Skip to content

Commit c87794c

Browse files
squidadmsquidadm
committed
2025-12-03
1 parent 2abe82d commit c87794c

10 files changed

Lines changed: 354 additions & 20 deletions

File tree

‎squid-users/2025-December.txt‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,93 @@ Cheers
2424
Amos
2525

2626

27+
From ngtech1ltd at gmail.com Wed Dec 3 13:31:46 2025
28+
From: ngtech1ltd at gmail.com (NgTech LTD)
29+
Date: Wed, 3 Dec 2025 15:31:46 +0200
30+
Subject: [squid-users] MFA with squid, is it possible?
31+
Message-ID: <CABA8h=R2_LzKNDmqiJjixPOrqNu7eHPWa1P5zuExFR8U_k_iTQ@mail.gmail.com>
32+
33+
I was wondering if it's possible to use 2fa with squid?
34+
If so, how?
35+
The authentication of squid is based on a couple methods, but, by what I
36+
can identify the 2fa? Is there any option to use some kind of token which
37+
can be acquired via some external authentication service?
38+
I am unsure if it's doable or not.
39+
I have seen a couple VPN services which offer 2fa, but all of these have
40+
connection based authentication.
41+
42+
The only service I have seen which has a nice concept of 2fa is Defguard.
43+
It uses Wireguard combined with psk.
44+
The flow is that the app contacts a management service and the 2fa
45+
authentication is done against this service.
46+
Then this service generates the WG config PSK and pushes it to the WG
47+
service.
48+
The app then connects with a combination of KEY+PSK.
49+
The detection of connection invalidation ("disconnection") is when there is
50+
no activity after 3 minutes on the WG peer(or by disconnection in the app).
51+
Then the PSK is automatically being revoked/changed in the peer config
52+
which blocks it' usage.
53+
It's not a perfect solution but it's a nice enough implementation.
54+
55+
The issue with a proxy connection is that the client-to-service connection
56+
is in plain text.
57+
So my assumption is that if we can secure the client-to-proxy and the
58+
generated config delivery to the client we can kind of consider it "secure
59+
enough".
60+
61+
I am wondering to myself about the available options in the proxy market.
62+
63+
Thanks,
64+
Eliezer
65+
-------------- next part --------------
66+
An HTML attachment was scrubbed...
67+
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20251203/6890db3f/attachment.htm>
68+
69+
From tony.albers at gmx.com Wed Dec 3 16:55:10 2025
70+
From: tony.albers at gmx.com (Tony Albers)
71+
Date: Wed, 03 Dec 2025 17:55:10 +0100
72+
Subject: [squid-users] MFA with squid, is it possible?
73+
In-Reply-To: <CABA8h=R2_LzKNDmqiJjixPOrqNu7eHPWa1P5zuExFR8U_k_iTQ@mail.gmail.com>
74+
References: <CABA8h=R2_LzKNDmqiJjixPOrqNu7eHPWa1P5zuExFR8U_k_iTQ@mail.gmail.com>
75+
Message-ID: <B8316C89-DAE5-4EA3-9B4F-88B2812B23EF@gmx.com>
76+
77+
On 3 December 2025 14:31:46 CET, NgTech LTD <ngtech1ltd at gmail.com> wrote:
78+
>I was wondering if it's possible to use 2fa with squid?
79+
>If so, how?
80+
>The authentication of squid is based on a couple methods, but, by what I
81+
>can identify the 2fa? Is there any option to use some kind of token which
82+
>can be acquired via some external authentication service?
83+
>I am unsure if it's doable or not.
84+
>I have seen a couple VPN services which offer 2fa, but all of these have
85+
>connection based authentication.
86+
>
87+
>The only service I have seen which has a nice concept of 2fa is Defguard.
88+
>It uses Wireguard combined with psk.
89+
>The flow is that the app contacts a management service and the 2fa
90+
>authentication is done against this service.
91+
>Then this service generates the WG config PSK and pushes it to the WG
92+
>service.
93+
>The app then connects with a combination of KEY+PSK.
94+
>The detection of connection invalidation ("disconnection") is when there is
95+
>no activity after 3 minutes on the WG peer(or by disconnection in the app).
96+
>Then the PSK is automatically being revoked/changed in the peer config
97+
>which blocks it' usage.
98+
>It's not a perfect solution but it's a nice enough implementation.
99+
>
100+
>The issue with a proxy connection is that the client-to-service connection
101+
>is in plain text.
102+
>So my assumption is that if we can secure the client-to-proxy and the
103+
>generated config delivery to the client we can kind of consider it "secure
104+
>enough".
105+
>
106+
>I am wondering to myself about the available options in the proxy market.
107+
>
108+
>Thanks,
109+
>Eliezer
110+
111+
Check out privacyidea.org
112+
113+
HTH
114+
115+
/tony
116+

