[squid-users] Looking for additional information about securing squid
sb33781 at gmail.com
Tue Dec 13 22:44:12 UTC 2016
My background's in networking, I'm very new to unix/linux and server
administration, I don't know a whole lot about security beyond ACLs and
setting up crypto for VPNs. I'm setting up a box at home with CentOS and
squid, among other features (I want this box to be a syslog server, etc).
At the moment I have no plan to run a web server, but I'm still concerned.
I know web servers are vulnerable to certain kinds of attacks, some of which
could escalate user privileges or dump data people shouldn't have access to.
Is squid, as a proxy server, I'm vulnerable to some of these kinds of
attacks? I'll be limiting squid to only accept traffic from my LAN but you
still never know. A guest might use my network with an infected device,
I've looked at the security FAQ on the squid wiki, and I tried to search the
mailing list archive using the link at
http://www.squid-cache.org/Support/mailing-lists.html, however I get a 404
error. I downloaded the last 6 months worth of archives and searched for
the word security, and I see references to SSL, TLS, bumping, etc. I'm sure
these conversations follow the requirements of people using squid at work
but aside from one thread I don't see anything addressing my concerns, hence
I suspect there's no more additional securing of squid I need to do - if
there were I would've expected something to mention it in the FAQ - but I'd
rather ask just in case. Any thoughts/suggestions?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the squid-users