[squid-users] Container Based Issues Lock Down Password and Terminate SSL

[Amos Jeffries]

On 23/04/24 11:52, Jonathan Lee wrote:
> Hello fellow Squid Accelerator/Dynamic Cache/Web Cache Users/PfSense users
> 
> I think this might resolve any container based issues/fears if they 
> happened to get into the cache. Ie a Docker Proxy got installed and 
> tried to data marshal the network card inside of a freeBSD jail or 
> something like that. Biggest fear with my cache it is a big cache now
> 
> Please yet me know what you think or if it is wrong.
> 
> Here is my configuration. I wanted to share it as it might help to 
> secure some of this.

FTR, this config was auto-generated by pfsense. A number of things which 
that tool forces into the config could be done much better in the latest 
Squid, but the tool does not do due to needing to support older Squid 
version.


> 
> Keep in mine I use cachemgr.cgi within Squidlight so I had to set the 
> password and I have to also adapt the php status file to include the 
> password and also the sqlight php file.
> 
> After that the status and gui pages work still with the new password. 
> Only issues area that it shows up in clear text when it goes over the 
> proxy I can see my password clear as day again that was an issue listed 
> inside the Squid O’REILLY book also.


Please ensure you are using the latest Squid v6 release. That release 
has both a number of security fixes, and working https:// URL access to 
the manager reports.

The cachemgr.cgi tool is deprecated fro a number of issues including 
that style of embedding passwords in the URLs.

Francesco and I have created a tool that can be found at 
<https://github.com/yadij/cachemgr.js/blob/master/README.md> for basic 
access to the reports directly from Browser.
That tool uses HTTP authentication configured via the well-documented 
proxy_auth ACLs and http_access for more secure access than the old URL 
based mechanism (which still exists, just deprecated).



Cheers
Amos