‎squid-users/2025-December/027714.html‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
</style>
1414
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
1515

16-
16+
<LINK REL="Next" HREF="027715.html">
1717
</HEAD>
1818
<BODY BGCOLOR="#ffffff">
1919
<H1>[squid-users] CVE-2025-62168</H1>
@@ -24,7 +24,8 @@ <H1>[squid-users] CVE-2025-62168</H1>
2424
<I>Wed Dec 3 03:32:07 UTC 2025</I>
2525
<P><UL>
2626

27-
27+
<LI>Next message (by thread): <A HREF="027715.html">[squid-users] MFA with squid, is it possible?
28+
</A></li>
2829
<LI> <B>Messages sorted by:</B>
2930
<a href="date.html#27714">[ date ]</a>
3031
<a href="thread.html#27714">[ thread ]</a>
@@ -52,12 +53,14 @@ <H1>[squid-users] CVE-2025-62168</H1>
5253

5354
</PRE>
5455

56+
5557
<!--endarticle-->
5658
<HR>
5759
<P><UL>
5860
<!--threads-->
5961

60-
62+
<LI>Next message (by thread): <A HREF="027715.html">[squid-users] MFA with squid, is it possible?
63+
</A></li>
6164
<LI> <B>Messages sorted by:</B>
6265
<a href="date.html#27714">[ date ]</a>
6366
<a href="thread.html#27714">[ thread ]</a>

