basic_sasl_auth(8)

📦
version 7.7 · 7 versions
, in arch rolling, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, ubuntu resolute, ubuntu stonking

💖 basic_sasl_auth — the manual, but make it make sense 💖

okay bestie, so this is basic_sasl_auth, and it lives in the System Manager's Manual (section 8, the admin one, very grown-up of it). It's a helper for Squid that does Basic Authentication using SASL — and specifically the cyrus-sasl authentication method. It's Version 1.0, which honestly? slay, we love a stable queen. 👑

✨ SYNOPSIS ✨

basic_sasl_auth

yeah that's it. no flags. no args. it just is. it's giving low-maintenance icon. 💅

🌸 DESCRIPTION 🌸

so basic_sasl_auth is an installed binary helper for Squid. that's its whole job and it does it well. 🫶

SASL is configurable — sorta like PAM, if PAM and SASL were cousins who text each other. Every service that authenticates against SASL identifies itself with an application name, and each application can be configured independently by the SASL administrator. no sharing, no crossover, each app gets its own lil setup. very main character. ✨

🎀 CONFIGURATION 🎀

To configure which authentication method gets used, the file basic_sasl_auth.conf can be placed in the appropriate location — usually /usr/lib/sasl. that's the vibe spot. 📁

The authentication database is defined by the pwcheck_method parameter. Heads up: only the PLAIN authentication mechanism is used. just PLAIN. no frills. periodt. 💀

Examples, bestie, in all their glory:

  • pwcheck_method:sasldb — use sasldb. this is the default if no conf file is installed. 🍓
  • pwcheck_method:pam — use the PAM authentication database
  • pwcheck_method:passwd — use the traditional /etc/passwd
  • pwcheck_method:shadow — use the slightly less traditional /etc/shadow

Others methods may be supported by your cyrus-sasl implementation — so consult your cyrus-sasl documentation for information. don't come for me, come for the docs. 📖

⚠️ okay important one: typically the authentication database (/etc/sasldb, /etc/shadow, PAM) can not be accessed by a normal user. no cap. So you should use setuid/setgid and an appropriate user/group on the executable to allow the authenticator to access the appropriate password database. If the access to the database is not permitted then the authenticator will typically fail with "-1, generic error". 😭

Here's how the cool kids do it:

chown root.mail basic_sasl_auth
chmod ug+s basic_sasl_auth

Also! If the application name is basic_sasl_auth, that same name will also be used for the PAM service name if pwcheck_method:pam is chosen. And an example PAM configuration file basic_sasl_auth.pam is also included. matching set, we love to see it. 🎀✨

💜 AUTHOR 💜

This program was written by Ian Castle <ian.castle@coldcomfortfarm.net>

This manual was written by Ian Castle <ian.castle@coldcomfortfarm.net> and Amos Jeffries <amosjeffries@squid-cache.org>

 * Copyright (C) 1996-2026 The Squid Software Foundation and
contributors
 *
 * Squid software is distributed under GPLv2+ license and includes
 * contributions from numerous individuals and organizations.
 * Please see the COPYING and CONTRIBUTORS files for details.

This program and documentation is copyright to the authors named above.

Distributed under the GNU General Public License (GNU GPL) version 2 or later (GPLv2+). 🫡

🙋 QUESTIONS 🙋

Got questions on the usage of this program? Send them to the Squid Users mailing list <squid-users@lists.squid-cache.org>. the girls that ask questions, honestly. 💖

🐛 REPORTING BUGS 🐛

Bug reports need to be made in English. See https://wiki.squid-cache.org/SquidFaq/BugReporting for details of what you need to include with your bug report. (iykyk, read it before you send anything 🙈)

Report bugs or bug fixes using https://bugs.squid-cache.org/

Report serious security bugs to Squid Bugs <squid-bugs@lists.squid-cache.org> 🔥

Report ideas for new improvements to the Squid Developers mailing list <squid-dev@lists.squid-cache.org> 🌈

🌟 SEE ALSO 🌟

and that's the whole page bestie!! 🦋 this came from the System Manager's Manual and it's all about basic_sasl_auth(8) — go forth, chown responsibly, and remember: setuid is a big deal, treat her with respect. mwah. 💋✨💅

📦 where this page comes from