Squid Proxy Authentication With PHP/MySQL

Many methods to do authentication in Squid, ie basic, ncsa, ntlm, kerberos, radius,.... But what about authenticate a user by looking in a MySQL table? More convenience if the language is PHP, as everybody language in the Web B-). So, after some quick googling results many clues, I picked one here and added some lines for data retrieval from MySQL. Here they are:

#!/usr/bin/php
mysql_connect("localhost","root","password");
if (! defined(STDIN)) {
        define("STDIN", fopen("php://stdin", "r"));
}
while (!feof(STDIN)) {
        $line = trim(fgets(STDIN));
        $fields = explode(' ', $line);
        $username = rawurldecode($fields[0]); //1738
        $password = rawurldecode($fields[1]); //1738
        $db=mysql("auth","select * from user where nama='$username' and passwd='$password'");
        if(mysql_num_rows($db)>0){
                fwrite(STDOUT, "OK\n");
        } else {
                // failed miserably
                fwrite(STDOUT, "ERR\n");
        }
}
?>

Very simple as we write. Next, chmod the script, eg auth.php with execute permission. Copy/move the script into any folder accessible by squid, just place it in /etc/squid is very well.

Edit /etc/squid/squid.conf, add the following lines:

auth_param basic program /etc/squid/auth.php
auth_param basic children 20
auth_param basic realm FKM HotSpot
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off

And allow only authenticated user:

acl AuthenticatedUsers proxy_auth REQUIRED
http_access allow AuthenticatedUsers
http_access deny all

Restart squid. One major drawback is we have to manually set the browser using the squid address and port, the authentication can't be done in a transparent proxy mode.