‎squid-users/2025-December/027715.html‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
2+
<HTML>
3+
<HEAD>
4+
<TITLE> [squid-users] MFA with squid, is it possible?
5+
</TITLE>
6+
<LINK REL="Index" HREF="index.html" >
7+
<LINK REL="made" HREF="mailto:squid-users%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-users%5D%20MFA%20with%20squid%2C%20is%20it%20possible%3F&In-Reply-To=%3CCABA8h%3DR2_LzKNDmqiJjixPOrqNu7eHPWa1P5zuExFR8U_k_iTQ%40mail.gmail.com%3E">
8+
<META NAME="robots" CONTENT="index,nofollow">
9+
<style type="text/css">
10+
pre {
11+
white-space: pre-wrap; /* css-2.1, curent FF, Opera, Safari */
12+
}
13+
</style>
14+
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
15+
<LINK REL="Previous" HREF="027714.html">
16+
<LINK REL="Next" HREF="027716.html">
17+
</HEAD>
18+
<BODY BGCOLOR="#ffffff">
19+
<H1>[squid-users] MFA with squid, is it possible?</H1>
20+
<B>NgTech LTD</B>
21+
<A HREF="mailto:squid-users%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-users%5D%20MFA%20with%20squid%2C%20is%20it%20possible%3F&In-Reply-To=%3CCABA8h%3DR2_LzKNDmqiJjixPOrqNu7eHPWa1P5zuExFR8U_k_iTQ%40mail.gmail.com%3E"
22+
TITLE="[squid-users] MFA with squid, is it possible?">ngtech1ltd at gmail.com
23+
</A><BR>
24+
<I>Wed Dec 3 13:31:46 UTC 2025</I>
25+
<P><UL>
26+
<LI>Previous message (by thread): <A HREF="027714.html">[squid-users] CVE-2025-62168
27+
</A></li>
28+
<LI>Next message (by thread): <A HREF="027716.html">[squid-users] MFA with squid, is it possible?
29+
</A></li>
30+
<LI> <B>Messages sorted by:</B>
31+
<a href="date.html#27715">[ date ]</a>
32+
<a href="thread.html#27715">[ thread ]</a>
33+
<a href="subject.html#27715">[ subject ]</a>
34+
<a href="author.html#27715">[ author ]</a>
35+
</LI>
36+
</UL>
37+
<HR>
38+
<!--beginarticle-->
39+
<PRE>I was wondering if it's possible to use 2fa with squid?
40+
If so, how?
41+
The authentication of squid is based on a couple methods, but, by what I
42+
can identify the 2fa? Is there any option to use some kind of token which
43+
can be acquired via some external authentication service?
44+
I am unsure if it's doable or not.
45+
I have seen a couple VPN services which offer 2fa, but all of these have
46+
connection based authentication.
47+
48+
The only service I have seen which has a nice concept of 2fa is Defguard.
49+
It uses Wireguard combined with psk.
50+
The flow is that the app contacts a management service and the 2fa
51+
authentication is done against this service.
52+
Then this service generates the WG config PSK and pushes it to the WG
53+
service.
54+
The app then connects with a combination of KEY+PSK.
55+
The detection of connection invalidation (&quot;disconnection&quot;) is when there is
56+
no activity after 3 minutes on the WG peer(or by disconnection in the app).
57+
Then the PSK is automatically being revoked/changed in the peer config
58+
which blocks it' usage.
59+
It's not a perfect solution but it's a nice enough implementation.
60+
61+
The issue with a proxy connection is that the client-to-service connection
62+
is in plain text.
63+
So my assumption is that if we can secure the client-to-proxy and the
64+
generated config delivery to the client we can kind of consider it &quot;secure
65+
enough&quot;.
66+
67+
I am wondering to myself about the available options in the proxy market.
68+
69+
Thanks,
70+
Eliezer
71+
-------------- next part --------------
72+
An HTML attachment was scrubbed...
73+
URL: &lt;<A HREF="http://lists.squid-cache.org/pipermail/squid-users/attachments/20251203/6890db3f/attachment.htm">http://lists.squid-cache.org/pipermail/squid-users/attachments/20251203/6890db3f/attachment.htm</A>&gt;
74+
</PRE>
75+
76+
77+
<!--endarticle-->
78+
<HR>
79+
<P><UL>
80+
<!--threads-->
81+
<LI>Previous message (by thread): <A HREF="027714.html">[squid-users] CVE-2025-62168
82+
</A></li>
83+
<LI>Next message (by thread): <A HREF="027716.html">[squid-users] MFA with squid, is it possible?
84+
</A></li>
85+
<LI> <B>Messages sorted by:</B>
86+
<a href="date.html#27715">[ date ]</a>
87+
<a href="thread.html#27715">[ thread ]</a>
88+
<a href="subject.html#27715">[ subject ]</a>
89+
<a href="author.html#27715">[ author ]</a>
90+
</LI>
91+
</UL>
92+
93+
<hr>
94+
<a href="https://lists.squid-cache.org/listinfo/squid-users">More information about the squid-users
95+
mailing list</a><br>
96+
</body></html>

