Set Separate Credentials for a Squid Parent
Give Squid 6.13 its own upstream proxy login instead of assuming that the client's proxy password should be passed to another operator.
A user's login to your Squid service and Squid's login to its parent are different credentials. The parent may belong to another operator or use a different account database. Do not assume that accepting a client password means you should pass it upstream.
Squid 6.13 can attach a static login to a parent definition:
cache_peer 192.0.2.20 parent 3128 0 no-query default name=upstream login=parentuser:ExampleOnlyThe address and password above are documentation examples. Apply the login to the existing parent definition rather than accidentally creating a second peer. Retain the separate routing policy that decides which requests must use this parent.
Keep the account scopes distinct
The downstream auth_param settings validate clients of your Squid instance. The peer's login option supplies credentials for another hop. Changing one does not automatically update the other.
Match the parent's documented authentication requirements. This line is not a complete configuration for every connection-oriented authentication scheme. If the parent expects NTLM or Negotiate, verify the supported peer arrangement instead of repeatedly changing a password in this field.
Squid also has credential-passing options such as PASS and PASSTHRU. They have different semantics from a dedicated upstream account and can expose client authentication information to the peer. Do not select them as a shortcut when the intended design uses separate accounts.
Protect the configuration and test the right hop
The static secret is stored in the configuration. Limit file and backup access, and sanitize parser or debug output before sharing it. The option has its own escaping rules: the documentation permits URL escapes and requires a literal percent character to be doubled.
If clients authenticate successfully but forwarded requests still fail at the parent, inspect that upstream exchange and account. Keep the client-to-Squid and Squid-to-parent transport protection separate as well; encrypting the first connection does not secure the second automatically.