Squid is one of the most popular proxy/cache server, and there are some security issues that should be taken into account. Squid's default configuration file denies all users requests. However the Debian package allows access from 'localhost', you just need to configure your browser properly. You should configure Squid to allow access to trusted users, hosts or networks defining an Access Control List on
/etc/squid/squid.conf, see the
https://web.archive.org/web/20061206052115/http://www.deckle.co.za/squid-users-guide/Main_Page for more information about defining ACLs rules. Notice that Debian provides a minimum configuration for Squid that will prevent anything, except from
localhost to connect to your proxy server (which will run in the default port 3128). You will need to customize your
/etc/squid/squid.conf as needed.
The recommended minimum configuration (provided with the package) is shown below:
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 901 # SWAT
acl purge method PURGE
acl CONNECT method CONNECT
(...)
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
# Only allow purge requests from localhost
http_access allow purge localhost
http_access deny purge
# Deny requests to unknown ports
http_access deny !Safe_ports
# Deny CONNECT to other than SSL ports
http_access deny CONNECT !SSL_ports
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
http_access allow localhost
# And finally deny all other access to this proxy
http_access deny all
#Default:
# icp_access deny all
#
#Allow ICP queries from everyone
icp_access allow all
You should also configure Squid based on your system resources, including cache memory (option cache_mem), location of the cached files and the amount of space they will take up on disk (option cache_dir).
Además, si no configuró debidamente, algúien puede enviar correo a través de Squid, puesto que el diseño de los protocolos HTTP y SMTP es semejante. El archivo de configuración Squid niega por defecto el acceso al puerto 25. Si desea permitir las conexiones del puerto 25 adiciónelo a la lista Safe_ports. Sin embargo, esto NO is recomendado.
Ajustar y configurar debidamente el proxy/cache es solamente una parte para mantener su sitio seguro. Otra tarea necesaria es analizar los registros de Squid asegurándose que todas las cosas que están trabajando, deben hacerlo como se espera. Hay algunos paquetes en Debian GNU/Linux que pueden ayudar al administrador a hacer esto. Los siguientes paquetes estan disponibles en woody (Debian 3.0):
calamaris - Analizar de las bitácoras de los proxy Squid y Oops.
modlogan - Analizador modular de bitácoras.
sarg - Generador de Reportes de Análisis de Squid.
squidtaild - Squid log monitoring program.
