Recommended Free Tools
Install Squid, create an NCSA-style password file, require proxy authentication in /etc/squid/squid.conf, then test an explicit proxy client with valid and invalid credentials. The procedure below works on Ubuntu systems using the distribution Squid package, but helper paths, package defaults, and available directives can vary by Ubuntu release, so verify them on the host before restarting the service.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What you are building
This configuration creates an explicit forward proxy. A browser, command-line tool, game launcher, or other client is told the proxy hostname and listening port, then sends its web requests through Squid. Squid challenges the client for a username and password before allowing the request.
As an Amazon Associate I earn from qualifying purchases.
Authentication uses Squid’s NCSA helper, basic_ncsa_auth, which reads an Apache httpd-style password file. The file is managed with htpasswd; the Ubuntu helper documentation states that the password file “can be manipulated using htpasswd.” This is local file authentication: Squid checks the credentials against entries stored on the proxy server rather than consulting a directory service.
The example uses the conventional listener port 3128, but the active http_port in your configuration is authoritative. Basic proxy authentication protects the credential exchange only as well as the network path carrying it. Restrict access to the proxy, administer the server over a trusted or encrypted connection, and do not treat Basic authentication as end-to-end encryption for the traffic being proxied.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Requirements and decisions before installation
Choose explicit proxy mode
Each client must know that it should use the proxy and must be configured with the proxy hostname or IP address and port. This is the mode in which proxy authentication works. Squid’s authentication documentation states: “Simply said, it’s not possible to authenticate users using proxy authentication schemes when running in interception or transparent modes.” If you need transparent interception, use a different access-control design rather than expecting a browser to answer a proxy-authentication challenge.
Confirm the Ubuntu and Squid release
Ubuntu release packaging affects the Squid major version, package defaults, helper location, service account, and supported directives. The Jammy basic_ncsa_auth manual is useful for the helper behavior, but do not assume every path is identical on another release. After installation, locate the helper with:
command -v basic_ncsa_authIf that returns nothing, inspect the package file list:
dpkg -L squid | grep basic_ncsa_authUse the path actually installed on your machine in auth_param basic program.
Plan who can reach the listener
Authentication is not a substitute for network filtering. Permit only the client networks that should use the proxy with your firewall or upstream controls, and avoid exposing an authenticated forward proxy to the public internet. An open or weakly protected proxy can be abused for third-party traffic, consume bandwidth, and put your host’s address on abuse lists.
Install Squid and the password-file utility
Update the package index and install Squid:
sudo apt update
sudo apt install squidThe htpasswd command is supplied by the Apache utilities package on Ubuntu. Install it explicitly if it is not already present:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo apt install apache2-utilsCheck that the service is installed and identify its initial state:
systemctl status squidDo not edit the configuration yet without making a recoverable copy. Preserve the original file and create a dated backup before changing it:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
sudo cp -a /etc/squid/squid.conf /etc/squid/squid.conf.backupCreate the NCSA password file
Add the first account
Create the file and an initial user with -c (create). The command prompts for the password without displaying it:
sudo htpasswd -c /etc/squid/passwords proxyuserUse -c only for the first account. Running it again replaces the existing file and removes previously created users.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteAdd additional users
Append users without -c:
sudo htpasswd /etc/squid/passwords anotheruserTo change an existing user’s password, run the same command with that username. To remove an account:
sudo htpasswd -D /etc/squid/passwords anotheruserReview the entries without exposing the file through a web server or broad filesystem permissions:
sudo ls -l /etc/squid/passwords
sudo getent passwd proxyThe second command helps identify a possible Squid service account named proxy; package or release details may differ. Determine the account used by the running service with:
systemctl show -p User squidSet ownership and permissions deliberately
The helper must be able to read the file as the Squid service account. The Ubuntu helper manual says the password file “must have permissions to be read by the user that Squid is running as.” It should not be world-readable.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
One common arrangement is to make the service account the owner and allow only the owner to read and write:
sudo chown proxy:proxy /etc/squid/passwords
sudo chmod 600 /etc/squid/passwordsUse the actual service user and group reported on your system. If your package uses a different group or a privileged administrator must edit the file, choose a group-readable arrangement instead, but grant no permissions to unrelated users:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
sudo chown root:proxy /etc/squid/passwords
sudo chmod 640 /etc/squid/passwordsAfter changing ownership, verify that the service account can read the file. For a service account named proxy:
sudo -u proxy test -r /etc/squid/passwords && echo readableAlso check parent-directory traversal permissions. A readable file is not sufficient if the service user cannot traverse /etc/squid.
