.squid-cache.org>

SEE ALSO
squid(8), GPL(7),
The Squid FAQ wiki https://wiki.squid-cache.org/SquidFaq
The Squid Configuration Manual http://www.squid-cache.org/Doc/config/