Comprehensive Guide to Squid 7.5: Kerberos + LDAP Auth, SSL-Bump, JSON Logging, Delay Pools, and Cache Optimization

Comprehensive Guide to Squid 7.5: Kerberos + LDAP Auth, SSL-Bump, JSON Logging, Delay Pools, and Cache Optimization

Introduction

Squid, the venerable caching and forwarding HTTP proxy, has been a cornerstone of enterprise network infrastructure for decades. The release of Squid 7.5 in early 2026 brings significant improvements in authentication flexibility, logging granularity, and security inspection capabilities. This guide provides a detailed, step-by-step walkthrough for configuring Squid 7.5 with integrated Kerberos and LDAP authentication, SSL-Bump for HTTPS inspection, structured JSON logging, delay pools for bandwidth management, and optimized caching. The material is based on a comprehensive case study published by a team of infrastructure engineers, which you can find in the original source article on Habr Source.

Why Squid 7.5? Key Improvements Over Previous Versions

Squid 7.5 is not merely an incremental update. According to the official Squid release notes (squid-cache.org, 2026), it introduces native support for Kerberos authentication without external helper binaries, a rewritten SSL-Bump engine that reduces latency by approximately 12–15% compared to Squid 6.x, and a new logging subsystem capable of emitting structured JSON logs directly. The development team behind the case study reported that migrating from Squid 6.8 to 7.5 reduced their proxy response times by an average of 8% under identical load conditions (10,000 concurrent connections, 500 Mbps throughput).

Core Architecture: Authentication with Kerberos and LDAP

The Problem with Traditional Proxy Auth

Traditional Squid setups often rely on basic authentication (plaintext passwords) or NTLM, which present security risks or compatibility issues in modern Active Directory environments. The case study's organization, a mid-sized enterprise with 2,500 employees, needed seamless single sign-on (SSO) for Windows and Linux clients without exposing credentials.

Solution: Kerberos + LDAP Integration

The authors implemented a two-tier authentication scheme:

1. Kerberos (GSSAPI) for initial ticket exchange — Squid 7.5 now supports the negotiate authentication scheme natively via the auth_param negotiate directive, using the system's Kerberos keytab file. This eliminates the need for the squid_kerb_auth helper.

2. LDAP for authorization and group membership checks — After Kerberos authenticates the user, Squid queries an LDAP server (e.g., Active Directory or OpenLDAP) to verify group membership and apply policy.

Configuration Snippet

# /etc/squid/squid.conf

# Kerberos authentication
auth_param negotiate program /usr/lib/squid/negotiate_kerberos_auth -d -s HTTP/proxy.example.com@EXAMPLE.COM
auth_param negotiate children 20 startup=5 idle=1
auth_param negotiate keep_alive on

# LDAP authorization
external_acl_type ldap_group %LOGIN /usr/lib/squid/ext_ldap_group_acl -R -b "dc=example,dc=com" -D "cn=squid-proxy,cn=Users,dc=example,dc=com" -W /etc/squid/ldap-password.txt -f "(&(objectClass=user)(sAMAccountName=%u)(memberOf=cn=proxy-users,cn=Users,dc=example,dc=com))"

acl allowed_users external ldap_group
http_access allow allowed_users

Performance Impact

The team measured authentication latency: Kerberos ticket exchange took an average of 8 ms, while LDAP group lookup added another 12 ms. Total auth overhead was ~20 ms per request, acceptable for their environment. They noted that increasing auth_param negotiate children to 25 reduced peak authentication queue times by 40% during morning login storms.

SSL-Bump: Intercepting HTTPS Traffic

Why SSL-Bump Matters

With over 85% of web traffic now encrypted (Google Transparency Report, 2025), proxies that cannot inspect HTTPS are effectively blind. The organization needed to enforce content filtering and malware detection on HTTPS traffic while complying with internal security policies.

Squid 7.5 SSL-Bump Configuration

The authors used a dynamic certificate generation approach with a local Certificate Authority (CA) distributed to all client devices via Group Policy.

# SSL-Bump configuration
http_port 3128 ssl-bump cert=/etc/squid/ssl_cert/myCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=10MB

# Bumping rules
acl step1 at_step SslBump1
ssl_bump peek step1
ssl_bump bump all

# Cache bumped certificates
sslproxy_cert_error deny all
sslproxy_flags DONT_VERIFY_PEER

Technical Details

• Peek-and-bump: Squid first inspects the ClientHello (step SslBump1) to decide whether to bump or splice the connection.
• Dynamic certificate cache: Set to 10 MB, which the team found sufficient for 5,000 unique sites visited daily.
• Performance: SSL-Bump added ~15 ms latency per HTTPS request. The team optimized by enabling sslproxy_session_cache_size (set to 50 MB), which reduced handshake overhead for repeated connections by 60%.

Security Considerations

The article emphasizes that SSL-Bump must be used with caution: it breaks end-to-end encryption and should only be deployed on corporate-managed devices with explicit user consent. The team implemented a bypass list for sensitive domains (e.g., banking, healthcare) using ssl_bump splice rules.

Structured Logging in JSON Format

The Need for Machine-Readable Logs

Traditional Squid logs (native format or CLF) are line-based and difficult to parse programmatically. The organization used Elasticsearch and Kibana for log analysis and needed structured data.

Enabling JSON Logging in Squid 7.5

Squid 7.5 introduces the access_log directive with a json format option. The authors configured it as follows:

# JSON logging
logformat json_fmt %{%Y-%m-%dT%H:%M:%S+00:00}tl %>a %>A %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt
access_log daemon:/var/log/squid/access.json json_fmt

This produces entries like:

{"timestamp":"2026-07-19T14:23:11+00:00","client_ip":"192.168.1.45","server_ip":"10.0.0.1","status":"TCP_MISS/200","size":15432,"method":"GET","url":"https://example.com/resource","user":"jdoe","server_host":"192.168.2.10/443","mime_type":"text/html"}

Storage and Performance

The team logged approximately 12 GB of JSON data per day (for 2,500 users, ~8 million requests daily). They rotated logs every 6 hours and used Logstash to ship them to Elasticsearch. JSON logging increased CPU usage by 3% compared to native format, but the team deemed it acceptable for the analytical benefits.

Delay Pools: Bandwidth Management

The Challenge

The organization had a mix of critical business applications (ERP, VoIP) and non-critical traffic (streaming, social media). Without rate limiting, non-critical traffic could saturate the internet link (500 Mbps).

Delay Pools Configuration

Squid delay pools allow per-user or per-IP bandwidth throttling. The authors implemented three classes:

```squid

Delay pools configuration

delay_pools 3
delay_class 1 2
delay_class 2 2
delay_class 3 1

Pool 1: default

delay_parameters 1 200000000/200000000 5000000/5000000
delay_access 1 allow all

Pool 2: VIP users

delay_parameters 2 400000000/400000000 20000000/20000000
acl vip_users proxy_auth