‎squid-users/2025-December/027716.html‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
2+
<HTML>
3+
<HEAD>
4+
<TITLE> [squid-users] MFA with squid, is it possible?
5+
</TITLE>
6+
<LINK REL="Index" HREF="index.html" >
7+
<LINK REL="made" HREF="mailto:squid-users%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-users%5D%20MFA%20with%20squid%2C%20is%20it%20possible%3F&In-Reply-To=%3CB8316C89-DAE5-4EA3-9B4F-88B2812B23EF%40gmx.com%3E">
8+
<META NAME="robots" CONTENT="index,nofollow">
9+
<style type="text/css">
10+
pre {
11+
white-space: pre-wrap; /* css-2.1, curent FF, Opera, Safari */
12+
}
13+
</style>
14+
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
15+
<LINK REL="Previous" HREF="027715.html">
16+
17+
</HEAD>
18+
<BODY BGCOLOR="#ffffff">
19+
<H1>[squid-users] MFA with squid, is it possible?</H1>
20+
<B>Tony Albers</B>
21+
<A HREF="mailto:squid-users%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-users%5D%20MFA%20with%20squid%2C%20is%20it%20possible%3F&In-Reply-To=%3CB8316C89-DAE5-4EA3-9B4F-88B2812B23EF%40gmx.com%3E"
22+
TITLE="[squid-users] MFA with squid, is it possible?">tony.albers at gmx.com
23+
</A><BR>
24+
<I>Wed Dec 3 16:55:10 UTC 2025</I>
25+
<P><UL>
26+
<LI>Previous message (by thread): <A HREF="027715.html">[squid-users] MFA with squid, is it possible?
27+
</A></li>
28+
29+
<LI> <B>Messages sorted by:</B>
30+
<a href="date.html#27716">[ date ]</a>
31+
<a href="thread.html#27716">[ thread ]</a>
32+
<a href="subject.html#27716">[ subject ]</a>
33+
<a href="author.html#27716">[ author ]</a>
34+
</LI>
35+
</UL>
36+
<HR>
37+
<!--beginarticle-->
38+
<PRE>On 3 December 2025 14:31:46 CET, NgTech LTD &lt;<A HREF="https://lists.squid-cache.org/listinfo/squid-users">ngtech1ltd at gmail.com</A>&gt; wrote:
39+
&gt;<i>I was wondering if it's possible to use 2fa with squid?
40+
</I>&gt;<i>If so, how?
41+
</I>&gt;<i>The authentication of squid is based on a couple methods, but, by what I
42+
</I>&gt;<i>can identify the 2fa? Is there any option to use some kind of token which
43+
</I>&gt;<i>can be acquired via some external authentication service?
44+
</I>&gt;<i>I am unsure if it's doable or not.
45+
</I>&gt;<i>I have seen a couple VPN services which offer 2fa, but all of these have
46+
</I>&gt;<i>connection based authentication.
47+
</I>&gt;<i>
48+
</I>&gt;<i>The only service I have seen which has a nice concept of 2fa is Defguard.
49+
</I>&gt;<i>It uses Wireguard combined with psk.
50+
</I>&gt;<i>The flow is that the app contacts a management service and the 2fa
51+
</I>&gt;<i>authentication is done against this service.
52+
</I>&gt;<i>Then this service generates the WG config PSK and pushes it to the WG
53+
</I>&gt;<i>service.
54+
</I>&gt;<i>The app then connects with a combination of KEY+PSK.
55+
</I>&gt;<i>The detection of connection invalidation (&quot;disconnection&quot;) is when there is
56+
</I>&gt;<i>no activity after 3 minutes on the WG peer(or by disconnection in the app).
57+
</I>&gt;<i>Then the PSK is automatically being revoked/changed in the peer config
58+
</I>&gt;<i>which blocks it' usage.
59+
</I>&gt;<i>It's not a perfect solution but it's a nice enough implementation.
60+
</I>&gt;<i>
61+
</I>&gt;<i>The issue with a proxy connection is that the client-to-service connection
62+
</I>&gt;<i>is in plain text.
63+
</I>&gt;<i>So my assumption is that if we can secure the client-to-proxy and the
64+
</I>&gt;<i>generated config delivery to the client we can kind of consider it &quot;secure
65+
</I>&gt;<i>enough&quot;.
66+
</I>&gt;<i>
67+
</I>&gt;<i>I am wondering to myself about the available options in the proxy market.
68+
</I>&gt;<i>
69+
</I>&gt;<i>Thanks,
70+
</I>&gt;<i>Eliezer
71+
</I>
72+
Check out privacyidea.org
73+
74+
HTH
75+
76+
/tony
77+
</PRE>
78+
79+
<!--endarticle-->
80+
<HR>
81+
<P><UL>
82+
<!--threads-->
83+
<LI>Previous message (by thread): <A HREF="027715.html">[squid-users] MFA with squid, is it possible?
84+
</A></li>
85+
86+
<LI> <B>Messages sorted by:</B>
87+
<a href="date.html#27716">[ date ]</a>
88+
<a href="thread.html#27716">[ thread ]</a>
89+
<a href="subject.html#27716">[ subject ]</a>
90+
<a href="author.html#27716">[ author ]</a>
91+
</LI>
92+
</UL>
93+
94+
<hr>
95+
<a href="https://lists.squid-cache.org/listinfo/squid-users">More information about the squid-users
96+
mailing list</a><br>
97+
</body></html>

