Squid Configuration - Bypass Auth?

[Duke5A]

Here is the deal... I setup a Squid/Dansguardian box running Ubuntu 9.10 a couple weeks ago for Internet access logging. It works great, authenticates against a 2003 Windows Server domain, and logs traffic with AD user names. The issue is third party apps on the client machines that don't support NTLM, or basic authentication against a proxy. Since they don't pass credentials to the proxy, they can't get out. One of these apps is Google Earth, well, not all of it. When a user clicks on a landmark to view pictures, nothing comes up. If I change IE to another proxy that doesn't require authentication, it works beautifully.

 

I guess what I'm asking is, how do configure squid to bypass authentication for a particular domain?

 

Thanks guys...

[voodoochile]

Hello there

did you get a solution for this

we have the same with smartboard software

[Duke5A]

Hello there

did you get a solution for this

we have the same with smartboard software

 

Yeah, sure did, just had to ask Google, go figure.

 

Create an ACL line in your Squid configuration file that looks like this...

 

acl bypassNTLM dstdomain "/etc/squid/bypassauth-sites.squid"

 

Then place an access rule right before the one that requires NTLM authentication that reads like this...

 

http_access allow all bypassNTLM

 

Now add whatever sites to "/etc/squid/bypassauth-sites.squid" you want that can bypass domain authentication.

 

Test it by logging onto a domain computer locally (or a computer not on the domain), set your proxy up in Internet Explorer, and try browsing the web. You should get asked for credentials with the exception of the ones specified in bypassauth-sites.squid.

[ranj]

Hi

 

Say if you want to bypass authetication when browising the internet via certain IP address? would this be possible?

 

Basically we have users who access a browser via citrix, we want these citrix servers to not ask users to authenticate.

 

thanks

[Duke5A]

Yeah, you can drop an IP in a separate line and it'll work just like a domain name.