Question:

I am trying to use a proxy radius module for Squid, but it does not seem to work. I followed the documentation for the installation and configuration, but I still get no response from the radius server. However, when I use radtest with the same parameters, it works fine. What could be the problem?

Answer:

>
> Squid is a popular web proxy server that can improve web performance, security, and filtering. One of the features of Squid is the ability to authenticate users before allowing them to access the web. This can be useful for enforcing policies, logging user activity, or restricting access to certain sites. >
> There are different methods of authentication that Squid supports, such as basic, digest, NTLM, or Kerberos. One of the methods is proxy radius, which uses the RADIUS protocol to communicate with a RADIUS server that stores the user credentials. This method can be convenient if you already have a RADIUS server set up for other purposes, such as wireless authentication or VPN access. >
> However, configuring proxy radius authentication for Squid can be tricky, and sometimes it may not work as expected. In this article, we will show you how to troubleshoot some common issues that may arise when using proxy radius authentication for Squid. >
>

Prerequisites

>
> Before we begin, we assume that you have the following: >
> – A working Squid server that can serve web requests without authentication. > – A working RADIUS server that can authenticate users with a shared secret. > – A proxy radius module for Squid, such as squid_radius_auth, that can communicate with the RADIUS server. This module should be compiled with the Squid source code, or installed separately as a binary file. > – A Squid configuration file that specifies the proxy radius module as the authentication program, and the RADIUS server details as the parameters. For example: “`bash

auth_param basic program /opt/squid/libexec/basic_radius_auth -h radius.example.com -p 1645 -i squid_proxy -w s3cR37 -t 15

auth_param basic children 5

auth_param basic realm Web-Proxy

auth_param basic credentialsttl 5 minute

auth_param basic casesensitive off

acl radius-auth proxy_auth REQUIRED

http_access allow radius-auth

http_access allow localhost

http_access deny all

“` > – A radtest tool that can test the RADIUS server from the command line, using the same parameters as the proxy radius module. For example: “`bash

radtest

user password

radius.example.com 1645 s3cR37

“` >

Troubleshooting steps

>
> If you have followed the prerequisites, but you still cannot get proxy radius authentication to work for Squid, you can try the following steps to diagnose the problem: >
> 1. Check the Squid logs for any errors or warnings related to authentication. The Squid logs are usually located in /var/log/squid, or /opt/squid/var/logs, depending on your installation. Look for messages that contain the words “auth”, “radius”, or “squid_radius_auth”. For example, you may see something like this: “`bash

WARNING: Authentication helper program /opt/squid/libexec/basic_radius_auth: (1) Server radius.example.com failed to respond

ERROR: Authentication helper program /opt/squid/libexec/basic_radius_auth: (2) No response from RADIUS server

“` > These messages indicate that the proxy radius module cannot connect to the RADIUS server, or the RADIUS server does not reply to the authentication requests. This could be due to network issues, firewall rules, or incorrect RADIUS server settings. > 2. Check the RADIUS server logs for any errors or warnings related to authentication. The RADIUS server logs are usually located in /var/log/radius, or /etc/raddb/logs, depending on your installation. Look for messages that contain the words “auth”, “radius”, or “squid_proxy”. For example, you may see something like this: “`bash

WARNING: Received request from unknown client 192.168.1.10 port 1645

ERROR: Ignoring request from unknown client 192.168.1.10 port 1645

“` > These messages indicate that the RADIUS server does not recognize the Squid server as a valid client, or the shared secret does not match. This could be due to incorrect RADIUS client settings, or mismatched shared secrets. > 3. Check the proxy radius module for any errors or warnings related to authentication. The proxy radius module is usually located in /opt/squid/libexec, or /usr/local/squid/libexec, depending on your installation. You can run the module from the command line, using the same parameters as the Squid configuration file. For example: “`bash /opt/squid/libexec/basic_radius_auth -h radius.example.com -p 1645 -i squid_proxy -w s3cR37 -t 15 “` > Then, you can enter a username and password on the same line, separated by a space, and press Enter. The module should return either “

OK

” or “ERR” depending on the authentication result. For example: “`bash

user password

OK

“` > If the module returns “

OK

“, it means that the proxy radius module can communicate with the RADIUS server, and the user credentials are valid. If the module returns “ERR”, it means that there is a problem with the proxy radius module, the RADIUS server, or the user credentials. The module may also print some error messages to the standard error output, which you can redirect to a file for further analysis. For example: “`bash /opt/squid/libexec/basic_radius_auth -h radius.example.com -p 1645 -i squid_proxy -w s3cR37 -t 15 2> error.log “` > 4. Check the radtest tool for any errors or warnings related to authentication. The radtest tool is usually located in /usr/bin, or /usr/local/bin, depending on your installation. You can run the tool from the command line, using the same parameters as the proxy radius module. For example: “`bash

radtest

user password

radius.example.com 1645 s3cR37

“` > The tool should return either “Access-Accept” or “Access-Reject” depending on the authentication result. For example: “`bash

Sending Access-Request of id 0 to 192.168.1.20 port 1645

User-Name = “user”

User-Password = “password”

NAS-IP-Address = 192.168.1.10

NAS-Port = 0

NAS-Identifier = “squid_proxy”

rad_recv: Access-Accept packet from host 192.168.1.20 port 1645, id=0, length=20

“` > If the tool returns “Access-Accept”, it means that the radtest tool can communicate with the RADIUS server, and the user credentials are valid. If the tool returns “Access-Reject”, it means that there is a problem with the radtest tool, the RADIUS server, or the user credentials. The tool may also print some error messages to the standard error output, which you can redirect to a file for further analysis. For example: “`bash

radtest

user password

radius.example.com 1645 s3cR37

2> error.log “` >

Conclusion

>
> In this article, we have shown you how to troubleshoot some common issues that may arise when using proxy radius authentication for Squid. We have covered how to check the Squid logs, the RADIUS server logs, the proxy radius module, and the radtest tool for any errors or warnings related to authentication. We hope that this article has helped you to solve your problem, or at least narrow down the possible causes. If you have any questions or feedback, please feel free to contact us. Thank you for reading..