Configure Basic authentication in squid.conf
Open the configuration file:
sudo editor /etc/squid/squid.confSquid’s packaged configuration can contain sample rules that allow local networks or other clients. Read the complete file and remove, comment, or place your rules so that an earlier broad http_access allow cannot bypass authentication. Add or adapt this block:
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
auth_param basic children 5
auth_param basic credentialsttl 1 minute
auth_param basic realm Squid proxy-caching web server
acl authenticated proxy_auth REQUIRED
http_access deny !authenticated
http_access allow authenticated
http_access deny allReplace /usr/lib/squid/basic_ncsa_auth if command -v or the package file list shows a different location.
What each directive does
| Directive | Purpose | Operational consideration |
|---|---|---|
auth_param basic program |
Starts the Basic authentication helper and points it at the password file. | The executable path must exist and the Squid service account must be able to read the file. |
auth_param basic children 5 |
Allows five helper processes to handle authentication requests. | Keep the value appropriate for your client volume; the example is a starting configuration, not a capacity guarantee. |
auth_param basic credentialsttl 1 minute |
Controls how long Squid caches a successful credential result. | A shorter lifetime limits the period for which a changed or revoked password remains accepted, while increasing repeated helper checks. |
auth_param basic realm |
Sets the text shown by clients in the authentication challenge. | Use a recognizable description that does not reveal unnecessary internal details. |
acl authenticated proxy_auth REQUIRED |
Defines an ACL that matches a client with valid proxy credentials. | REQUIRED means an authenticated identity is necessary. |
http_access deny !authenticated |
Rejects requests that are not authenticated. | This rule must occur before any broad allow rule that could grant access. |
http_access allow authenticated |
Permits requests that match the authenticated ACL. | For tighter control, combine authentication with source-network, destination, or port ACLs. |
http_access deny all |
Provides an explicit final deny. | Keep a final deny so an unintended rule change does not create an implicit open policy. |
Understand rule ordering
Squid evaluates http_access rules in order and stops when a rule determines the result. If an earlier line says http_access allow localnet, a client in that network may be allowed before Squid reaches deny !authenticated. Move the authentication requirement ahead of broad allows, or incorporate authentication into the allow rule. For example, a deployment that should allow only authenticated clients from a known network can define a source ACL and then allow the combination, followed by a final deny. Do not copy a rule into the file without checking how it interacts with the existing packaged policy.
Verify the listener
Find the active listener line:
grep -n '^[[:space:]]*http_port' /etc/squid/squid.confIf no custom line is present, the package commonly listens on port 3128, but verify rather than relying on that default. A port can also be constrained to a specific address, which affects how clients connect.
Validate and restart Squid safely
Parse the configuration first
Where supported by the installed package, run:
sudo squid -k parseA successful parse should report no configuration errors. If it fails, fix the first reported error before restarting. Common causes include a misspelled directive, an incorrect helper path, a missing password file, or a permission problem.
Restart and inspect the service
sudo systemctl restart squid
sudo systemctl status squid --no-pagerConfirm that the service remains active after the restart. If it exits, inspect the unit journal and Squid cache log:
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
sudo journalctl -u squid -b --no-pager
sudo tail -n 100 /var/log/squid/cache.logDo not treat a successful systemd restart alone as proof that authentication works; test both accepted and rejected credentials from a client.
