Skip to content

Commit f384c76

Browse files
squidadmsquidadm
committed
2025-12-05
1 parent 4eff85d commit f384c76

File tree

7 files changed

+236
-19
lines changed

7 files changed

+236
-19
lines changed

‎squid-users/2025-December.txt‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,3 +131,75 @@ https://proxy.example.org:portnum/ as the proxy address.
131131

132132

133133

134+
From squid3 at treenet.co.nz Fri Dec 5 07:52:21 2025
135+
From: squid3 at treenet.co.nz (Amos Jeffries)
136+
Date: Fri, 5 Dec 2025 20:52:21 +1300
137+
Subject: [squid-users] MFA with squid, is it possible?
138+
In-Reply-To: <CABA8h=R2_LzKNDmqiJjixPOrqNu7eHPWa1P5zuExFR8U_k_iTQ@mail.gmail.com>
139+
References: <CABA8h=R2_LzKNDmqiJjixPOrqNu7eHPWa1P5zuExFR8U_k_iTQ@mail.gmail.com>
140+
Message-ID: <[email protected]>
141+
142+
On 04/12/2025 02:31, NgTech LTD wrote:
143+
> I was wondering if it's possible to use 2fa with squid?
144+
145+
Of course.
146+
147+
> If so, how?
148+
149+
As you know, helpers can do anything you can code/script as their
150+
actions to validate standard HTTP login credentials.
151+
152+
All it takes is a helper that triggers the 2nd-factor query before
153+
accepting the login.
154+
155+
A classic example of this which is available in all Squid today is the
156+
SQL_session helper "ACTIVE" mode. In that case the 2nd-factor is the
157+
prior use of some specific URL.
158+
159+
A more modern example is OAuth Bearer authentication. Though this
160+
requires patching of Squid since the feature is not yet passed official
161+
review.
162+
163+
A somewhat unconventional approach prior to Bearer invention was/is to
164+
use HTTP Basic auth where the password is a temporary token (or Digest
165+
auth with a single-use nonce) that can only validate when used on a POST
166+
with some 2nd-factor details in the request message content. Whereupon
167+
the user:pass details are changed to something else.
168+
169+
170+
> The authentication?of squid is based on a couple methods, but, by what I
171+
> can identify the 2fa? Is there any option to use some kind of token
172+
> which can be acquired?via some external authentication service?
173+
174+
2FA is pretty much the definition of a how captured-portal logins work.
175+
So yes, or course.
176+
177+
Modern Squid are configured with "auth_param ... key_extras" in
178+
squid.conf to pass arbitrary 2FA details to the helper. These can be
179+
user-provided such as 2FA tokens, or something implicit like client IP
180+
or Set-Cookie headers.
181+
182+
183+
> I am unsure if it's doable or not.
184+
> I have seen a couple VPN services which offer 2fa, but all of these have
185+
> connection based authentication.
186+
187+
Nod. VPN are typically connection-oriented designs. It is way easier to
188+
tie tracking of whole sessions to something persistent like TCP socket
189+
or src-IP, than to juggle 2FA on a per-message basis.
190+
191+
192+
> The issue with a proxy connection is that the client-to-service
193+
> connection is in plain text.
194+
195+
As others have mentioned, Squid is perfectly capable of receiving
196+
encrypted traffic directly from any agent.
197+
198+
The misconception comes from Browsers historically lacking the ability
199+
to use encrypted proxies. Which is entirely a Browser issue, not a
200+
property of Squid.
201+
202+
203+
Cheers
204+
Amos
205+

‎squid-users/2025-December/027717.html‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
</style>
1414
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
1515
<LINK REL="Previous" HREF="027716.html">
16-
16+
<LINK REL="Next" HREF="027718.html">
1717
</HEAD>
1818
<BODY BGCOLOR="#ffffff">
1919
<H1>[squid-users] MFA with squid, is it possible?</H1>
@@ -25,7 +25,8 @@ <H1>[squid-users] MFA with squid, is it possible?</H1>
2525
<P><UL>
2626
<LI>Previous message (by thread): <A HREF="027716.html">[squid-users] MFA with squid, is it possible?
2727
</A></li>
28-
28+
<LI>Next message (by thread): <A HREF="027718.html">[squid-users] MFA with squid, is it possible?
29+
</A></li>
2930
<LI> <B>Messages sorted by:</B>
3031
<a href="date.html#27717">[ date ]</a>
3132
<a href="thread.html#27717">[ thread ]</a>
@@ -46,13 +47,15 @@ <H1>[squid-users] MFA with squid, is it possible?</H1>
4647

