You can run Squid as an explicit forward proxy on Ubuntu and require every client to authenticate with a username and password. Install Squid and the htpasswd utility, create a protected NCSA password file, connect Squid’s basic_ncsa_auth helper in /etc/squid/squid.conf, validate the configuration, and test both accepted and rejected credentials.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This method is intended for clients that are explicitly configured to use the proxy. It does not provide user authentication in interception or transparent mode, and Basic credentials must travel over a network path you trust.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat you are building
In an explicit-proxy deployment, each browser, command-line tool, or application is told the proxy hostname and listening port. The client sends its request to Squid, Squid challenges for proxy credentials, and Squid forwards the request only after the username and password have been checked against a local password file.
The design has four parts:
- Squid: the forward-proxy service.
- NCSA password helper:
basic_ncsa_auth, which reads an Apache-style username-and-hash file. - Password file: normally
/etc/squid/passwords, readable by the account that runs Squid but not exposed to ordinary users. - Access-control rules: an authenticated-only rule placed before broad allows, followed by a final deny.
Squid’s listener is commonly port 3128, but the active http_port in your configuration is authoritative. Ubuntu package versions and releases can change helper paths, service defaults, and available directives, so verify those details on the target machine.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Requirements and decisions before installation
Use an Ubuntu release supported by your normal update process
Run the commands with an account that can use sudo. Keep Ubuntu and Squid updated through the distribution repositories. The exact Squid major version, service account, helper location, and default configuration differ between releases; do not copy a path from another Ubuntu host without checking it.
Choose explicit proxy mode
Authentication in this guide works when clients deliberately connect to Squid. It is not a way to identify users whose traffic is silently redirected by a router. Squid’s authentication documentation states: “Simply said, it’s not possible to authenticate users using proxy authentication schemes when running in interception or transparent modes.” If you need credentials, configure the proxy settings in each client or distribute them through your organization’s management system.
Free tools Windows power users keep installed
One-click scans. No signup required.
Plan the trust boundary
Basic authentication protects the proxy with a username and password; it is not, by itself, an encrypted administration channel or an end-to-end tunnel for every request. Restrict which networks can reach the proxy, manage the server over a trusted or TLS-protected path, and avoid sending credentials across an untrusted network. HTTPS destinations still use their own TLS connection, but the proxy credential exchange must also be protected at the network layer.
Install Squid and the password-file utility
- Refresh package metadata and install Squid:
sudo apt update && sudo apt install squid - Install the package that provides
htpasswdif it is not already present:sudo apt install apache2-utils - Confirm that the service is present and note its initial state:
sudo systemctl status squid
Do not assume that an installation started with a completely empty configuration. Ubuntu’s packaged /etc/squid/squid.conf can contain safety ACLs and local-management rules that you should preserve while adding authentication.
Create the NCSA password file
Create the first account
Create the file and its first user with -c:
sudo htpasswd -c /etc/squid/passwords proxyuser
Enter the password when prompted. The command writes a username and a password hash; it does not store the clear-text password. The -c option creates a new file and can overwrite an existing one, so use it only for the initial account or when you intentionally want to replace the file.
Add more users without recreating the file
For every later account, omit -c:
sudo htpasswd /etc/squid/passwords anotheruser
The Ubuntu basic_ncsa_auth manual notes that the password file can be manipulated with htpasswd. To change an existing user’s password, run the same command with that username. To remove a user, use the utility’s delete option on the existing file and then verify that the line is gone.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Understand the hash choices
The helper documentation lists Blowfish, SHA-256, SHA-512, MD5, and DES support, subject to the build on your Ubuntu release. Prefer a modern hash supported by the installed htpasswd and helper, and test a newly created account before distributing it. DES is especially unsuitable for long passwords because it silently truncates them to eight characters. A hash algorithm mismatch can look like a bad-password error even when the typed password is correct.
Protect the password file
The helper must be able to read the file as the user under which Squid runs. At the same time, the file should not be world-readable: possession of it gives an attacker material for offline password cracking.
- Inspect the installed service definition or running process to identify the Squid service account and group. Ubuntu package choices vary, so use the account shown on this host rather than assuming a name from another release.
- Set ownership or group membership so that account can read
/etc/squid/passwords. - Use restrictive permissions, commonly owner read/write and group read, with no permissions for other users. Verify the result with:
sudo ls -l /etc/squid/passwords - Check each parent directory as well. The service needs directory traversal permission, but unrelated users should not gain access to the file by loosening directory permissions.
After changing ownership or mode, test the configuration and service rather than waiting for the next authentication request. A permission failure is normally reported in Squid’s service or cache log.
