digest_file_auth(8)

📦
version 7.7 · 7 versions
, in alpine 3.23, alpine 3.24, arch rolling, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, ubuntu resolute, ubuntu stonking

💖 digest_file_auth 💖

okay bestie, welcome to digest_file_auth — this one lives in section 8 of the System Manager's Manual and it's the file-based digest auth helper for Squid. it's an installed binary, it does digest authentication, and it's got exactly one flag. we love a low-maintenance icon. ✨

Version 1.1, btw. noted. 💅

🌸 NAME 🌸

digest_file_auth — File based digest authentication helper for Squid.

Version 1.1

🎀 SYNOPSIS 🎀

digest_file_auth [-c] file

🦋 DESCRIPTION 🦋

so digest_file_auth is an installed binary authentication program for Squid, periodt. it handles the digest authentication protocol and it authenticates against a text file backend. yes, a whole auth system, just vibing in a plain text file. iconic honestly.

here's the fun part: this program will automatically detect the existence of a concurrency channel-ID and adjust appropriately. it's giving self-aware. 🫶

and it may be used with any value 0 or above for the auth_param children concurrency= parameter. so like, scale it however you want, she's flexible. 💅

✨ OPTIONS ✨

  • -c — Accept digest hashed passwords rather than plaintext in the password file.

and that's the whole list. one option. a minimalist queen. 👑

🌈 CONFIGURATION 🌈

okay this is the part you actually need, so pay attention bestie. 💜

🍓 Username database file format

  • comment lines are possible and should start with a '#';
  • empty or blank lines are possible;
  • plaintext entry format is username:password
  • HA1 entry format is username:realm:HA1

🧚 To build a directory integrated backend

so to build a directory integrated backend, you need to be able to calculate the HA1 returned to squid. the trick is: to avoid storing a plaintext password, you can calculate MD5(username:realm:password) when the user changes their password, and store the tuple username:realm:HA1. then find the matching username:realm when squid asks for the HA1. that's the whole move. 🫶

💀 the honest tea

This implementation could be improved by using such a triple for the file format. However storing such a triple does little to improve security: If compromised the username:realm:HA1 combination is "plaintext equivalent" - for the purposes of digest authentication they allow the user access. Password synchronization is not tackled by digest - just preventing on the wire compromise.

no cap, that's a real one. if someone gets that file, they get in. 🚨

👑 AUTHOR 👑

  • This program was written by Robert Collins <robertc@squid-cache.org>
  • Based on prior work by Arjan de Vet <Arjan.deVet@adv.iae.nl>
  • This manual was written by Robert Collins <robertc@squid-cache.org> and Amos Jeffries <amosjeffries@squid-cache.org>

shoutout to the authors, fr fr. 🌟

 * Copyright (C) 1996-2026 The Squid Software Foundation and contributors
 *
 * Squid software is distributed under GPLv2+ license and includes
 * contributions from numerous individuals and organizations.
 * Please see the COPYING and CONTRIBUTORS files for details.

This program and documentation is copyright to the authors named above.

Distributed under the GNU General Public License (GNU GPL) version 2 or later (GPLv2+).

💌 QUESTIONS 💌

Questions on the usage of this program can be sent to the Squid Users mailing list <squid-users@lists.squid-cache.org>

🐛 REPORTING BUGS 🐛

Bug reports need to be made in English. See https://wiki.squid-cache.org/SquidFaq/BugReporting for details of what you need to include with your bug report.

Report bugs or bug fixes using https://bugs.squid-cache.org/

Report serious security bugs to Squid Bugs <squid-bugs@lists.squid-cache.org>

Report ideas for new improvements to the Squid Developers mailing list <squid-dev@lists.squid-cache.org>

🔥 SEE ALSO 🔥

and that's the whole page bestie!! 💖✨🎀🦋🌸

this was the System Manager's Manual page for digest_file_auth, Version 1.1 — go forth and authenticate responsibly, mwah 💅🫶🌈⭐

📦 where this page comes from