4748
</PRE>
4849

50+
4951
<!--endarticle-->
5052
<HR>
5153
<P><UL>
5254
<!--threads-->
5355
<LI>Previous message (by thread): <A HREF="027716.html">[squid-users] MFA with squid, is it possible?
5456
</A></li>
55-
57+
<LI>Next message (by thread): <A HREF="027718.html">[squid-users] MFA with squid, is it possible?
58+
</A></li>
5659
<LI> <B>Messages sorted by:</B>
5760
<a href="date.html#27717">[ date ]</a>
5861
<a href="thread.html#27717">[ thread ]</a>

‎squid-users/2025-December/027718.html‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
2+
<HTML>
3+
<HEAD>
4+
<TITLE> [squid-users] MFA with squid, is it possible?
5+
</TITLE>
6+
<LINK REL="Index" HREF="index.html" >
7+
<LINK REL="made" HREF="mailto:squid-users%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-users%5D%20MFA%20with%20squid%2C%20is%20it%20possible%3F&In-Reply-To=%3C80c14c0b-28c5-4135-91a5-cb1fd561f708%40treenet.co.nz%3E">
8+
<META NAME="robots" CONTENT="index,nofollow">
9+
<style type="text/css">
10+
pre {
11+
white-space: pre-wrap; /* css-2.1, curent FF, Opera, Safari */
12+
}
13+
</style>
14+
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
15+
<LINK REL="Previous" HREF="027717.html">
16+
17+
</HEAD>
18+
<BODY BGCOLOR="#ffffff">
19+
<H1>[squid-users] MFA with squid, is it possible?</H1>
20+
<B>Amos Jeffries</B>
21+
<A HREF="mailto:squid-users%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-users%5D%20MFA%20with%20squid%2C%20is%20it%20possible%3F&In-Reply-To=%3C80c14c0b-28c5-4135-91a5-cb1fd561f708%40treenet.co.nz%3E"
22+
TITLE="[squid-users] MFA with squid, is it possible?">squid3 at treenet.co.nz
23+
</A><BR>
24+
<I>Fri Dec 5 07:52:21 UTC 2025</I>
25+
<P><UL>
26+
<LI>Previous message (by thread): <A HREF="027717.html">[squid-users] MFA with squid, is it possible?
27+
</A></li>
28+
29+
<LI> <B>Messages sorted by:</B>
30+
<a href="date.html#27718">[ date ]</a>
31+
<a href="thread.html#27718">[ thread ]</a>
32+
<a href="subject.html#27718">[ subject ]</a>
33+
<a href="author.html#27718">[ author ]</a>
34+
</LI>
35+
</UL>
36+
<HR>
37+
<!--beginarticle-->
38+
<PRE>On 04/12/2025 02:31, NgTech LTD wrote:
39+
&gt;<i> I was wondering if it's possible to use 2fa with squid?
40+
</I>
41+
Of course.
42+
43+
&gt;<i> If so, how?
44+
</I>
45+
As you know, helpers can do anything you can code/script as their
46+
actions to validate standard HTTP login credentials.
47+
48+
All it takes is a helper that triggers the 2nd-factor query before
49+
accepting the login.
50+
51+
A classic example of this which is available in all Squid today is the
52+
SQL_session helper &quot;ACTIVE&quot; mode. In that case the 2nd-factor is the
53+
prior use of some specific URL.
54+
55+
A more modern example is OAuth Bearer authentication. Though this
56+
requires patching of Squid since the feature is not yet passed official
57+
review.
58+
59+
A somewhat unconventional approach prior to Bearer invention was/is to
60+
use HTTP Basic auth where the password is a temporary token (or Digest
61+
auth with a single-use nonce) that can only validate when used on a POST
62+
with some 2nd-factor details in the request message content. Whereupon
63+
the user:pass details are changed to something else.
64+
65+
66+
&gt;<i> The authentication&#160;of squid is based on a couple methods, but, by what I
67+
</I>&gt;<i> can identify the 2fa? Is there any option to use some kind of token
68+
</I>&gt;<i> which can be acquired&#160;via some external authentication service?
69+
</I>
70+
2FA is pretty much the definition of a how captured-portal logins work.
71+
So yes, or course.
72+
73+
Modern Squid are configured with &quot;auth_param ... key_extras&quot; in
74+
squid.conf to pass arbitrary 2FA details to the helper. These can be
75+
user-provided such as 2FA tokens, or something implicit like client IP
76+
or Set-Cookie headers.
77+
78+
79+
&gt;<i> I am unsure if it's doable or not.
80+
</I>&gt;<i> I have seen a couple VPN services which offer 2fa, but all of these have
81+
</I>&gt;<i> connection based authentication.
82+
</I>
83+
Nod. VPN are typically connection-oriented designs. It is way easier to
84+
tie tracking of whole sessions to something persistent like TCP socket
85+
or src-IP, than to juggle 2FA on a per-message basis.
86+
87+
88+
&gt;<i> The issue with a proxy connection is that the client-to-service
89+
</I>&gt;<i> connection is in plain text.
90+
</I>
91+
As others have mentioned, Squid is perfectly capable of receiving
92+
encrypted traffic directly from any agent.
93+
94+
The misconception comes from Browsers historically lacking the ability
95+
to use encrypted proxies. Which is entirely a Browser issue, not a
96+
property of Squid.
97+
98+
99+
Cheers
100+
Amos
101+
</PRE>
102+
103+
<!--endarticle-->
104+
<HR>
105+
<P><UL>
106+
<!--threads-->
107+
<LI>Previous message (by thread): <A HREF="027717.html">[squid-users] MFA with squid, is it possible?
108+
</A></li>
109+
110+
<LI> <B>Messages sorted by:</B>
111+
<a href="date.html#27718">[ date ]</a>
112+
<a href="thread.html#27718">[ thread ]</a>
113+
<a href="subject.html#27718">[ subject ]</a>
114+
<a href="author.html#27718">[ author ]</a>
115+
</LI>
116+
</UL>
117+
118+
<hr>
119+
<a href="https://lists.squid-cache.org/listinfo/squid-users">More information about the squid-users
120+
mailing list</a><br>
121+
</body></html>