Configure an explicit proxy client
Browser or desktop application
- Open the application’s network or proxy settings.
- Select manual or explicit proxy configuration.
- Enter the proxy server’s hostname or IP address and the verified
http_portvalue, commonly 3128. - Enable the option to use the proxy for the protocols your application should send through Squid.
- Save the settings and open a test page. The client should request a username and password, or display a proxy-authentication error if credentials are absent.
Applications differ in whether they reuse credentials for a session, store them in an operating-system credential manager, or prompt for each new process. A successful browser login does not prove that another application is using the proxy; configure and test each client separately.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Command-line test with curl
Use the proxy URL and credentials explicitly. Substitute the proxy address, port, username, and password:
curl --proxy http://proxy.example:3128 --proxy-user proxyuser:'your-password' https://example.com/A successful request demonstrates that the client can reach the listener, complete Basic authentication, and obtain a response through Squid. Avoid placing real passwords in shell history on shared systems; use a protected environment, an interactive prompt, or the client’s credential facility when appropriate.
Test an incorrect password separately:
curl --proxy http://proxy.example:3128 --proxy-user proxyuser:'wrong-password' https://example.com/The invalid request should fail with a proxy-authentication response rather than being forwarded. Test without credentials as well:
curl --proxy http://proxy.example:3128 https://example.com/Depending on the client and Squid version, the unauthenticated response may be a proxy-authentication challenge or an access denial. Both outcomes indicate that the request was not silently allowed; confirm the exact status and log entry.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Check logs and prove the policy
Squid normally records requests in /var/log/squid/access.log. While testing, watch the log:
sudo tail -f /var/log/squid/access.logGenerate three requests and verify that the log distinguishes them:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
- An unauthenticated request is challenged or denied.
- A request using the correct password-file entry is allowed.
- A request using a wrong password is rejected.
Look for the authenticated username in the access-log format used by your package and for status codes that indicate denial or success. If no entries appear, check that the client is using the correct address and port and that a firewall is not blocking the connection.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Manage accounts and credential changes
Add, change, and remove users
Use htpasswd as the controlled interface to the file:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo htpasswd /etc/squid/passwords newuser
sudo htpasswd /etc/squid/passwords existinguser
sudo htpasswd -D /etc/squid/passwords formeruserAfter a password change, the credentialsttl value determines how long a previously validated credential may remain cached. With the example value of one minute, allow up to that interval for cached authentication decisions to age out, then retest. A client that stores its own proxy credentials may also need to be closed, signed out, or have its saved entry replaced.
Protect the file during administration
Do not copy the password file into a document root, source repository, ticket, or shell transcript. Back up it only to a location with equivalent or stronger permissions, and remove obsolete backups. When transferring a configuration, transfer the password file through an encrypted administrative channel and preserve ownership and mode bits.
Password hashes and helper compatibility
The Ubuntu basic_ncsa_auth documentation lists support for Blowfish, SHA-256, SHA-512, MD5, and DES, subject to how the helper was built. Prefer a modern supported hash on the installed release and verify it with a test account before deploying widely.
DES has a specific hazard: the helper documentation warns that DES silently truncates passwords to eight characters. A user may believe a long password is protecting the account while only the first eight characters are effective. Do not choose DES for new accounts, and check existing files if they were created on an older system.
Hash support is not identical across every Ubuntu and Squid build. If a newly created account cannot authenticate, inspect the generated line, confirm the helper’s supported formats for that release, and test with a temporary account rather than weakening the access rules globally.
Local password files versus other authentication helpers
| Approach | Best fit | Advantages | Costs and cautions |
|---|---|---|---|
NCSA password file with basic_ncsa_auth |
Small deployments, isolated lab networks, or services needing a few independent accounts. | Simple package-supported setup; users are managed with htpasswd; no directory service is required. |
Accounts must be changed on each proxy; file ownership, backups, hash format, and revocation are your responsibility. |
| PAM or another external helper | Environments that already manage identities through a host authentication stack or centralized service. | Can reuse existing account policy and lifecycle controls. | More moving parts, helper-specific configuration, and release-dependent behavior; test failure handling and service-account permissions carefully. |
Choose the NCSA file when its operational simplicity matches the number of users and the required lifecycle controls. Choose another helper only when its identity source and administrative benefits justify the added dependencies. The auth_param framework is the part that connects Squid to the selected helper; changing helpers does not change the requirement for deliberate http_access ordering.