Find the installed authentication helper
The helper is often installed at /usr/lib/squid/basic_ncsa_auth, which is the path used in the official Squid example, but Ubuntu packages can place it elsewhere. Check the host:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemscommand -v basic_ncsa_auth
If that returns nothing, inspect the files installed by the Squid package and confirm that the authentication-helper package for your release is installed. Use the resulting absolute path in auth_param basic program; do not leave a path that exists only on a different Ubuntu version.
Configure Squid authentication
Add the authentication directives
Edit the configuration:
sudo editor /etc/squid/squid.conf
Add or adapt the following block, replacing the helper path only when your installation reports a different one:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
auth_param basic children 5
auth_param basic credentialsttl 1 minute
auth_param basic realm Squid proxy-caching web server
acl authenticated proxy_auth REQUIRED
http_access deny !authenticated
http_access allow authenticated
http_access deny allWhat each line does
auth_param basic programstarts the NCSA helper and passes it the password-file path.auth_param basic children 5allows five helper processes to handle authentication checks concurrently. Increase or decrease this only after considering the number of clients and the host’s resources.auth_param basic credentialsttl 1 minutecontrols how long Squid treats a successful credential check as valid in its authentication cache. A shorter value notices password changes sooner but causes more helper checks; a longer value reduces checks but delays recognition of a changed password.auth_param basic realmsupplies the label clients display in their proxy-login prompt.acl authenticated proxy_auth REQUIREDdefines an ACL that matches a request only when proxy authentication succeeds.http_access deny !authenticatedrejects requests that have not authenticated.http_access allow authenticatedpermits authenticated requests to continue to any later ACL restrictions you retain.http_access deny allprovides a deliberate final deny if no earlier rule has matched.
Preserve and order the rest of your ACL policy
Squid evaluates http_access rules from top to bottom and stops at the first match. Keep required safety rules from the Ubuntu sample configuration, such as restrictions on management access, destination ports, or local networks, and place the authentication requirement before any broad allow that would otherwise let an unauthenticated request through. A final deny is an important fail-closed guard.
Authentication proves who supplied credentials; it does not automatically make every destination or method acceptable. If your existing policy allows only selected source networks or ports, combine those ACLs with the authenticated rule rather than deleting them.
Validate and restart safely
- Ask Squid to parse the configuration:
sudo squid -k parse - Fix every reported path, spelling, ACL-order, or permission error before restarting. A successful parse is necessary but does not prove that the helper can read the password file.
- Restart the service after saving the file:
sudo systemctl restart squid - Confirm that it stayed active:
sudo systemctl status squid - If startup fails, inspect the service journal and Squid’s configured logs. Ubuntu installations commonly write request data to an
access.logand startup or helper diagnostics to acache.log; use the paths shown by your configuration.
Ubuntu’s Squid installation guidance requires saving the configuration and restarting Squid after edits. A restart that immediately returns to an inactive or failed state means the configuration or runtime permissions still need attention.
Configure a client and test authentication
Determine the proxy endpoint
Use the server’s reachable hostname or IP address and the active http_port. Although 3128 is common, inspect /etc/squid/squid.conf rather than assuming it. Ensure firewalls and security groups permit the intended client networks and no others.
Test with curl
Run an explicit-proxy request with verbose output. Substitute your host, port, username, and password:
curl -v -x http://proxy.example:3128 --proxy-user proxyuser:password http://example.com/
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
For an HTTPS destination, test the CONNECT path separately:
curl -v -x http://proxy.example:3128 --proxy-user proxyuser:password https://example.com/
Credentials placed directly in a command can remain in shell history or process listings. Use a safer interactive or environment-based method in shared environments, and remove any test command containing a real password from history.
Configure a browser or application
Open the application’s network or proxy settings, choose manual HTTP/explicit proxy configuration, enter the Squid host and verified port, and enable the option to use the proxy for the protocols you intend to send through it. Leave automatic discovery disabled unless you operate a discovery service. Save the settings, request an HTTP and an HTTPS page, and confirm that the application displays a proxy-login prompt.
Recommended Free Tools
Use a repeatable test matrix
| Test | Expected result | What it proves |
|---|---|---|
| No proxy credentials | A proxy-authentication challenge or denial | The proxy is not open to unauthenticated clients. |
| Valid username and password | The request succeeds if other ACLs permit the destination | The helper can read and validate the password file. |
| Wrong password | Authentication fails | Squid is actually checking the supplied secret. |
| Valid credentials over HTTPS destination | CONNECT succeeds when destination and port ACLs allow it | The authenticated explicit-proxy path works for TLS traffic too. |
| Request from an unauthorized source network | Denied if your source-network ACL blocks it | Authentication has not replaced network-boundary controls. |
Watch the access log while testing. It should show rejected unauthenticated or wrong-password requests and accepted requests associated with the expected authenticated username.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot common failures
Squid reports that the helper cannot be found
Run command -v basic_ncsa_auth and inspect the package file list. Correct the absolute path in auth_param basic program, then run sudo squid -k parse again. Do not solve this by making up a path from an online example for another Ubuntu release.
