Paranoid Penguin - Building a Secure Squid Web Proxy, Part III
Setting ACLs, running Squid with nonroot privileges most or all of the time and running Squid in a chroot jail constitute the bulk of Squid's built-in security features. But, these are not the only things you can do to use Squid to enhance your network and end-user systems' security.
Next time, I'll show you how to use add-on tools such as SquidGuard to increase Squid's intelligence in how it evaluates clients' requests and servers' replies. I'll also address (if not next time then in a subsequent column) some of the finer points of proxying TLS/SSL-encrypted sessions. Until then, be safe!
Wessels, Duane: Squid: The Definitive Guide. Sebastopol, CA: O'Reilly Media, 2004. Includes some tips on creating and using a Squid chroot jail.
The Squid home page, where you can obtain the latest source code and binaries for Squid: www.squid-cache.org.
The Ubuntu Server Guide's Squid chapter: https://help.ubuntu.com/8.10/serverguide/C/squid.html.
The Squid User's Guide: www.deckle.co.za/squid-users-guide/Main_Page.
ViSolve's Squid 2.6 Configuration Manual and Comprehensive squid.conf Reference: www.visolve.com/squid/squid26/contents.php.
“The Homeless Hacker v. The New York Times”, Jennifer Kahn's article in Wired about Adrian Lamos: www.wired.com/wired/archive/12.04/hacker_pr.html.
Chris Wichura's slideshow “The Squid Caching Proxy”: www.uniforum.chi.il.us/slides/squid/UniForum-Squid.ppt.
Vivek Gite's tutorial “Howto: Squid proxy authentication using ncsa_auth helper”: www.cyberciti.biz/tips/linux-unix-squid-proxy-server-authentication.html.
Vivek Gite's Tutorial “Configure squid for LDAP authentication using squid_ldap_auth helper”: www.cyberciti.biz/tips/howto-configure-squid-ldap-authentication.html.
David Bolton's “Howto: Squid + msnt_auth + Active Directory”: www.davidbolton.com/?p=32.
Paul Matthews' HOWTO “Squid with PAM Authentication and Squish Download Manager”: www.opensourcehowto.org/how-to/squid/squid-with-pam-authentication--squish-download-manager.html.
Thread from the squid-users mailing list, on what should go into a Squid chroot jail: www.squid-cache.org/mail-archive/squid-users/200609/0782.html.
Thread from the squid-users mailing list, about some of the finer points of running Squid in a chroot jail: www.squid-cache.org/mail-archive/squid-users/200811/0411.html.
Mick Bauer (firstname.lastname@example.org) is Network Security Architect for one of the US's largest banks. He is the author of the O'Reilly book Linux Server Security, 2nd edition (formerly called Building Secure Servers With Linux), an occasional presenter at information security conferences and composer of the “Network Engineering Polka”.
Practical Task Scheduling Deployment
July 20, 2016 12:00 pm CDT
One of the best things about the UNIX environment (aside from being stable and efficient) is the vast array of software tools available to help you do your job. Traditionally, a UNIX tool does only one thing, but does that one thing very well. For example, grep is very easy to use and can search vast amounts of data quickly. The find tool can find a particular file or files based on all kinds of criteria. It's pretty easy to string these tools together to build even more powerful tools, such as a tool that finds all of the .log files in the /home directory and searches each one for a particular entry. This erector-set mentality allows UNIX system administrators to seem to always have the right tool for the job.
Cron traditionally has been considered another such a tool for job scheduling, but is it enough? This webinar considers that very question. The first part builds on a previous Geek Guide, Beyond Cron, and briefly describes how to know when it might be time to consider upgrading your job scheduling infrastructure. The second part presents an actual planning and implementation framework.
Join Linux Journal's Mike Diehl and Pat Cameron of Help Systems.
Free to Linux Journal readers.Register Now!
- SUSE LLC's SUSE Manager
- My +1 Sword of Productivity
- Murat Yener and Onur Dundar's Expert Android Studio (Wrox)
- Managing Linux Using Puppet
- Non-Linux FOSS: Caffeine!
- Doing for User Space What We Did for Kernel Space
- SuperTuxKart 0.9.2 Released
- Parsing an RSS News Feed with a Bash Script
- Google's SwiftShader Released
- Rogue Wave Software's Zend Server