Re: [squid-users] Re: secure authentication on squid

From: Henrik Nordstrom <[email protected]>
Date: 21 Nov 2002 16:30:02 +0100

tor 2002-11-21 klockan 14.18 skrev Jose Araujo:

> That is my problem, how to generate the hash for a user without knowing
> it's password ?

You can't.

You must either have the actual password, or a digest hash of the
password, i.e. H(A1) = MD5(username ":" realm ":" passwd)

Alternatively your backend needs to support querying of MD5-sess H(A1)
values using some kind of third-party protocol, and Squid extended to
support the MD5-sess digest protocol and a helper using the above
thirt-party protocol to query your backend database in a reasonably
secure manner..

Regards
Henrik
Received on Thu Nov 21 2002 - 09:30:24 MST

This archive was generated by hypermail pre-2.1.9 : Tue Dec 09 2003 - 17:11:21 MST