‎squid-users/2025-December/author.html‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,20 +19,30 @@ <h1>December 2025 Archives by author</h1>
1919
</a></b></li>
2020
</ul>
2121
<p><b>Starting:</b> <i>Wed Dec 3 03:32:07 UTC 2025</i><br>
22-
<b>Ending:</b> <i>Wed Dec 3 03:32:07 UTC 2025</i><br>
23-
<b>Messages:</b> 1<p>
22+
<b>Ending:</b> <i>Wed Dec 3 16:55:10 UTC 2025</i><br>
23+
<b>Messages:</b> 3<p>
2424
<ul>
2525

26+
<LI><A HREF="027716.html">[squid-users] MFA with squid, is it possible?
27+
</A><A NAME="27716">&nbsp;</A>
28+
<I>Tony Albers
29+
</I>
30+
2631
<LI><A HREF="027714.html">[squid-users] CVE-2025-62168
2732
</A><A NAME="27714">&nbsp;</A>
2833
<I>Amos Jeffries
34+
</I>
35+
36+
<LI><A HREF="027715.html">[squid-users] MFA with squid, is it possible?
37+
</A><A NAME="27715">&nbsp;</A>
38+
<I>NgTech LTD
2939
</I>
3040

3141
</ul>
3242
<p>
3343
<a name="end"><b>Last message date:</b></a>
34-
<i>Wed Dec 3 03:32:07 UTC 2025</i><br>
35-
<b>Archived on:</b> <i>Wed Dec 3 03:32:12 UTC 2025</i>
44+
<i>Wed Dec 3 16:55:10 UTC 2025</i><br>
45+
<b>Archived on:</b> <i>Wed Dec 3 16:55:24 UTC 2025</i>
3646
<p>
3747
<ul>
3848
<li> <b>Messages sorted by:</b>

‎squid-users/2025-December/date.html‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,20 +19,30 @@ <h1>December 2025 Archives by date</h1>
1919
</a></b></li>
2020
</ul>
2121
<p><b>Starting:</b> <i>Wed Dec 3 03:32:07 UTC 2025</i><br>
22-
<b>Ending:</b> <i>Wed Dec 3 03:32:07 UTC 2025</i><br>
23-
<b>Messages:</b> 1<p>
22+
<b>Ending:</b> <i>Wed Dec 3 16:55:10 UTC 2025</i><br>
23+
<b>Messages:</b> 3<p>
2424
<ul>
2525

2626
<LI><A HREF="027714.html">[squid-users] CVE-2025-62168
2727
</A><A NAME="27714">&nbsp;</A>
2828
<I>Amos Jeffries
29+
</I>
30+
31+
<LI><A HREF="027715.html">[squid-users] MFA with squid, is it possible?
32+
</A><A NAME="27715">&nbsp;</A>
33+
<I>NgTech LTD
34+
</I>
35+
36+
<LI><A HREF="027716.html">[squid-users] MFA with squid, is it possible?
37+
</A><A NAME="27716">&nbsp;</A>
38+
<I>Tony Albers
2939
</I>
3040

3141
</ul>
3242
<p>
3343
<a name="end"><b>Last message date:</b></a>
34-
<i>Wed Dec 3 03:32:07 UTC 2025</i><br>
35-
<b>Archived on:</b> <i>Wed Dec 3 03:32:12 UTC 2025</i>
44+
<i>Wed Dec 3 16:55:10 UTC 2025</i><br>
45+
<b>Archived on:</b> <i>Wed Dec 3 16:55:24 UTC 2025</i>
3646
<p>
3747
<ul>
3848
<li> <b>Messages sorted by:</b>

0 commit comments

Comments
 (0)