Security controls that belong alongside authentication
- Restrict network reachability: allow only trusted client addresses or networks to connect to the proxy port.
- Use a trusted administration path: manage the Ubuntu host over encrypted remote administration and protect local configuration backups.
- Limit destinations when appropriate: combine the authenticated ACL with destination, port, or domain policies if users should not have unrestricted outbound access.
- Keep credentials private: Basic authentication transmits a username and password representation that must be protected by the surrounding network path. Do not assume it provides end-to-end encryption for ordinary proxied traffic.
- Monitor abuse: review access and cache logs for unexpected source addresses, repeated authentication failures, or unusual volume.
- Use a deliberate credential lifetime: the example’s one-minute
credentialsttllimits stale-cache duration, but a shorter value increases helper work and a longer value delays revocation. - Patch the host: keep Ubuntu and Squid security updates current, then re-run configuration parsing and authentication tests after package changes.
Explicit mode and interception mode are not interchangeable
In explicit mode, the client sends a proxy request to Squid and can respond to a proxy-authentication challenge. In interception or transparent mode, traffic is redirected without the client being configured as a proxy. Squid’s authentication documentation explicitly rules out proxy authentication schemes for those modes. If your network design currently redirects traffic transparently, changing only the auth_param lines will not make username-and-password prompts work. Redesign the client path for explicit proxy use or select an access-control method suitable for interception.
Quick Recap
Troubleshooting by symptom
squid -k parse reports an unknown directive or helper error
- Check that the directive spelling matches the installed Squid version.
- Run
command -v basic_ncsa_authand inspectdpkg -L squidfor the actual helper path. - Confirm that
/etc/squid/passwordsexists and is readable by the service account. - Restore the backup only as a diagnostic step, then reapply the smallest necessary change so you do not lose unrelated site policy.
The service starts, but every valid password fails
- Verify that the client is pointed at the same listener address and port shown by
http_port. - Check the helper path and password-file path character for character.
- Use
sudo -u <service-user> test -r /etc/squid/passwordswith the actual account. - Create a temporary account with
htpasswdand test it, then inspectcache.logfor helper errors. - Check the password-file hash format and avoid DES accounts whose effective password is limited to eight characters.
Unauthenticated clients are still getting access
- Inspect all
http_accesslines abovedeny !authenticated. - Move the authentication requirement ahead of broad
allowrules or require the authenticated ACL in the allow condition. - Retain
http_access deny allas the final rule. - Confirm that the test client is actually using Squid rather than connecting directly.
The service will not restart after editing
- Run
sudo squid -k parseand fix the first error reported. - Read
sudo journalctl -u squid -b --no-pagerand/var/log/squid/cache.log. - Check for a port conflict, malformed ACL, inaccessible helper, or password file permission change.
- After correction, parse again before restarting.
Authentication works once, then behavior seems inconsistent
- Account for the configured one-minute credential cache lifetime.
- Clear or replace credentials stored by the client.
- Check whether multiple Squid instances or listeners are serving different configuration files.
- Compare the client’s source address and request timestamps with
access.log.
Final validation checklist
sudo squid -k parsereports no configuration errors where that command is supported.systemctl status squidshows the service active after restart.- The password file exists, is not world-readable, and is readable by the Squid service account.
- An explicit proxy client receives a challenge or denial without credentials.
- A valid password-file entry permits a request.
- A wrong password fails.
- Access and cache logs show the expected accepted and rejected requests.
- The listener port and firewall exposure match the intended client network.
- The deployment remains in explicit proxy mode if proxy authentication is required.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