The service starts, but every password is rejected
- Confirm the password file exists at exactly the path in the configuration.
- Check that the Squid service account can read the file and its parent directories.
- Verify that you added later users without
-c; recreating the file can remove the account you are testing. - Check the hash format generated by your installed
htpasswdagainst the algorithms supported by your helper. Remember the eight-character DES truncation warning. - Read the cache or service log for helper errors rather than repeatedly changing client passwords.
Unauthenticated requests still pass
Inspect every http_access line above your authentication block. Because rules are first-match, an earlier broad allow can bypass the later denial. Move the authentication requirement ahead of that allow while retaining necessary local-management and destination-safety rules, then parse and restart.
Valid credentials are challenged repeatedly
Check that the client is actually configured for an explicit proxy and is sending credentials to the proxy, not to the destination website. Confirm the helper path and file permissions. A very short credentialsttl increases checks; it should not by itself cause valid credentials to fail, but logs can reveal helper or file-access errors.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →HTTP works but HTTPS fails
HTTPS usually requires the CONNECT method and an allowed destination port. Authentication can be correct while another ACL denies CONNECT or the target port. Compare the verbose curl output and access-log entry for both protocols, and review the existing port and method rules before weakening them.
The configuration parses but restart fails
Parsing does not exercise every runtime operation. Check the system journal and Squid logs for a missing directory, an unreadable password file, an invalid helper executable, or a port already in use. Restore the last known-good configuration, correct one issue at a time, parse again, and restart.
Operational security and maintenance
Limit who can reach the listener
Use host firewalls, cloud security groups, or network ACLs to permit only intended client networks. Do not expose an authenticated proxy broadly to the public internet. Authentication reduces casual misuse; it does not replace source-network restrictions, monitoring, or patch management.
Handle credentials as secrets
Give each person or service a separate account so you can revoke one credential without changing every client. Avoid sharing a single username, rotate passwords through a controlled process, and remove departed users from the file. Keep backups of the password file protected like any other credential database.
Balance credential cache lifetime
credentialsttl is an operational trade-off. The one-minute value in the example causes a changed password to become effective quickly while avoiding a helper lookup for every request. Longer lifetimes can reduce helper load on a busy installation but leave a recently changed credential recognized for longer; choose a value that matches your revocation requirements.
Review logs
Regularly look for repeated failures, unexpected source addresses, and access outside the intended schedule. Confirm that logs are protected, retained according to your policy, and not treated as a substitute for network encryption. Test a revoked account and a newly added account after maintenance.
Quick Recap
How the available choices compare
| Choice | Strengths | Limitations and when to use it |
|---|---|---|
| Local NCSA password file | Simple, self-contained, easy to automate with htpasswd, and requires no external identity service. |
Accounts and revocation are local to the file; protect its permissions and manage hash compatibility on each Ubuntu release. |
| PAM or another authentication helper | Can integrate with an operating-system or external identity policy when the required helper and deployment are available. | Introduces additional configuration, package, and service dependencies. Follow that helper’s own credential and failure controls instead of copying NCSA settings blindly. |
| Explicit proxy mode | Clients receive a proxy-authentication challenge and can supply credentials directly. | Every client must be configured or centrally managed; applications that ignore proxy settings will not use the proxy. |
| Interception or transparent mode | Can redirect traffic without configuring each client. | Proxy-authentication schemes cannot authenticate users in this mode, so it is incompatible with this username-and-password design. |
| Modern password hash | Provides stronger resistance to offline cracking when the password file is exposed. | Must be supported by both the installed htpasswd and Squid helper; verify a test account after upgrades. |
| DES hash | Legacy compatibility on builds that support it. | Passwords are silently truncated to eight characters, making it a poor choice for new accounts. |
Deployment checklist
- Squid and the
htpasswdutility are installed from the Ubuntu repositories. - The first account was created with
htpasswd -c; later accounts were added without-c. - The password file is at the configured path, is not world-readable, and is readable by the Squid service account.
- The helper path was verified on this Ubuntu release.
auth_param,proxy_auth, and orderedhttp_accessrules are present, with a final deny.sudo squid -k parsereports no configuration errors.- The service remains active after
sudo systemctl restart squid. - An explicit client is configured with the verified host and
http_port. - Unauthenticated, valid-password, and wrong-password tests produce the expected results in the logs.
- Network access, password handling, credential lifetime, and log review are managed as ongoing operations.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
