Squid3 local authentication not authenticating

CubedRoot

Hello all. I have been having issues getting local authentication to work in Squid3.

If I set authentication to none, everything works great. I can use the proxy, see my remote machine getting succesfull packets in the access and cache logs, and it works great. So I then decided to setup local authentication.

I enabled Local authentication, saved the configuration and then went to the users tab and created my user. I then saved the config again, and restarted the squid service.

Now, my PC will get the authentication box, and when I enter my credentials, I keep getting prompted. It doesnt appear that I am getting autenticated using local auth.

If I do a tail -f on access.log on my pfsense machine here is what I see:
1424320805.815 4 192.168.1.111 TCP_DENIED/407 3810 CONNECT aus3.mozilla.org:443 cubedroot HIER_NONE/- text/html
1424320805.815 3 192.168.1.111 TCP_DENIED/407 3775 CONNECT blocklist.addons.mozilla.org:443 cubedroot HIER_NONE/- text/html

Everytime I enter my credentials, and press enter, I get 2 lines that look like the two above.

Here's my setup information:
2.2-RELEASE (amd64)
built on Thu Jan 22 14:03:54 CST 2015

Squid 3 package version: 3.4.10_2 pkg 0.2.6

I have also verified that my username is showing up in the squid.passwd. Any suggestions?

marcelloc

I've tested local authentication without issues today.

Try to add your local network on first squid acl.

Also check cache.log to see if it shows any warning or error.

CubedRoot

Thanks for the reply.

Here is what my ACL configuration looks like. I have my local network on the first ACL: http://i.imgur.com/WBJiTfA.png

Here is the last 50 lines of my cache.log: http://fpaste.org/187850/14243824/

However, if I do a tail -f on cache.log and access.log and keep it running, and then go to my machine and try to use the proxy, I get prompted for authentication, and as soon as I enter my credentials, the box will pop back up and then I see these entries in the access.log:

1424382534.663 0 192.168.1.2 TCP_DENIED/407 4071 GET http://google.com/ - HIER_NONE/- text/html
This line pops up right when the authentication box is displayed

1424382547.914 4 192.168.1.2 TCP_DENIED/407 4221 GET http://google.com/ cubedroot HIER_NONE/- text/html
After I enter my credentials and press enter, I get this line.

Then there are no more entries in the logs. cubedroot is the user I tried to authenticate with.

I also double checked… If I disabled local authentication, the proxy works great and I see things like this in the logs:
==> access.log <==
1424382661.430 44 192.168.1.2 TCP_MISS/301 665 GET http://google.com/ - HIER_DIRECT/74.205.129.30 text/html
1424382661.472 39 192.168.1.2 TCP_MISS/302 802 GET http://www.google.com/ - HIER_DIRECT/74.125.196.104 text/html
1424382661.609 44 192.168.1.2 TCP_MISS/200 871 POST http://clients1.google.com/ocsp - HIER_DIRECT/74.205.129.38 application/ocsp-response

Nothing in cache.log
Is there anyway to totally blow away all squid related packages and files and just reinstall?

marcelloc

Did you tried a simple passwork without special characters?

CubedRoot

NICE! I believe I found the problem. It looks as if the webform field for the password is truncating everything after 8 characters. The password I was using had 12 characters.

I am able to use any password as long as it is 8 characters or below. If I create a password that has more than 8 characters it wont authenticate.

For example:
password of: 12345678 works great.

Changed password to: 123456789
Will not authenticate. HOWEVER if I use 12345678 for the password it works.

To test my thesis, I reset the password to ABCDEFGHI
Will not authenticate with that password. But, if i use ABCDEFGH i am able to authenticate without any issues.

I am not sure if there is an eight character password limit in the samba.passwd file, or if its a limit in the entry field of the web page for the user. But, using any string as long as its 8 characters or below in that field works.

lgalford

hi,

did you find the solution for this issue?

I have the same problem but if I write a 123456 password it keeps with the same behaviour.

Rgds
Luis

jimp

Update to the latest squid package. I have put in a fix to properly handle longer passwords.