‎squid-users/2025-December/author.html‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@ <h1>December 2025 Archives by author</h1>
1919
</a></b></li>
2020
</ul>
2121
<p><b>Starting:</b> <i>Wed Dec 3 03:32:07 UTC 2025</i><br>
22-
<b>Ending:</b> <i>Thu Dec 4 12:11:25 UTC 2025</i><br>
23-
<b>Messages:</b> 4<p>
22+
<b>Ending:</b> <i>Fri Dec 5 07:52:21 UTC 2025</i><br>
23+
<b>Messages:</b> 5<p>
2424
<ul>
2525

2626
<LI><A HREF="027716.html">[squid-users] MFA with squid, is it possible?
@@ -38,6 +38,11 @@ <h1>December 2025 Archives by author</h1>
3838
<I>Amos Jeffries
3939
</I>
4040

41+
<LI><A HREF="027718.html">[squid-users] MFA with squid, is it possible?
42+
</A><A NAME="27718">&nbsp;</A>
43+
<I>Amos Jeffries
44+
</I>
45+
4146
<LI><A HREF="027715.html">[squid-users] MFA with squid, is it possible?
4247
</A><A NAME="27715">&nbsp;</A>
4348
<I>NgTech LTD
@@ -46,8 +51,8 @@ <h1>December 2025 Archives by author</h1>
4651
</ul>
4752
<p>
4853
<a name="end"><b>Last message date:</b></a>
49-
<i>Thu Dec 4 12:11:25 UTC 2025</i><br>
50-
<b>Archived on:</b> <i>Thu Dec 4 12:11:36 UTC 2025</i>
54+
<i>Fri Dec 5 07:52:21 UTC 2025</i><br>
55+
<b>Archived on:</b> <i>Fri Dec 5 07:52:27 UTC 2025</i>
5156
<p>
5257
<ul>
5358
<li> <b>Messages sorted by:</b>

‎squid-users/2025-December/date.html‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@ <h1>December 2025 Archives by date</h1>
1919
</a></b></li>
2020
</ul>
2121
<p><b>Starting:</b> <i>Wed Dec 3 03:32:07 UTC 2025</i><br>
22-
<b>Ending:</b> <i>Thu Dec 4 12:11:25 UTC 2025</i><br>
23-
<b>Messages:</b> 4<p>
22+
<b>Ending:</b> <i>Fri Dec 5 07:52:21 UTC 2025</i><br>
23+
<b>Messages:</b> 5<p>
2424
<ul>
2525

