Add Basic Authentication to a Squid 6.13 Proxy

This procedure adds NCSA-backed Basic authentication to a source-restricted Squid 6.13 proxy. Debian 13's helper is /usr/lib/squid/basic_ncsa_auth; confirm the path and service account for your package.

Create the first account

Use the distribution's htpasswd utility and enter the password interactively:

sudo htpasswd -c /etc/squid/users proxyuser
sudo chown root:proxy /etc/squid/users
sudo chmod 640 /etc/squid/users

The ownership assumes Debian's service group. Squid needs to read the file; other users should not. For later accounts, omit -c, which creates a new file and can replace existing entries.

Require source and login on the same allow rule

Place these after the existing destination-port, management, localhost and link-local safeguards:

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/users
auth_param basic realm PrivateProxy

acl proxy_client src 198.51.100.27/32
acl logged_in proxy_auth REQUIRED

http_access allow proxy_client logged_in
http_access deny all

Replace the client address with the source Squid observes. Both conditions must match. Remove earlier broad client allows that would bypass the login rule, while keeping listener and firewall restrictions.

Parse, reload, then compare two requests

sudo squid -k parse -f /etc/squid/squid.conf

Fix parser errors, then reload the managed Squid service before testing. From an allowed source, a request without credentials should be challenged. Compare an authorized request, using your real proxy hostname:

curl --proxy http://proxy.example:3128 --proxy-basic --proxy-user proxyuser --noproxy '' --connect-timeout 5 --max-time 15 https://example.com/

Supplying only the username lets curl prompt for the password. A valid request should reach the destination.

Basic authentication does not encrypt the client-to-proxy exchange. Later destination HTTPS cannot protect credentials already sent to a cleartext proxy; use an appropriately protected path. These directives target Squid 6.13; consult version-specific configuration for Squid 8.