Disabling Authentication

As you may know Squid proxy builds and runs in some pretty interesting places. Amongst these is the WRT operating system. Although admittedly getting Squid small and light enough to run there is a major miniaturization job all by itself and its size still prevents other deserving applications from being used.

One of the problems that keeps popping up in this miniaturization effort is the  –disable-auth option. One would naturally expect such an option to disable authentication in Squid. It does not. So far all it does is prevent the additional helpers being built, and that only in the 3.2 series.

This month my spare-time task has been to make that directive work. To actually omit from the Squid binary as much code as possible which processes and manipulates the authentication information.

So far progress is looking good, around 900KB of the default binary size is removed.  100KB or so of run-time footprint. There are some not so obvious side effects of removing authentication which I’m going to cover here.

These changes have already landed in 3.HEAD and will be present in the 3.2 betas shortly.

In the security industry there are three terms: identification (of who or what something is), authentication (that some identification is true and correct) and authorization (that someone or thing is allowed to perform an action). Almost all access through Squid has a number of features acting to test these in various combinations. Luckily most of it takes the form of simple identification and authorization.

Authentication and ACLs

Naturally this being the goal of the project.

–disable-auth removes auth_param directives and also all ACL types which process usernames. Other than the ident username ACL which does not involve actual authentication.

IDENT

This protocol is all about identification and authorization. No authentication involved. As such its use has not been impacted in any visible way in the current Squid. However I’m noting it here since another side project underway is unifying the username details together.

–disable-auth removes the shared username objects and may in future affect storage of IDENT results.

External ACLs

External ACL helpers are permitted to perform what is called side-band authentication and return to Squid the username and password for an authenticated user. Since this is a form of authentication it dumps results into the username structures at various points.

–disable-auth will disable and remove the storage of these usernames as a possibility. Effectively disabling this type of authentication despite any support which may remain in the helper.

FTP

FTP protocol requires authentication credentials to be passed to the FTP server. Squid has several ways of doing this. Anonymous credentials are set in squid.conf and tried first. The URL may be sent containing an unsecured username and password in clear text.

Alternatively recent versions of Squid will look for HTTP Basic authentication credentials to use. Lacking any working credentials Squid will normally now reply with an HTTP authentication request, resulting in the user being able to enter their FTP login into a popup box or browser password manager.

–disable-auth or even just –disable-auth-basic will now prevent the HTTP authentication method from working in Squids FTP gateway.

Cache Manager

Squids HTTP management interface used by cachemgr.cgi, squidclient and other tools to fetch reports and perform administrative actions relies on authentication for certain actions.

Despite the fancy action@password style its URLs use this is converted into a real HTTP login header by the tools. The management interface relies on this authentication for all actions marked as protected.

–disable-auth or even just –disable-auth-basic will now prevent the Squid cache manager interface from receiving these credentials. Effectively blocking all access to the protected actions.

Delay Pools

The fancy new delay pools in Squid-3 rely on user credentials for some of their bucket types. If one thinks about it closely it becomes clear that without any authentication such pools are useless.

–disable-auth will prevent the class 4 delay pool from being built and available.

Peering

The cache_peer login directive which may normally pass on credentials to a peer via HTTP authentication headers has a complex and mixed relationship with authentication.

–disable-auth prevents login= from generating any HTTP headers. Since the auth encoding is disabled. However the PASSTHRU will still work. PASS is reduced to an exact equivalent of PASSTHRU since it may not generate a header for external ACL authenticated users.

–disable-auth-basic prevents login=username:password from working since the basic authentication header creation is disabled. However the NEGOTIATE and PASSTHRU remain working. PASS is reduced to an equivalent for PASSTHRU since the external ACL authenticated users require Basic encoding.

–disable-auth-negotiate prevents login=NEGOTIATE working since the negotiate authentication header creation is disabled. However all the other forms still work.