2626
<LI><A HREF="027714.html">[squid-users] CVE-2025-62168
@@ -41,13 +41,18 @@ <h1>December 2025 Archives by date</h1>
4141
<LI><A HREF="027717.html">[squid-users] MFA with squid, is it possible?
4242
</A><A NAME="27717">&nbsp;</A>
4343
<I>Stuart Henderson
44+
</I>
45+
46+
<LI><A HREF="027718.html">[squid-users] MFA with squid, is it possible?
47+
</A><A NAME="27718">&nbsp;</A>
48+
<I>Amos Jeffries
4449
</I>
4550

4651
</ul>
4752
<p>
4853
<a name="end"><b>Last message date:</b></a>
49-
<i>Thu Dec 4 12:11:25 UTC 2025</i><br>
50-
<b>Archived on:</b> <i>Thu Dec 4 12:11:36 UTC 2025</i>
54+
<i>Fri Dec 5 07:52:21 UTC 2025</i><br>
55+
<b>Archived on:</b> <i>Fri Dec 5 07:52:27 UTC 2025</i>
5156
<p>
5257
<ul>
5358
<li> <b>Messages sorted by:</b>

‎squid-users/2025-December/subject.html‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@ <h1>December 2025 Archives by subject</h1>
1919
</a></b></li>
2020
</ul>
2121
<p><b>Starting:</b> <i>Wed Dec 3 03:32:07 UTC 2025</i><br>
22-
<b>Ending:</b> <i>Thu Dec 4 12:11:25 UTC 2025</i><br>
23-
<b>Messages:</b> 4<p>
22+
<b>Ending:</b> <i>Fri Dec 5 07:52:21 UTC 2025</i><br>
23+
<b>Messages:</b> 5<p>
2424
<ul>
2525

2626
<LI><A HREF="027714.html">[squid-users] CVE-2025-62168
@@ -41,13 +41,18 @@ <h1>December 2025 Archives by subject</h1>
4141
<LI><A HREF="027717.html">[squid-users] MFA with squid, is it possible?
4242
</A><A NAME="27717">&nbsp;</A>
4343
<I>Stuart Henderson
44+
</I>
45+
46+
<LI><A HREF="027718.html">[squid-users] MFA with squid, is it possible?
47+
</A><A NAME="27718">&nbsp;</A>
48+
<I>Amos Jeffries
4449
</I>
4550

4651
</ul>
4752
<p>
4853
<a name="end"><b>Last message date:</b></a>
49-
<i>Thu Dec 4 12:11:25 UTC 2025</i><br>
50-
<b>Archived on:</b> <i>Thu Dec 4 12:11:36 UTC 2025</i>
54+
<i>Fri Dec 5 07:52:21 UTC 2025</i><br>
55+
<b>Archived on:</b> <i>Fri Dec 5 07:52:27 UTC 2025</i>
5156
<p>
5257
<ul>
5358
<li> <b>Messages sorted by:</b>

‎squid-users/2025-December/thread.html‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@ <h1>December 2025 Archives by thread</h1>
1919
</a></b></li>
2020
</ul>
2121
<p><b>Starting:</b> <i>Wed Dec 3 03:32:07 UTC 2025</i><br>
22-
<b>Ending:</b> <i>Thu Dec 4 12:11:25 UTC 2025</i><br>
23-
<b>Messages:</b> 4<p>
22+
<b>Ending:</b> <i>Fri Dec 5 07:52:21 UTC 2025</i><br>
23+
<b>Messages:</b> 5<p>
2424
<ul>
2525

2626
<!--0 01764732727.27714- -->
@@ -48,12 +48,18 @@ <h1>December 2025 Archives by thread</h1>
4848
<I>Stuart Henderson
4949
</I>
5050

51+
<!--1 01764768706.27715-01764921141.27718- -->
52+
<LI><A HREF="027718.html">[squid-users] MFA with squid, is it possible?
53+
</A><A NAME="27718">&nbsp;</A>
54+
<I>Amos Jeffries
55+
</I>
56+
5157
</UL>
5258
</ul>
5359
<p>
5460
<a name="end"><b>Last message date:</b></a>
55-
<i>Thu Dec 4 12:11:25 UTC 2025</i><br>
56-
<b>Archived on:</b> <i>Thu Dec 4 12:11:36 UTC 2025</i>
61+
<i>Fri Dec 5 07:52:21 UTC 2025</i><br>
62+
<b>Archived on:</b> <i>Fri Dec 5 07:52:27 UTC 2025</i>
5763
<p>
5864
<ul>
5965
<li> <b>Messages sorted by:</b>

0 commit comments

Comments
 (0)