Paranoid Penguin - Building a Secure Squid Web Proxy, Part III

Tighten the controls on your Squid Web proxy.

We've been building a secure Squid Web Proxy the past few months, and we'll continue to do so for a couple more. Last time [May 2009], we got Squid installed, running and restricted to serve only local clients (based on their IP addresses). This month, we delve deeper into Squid's Access Control List (ACL) capabilities and other built-in security features.

ACL Review

As you may recall from my last column, all we had to do to get Squid running on a standard Ubuntu 8.04 system was add two lines to the file /etc/squid/squid.conf:

acl mick_network src 10.0.2.0/24
http_access allow mick_network

We inserted those two lines, which allow outbound proxy connections from clients whose IP addresses fall within the network 10.0.2.0/24 (that is, addresses 10.0.2.1 through 10.0.2.254), right above Squid's default “deny all” ACL, which looks like this:

http_access deny all

You can correctly infer from this that, by default, Squid denies proxy connections from all clients. This is a refreshing change in default server application configurations during the past few years. Whereas in the past, many applications had default configurations that would “just work”, which is a very user-friendly but also excessively open stance, nowadays few network applications will do much of anything without some administrative intervention. This is only sensible. Connecting things to the Internet that you don't even know how to configure is the way of pain.

Getting back to our example ACL, the acl statement itself is fairly self-explanatory: acl tells Squid we're defining an ACL; mick_network is its name; src indicates it matches the client's source IP address or network address; and 10.0.2.0/24 is the network address in CIDR notation that will match this ACL.

This is the simplest type of ACL and still one of the most useful. In February 2002, if the New York Times had had a simple source-IP/network ACL correctly configured on its Internet-facing corporate Web proxies, the rogue hacker Adrian Lamos couldn't have gained access quite so easily to its editorial-page contributor database or its Lexus-Nexus portal.

ACLs in More Depth

Besides clients' (source) IP addresses, Squid also can match a great deal of other proxy transaction characteristics. Note that some of these deal with arcane HTTP headers and parameters, many of which are minimally useful for most Squid users anyhow.

Table 1. Complete List of ACL Types Supported in Squid 2.6

ACL TypeDescription
srcClient (transaction source) IP address or network address.
dstServer (transaction destination) IP address or network address.
myipLocal IP address on which Squid is listening for connections.
arpClient's Ethernet (MAC) address (matches local LAN clients only).
srcdomainClient's domain name as determined by reverse DNS lookup.
dstdomainDomain portion of URL requested by client.
srcdom_regexRegular expression matching client's domain name.
dstdom_regexRegular expression matching domain in requested URL.
timePeriod of time in which transaction falls.
url_regexRegular expression matching entire requested URL (not just domain).
urlpath_regexRegular expression matching path portion of requested URL.
urlloginRegular expression matching requested URL's “login” field.
portRequested site's (destination) TCP port.
myportLocal TCP port on which Squid is listening for connections.
protoApplication-layer protocol of request (HTTP, HTTPS, FTP, WHOIS or GOPHER).
methodRequest's HTTP method (GET, POST or CONNECT).
browserMatches the client's browser, per HTTP “User-Agent” header.
referer_regexRegular expression matching the unreliable HTTP “Referer” header (that is, the supposed URL of some page on which the user clicked a link to the requested site).
identMatches specified user name(s) of user(s) running client browser, per an “ident” lookup. Note that ident replies, which often can be spoofed, should not be used in lieu of proper authentication.
ident_regexRegular expression defining which client user names to match per ident lookup.
src_asMatches client IP addresses associated with the specified Autonomous System (AS) number, usually an ISP or other large IP registrant.
dst_asMatches destination-server IP addresses associated with the specified AS number.
proxy_authMatches the specified user name, list of user names or the wild card REQUIRED (which signifies any valid user name).
proxy_auth_regexRegular expression defining which user names to match.
snmp_community For SNMP-enabled Squid proxies, matches client-provided SNMP community string.
maxconnMatches when client's IP address has established more than the specified number of HTTP connections.
max_user_ipMatches the number of IP addresses from which a single user attempts to log in.
req_mime_typeMatches a regular expression describing the MIME type of the client's request (not the server's response).
req_headerMatches a regular expression applied to all known request headers (browser, referer and mime-type) in the client's request.
rep_mime_typeMatches a regular expression describing the MIME type of the server's response.
rep_headerMatches a regular expression applied to all known request headers (browser, referer and mime-type) in the server's response.
externalPerforms an external ACL lookup by querying the specified helper class defined in the external_acl_type tag.
urlgroupMatches a urlgroup name, as defined in redirector setups.
user_certMatches specified attribute (DN, C, O, CN, L or ST) and values against client's SSL certificate.
ca_certMatches specified attribute (DN, C, O, CN, L or ST) and values against client certificate's issuing Certificate Authority certificate.
ext_userMatches specified user name(s) against that returned by an external ACL/authentication helper (configured elsewhere in squid.conf).
ext_user_regexMatches a regular expression describing user names to be matched against that returned by an external ACL/authentication helper.

I've presented the full range of possible ACL types to give you a taste for how rich Squid's ACL functionality is. Needless to say, however, I can't cover usage scenarios for (or even adequately explain) all of these. ViServe's “Squid 2.6 Configuration Manual” (see Resources) gives complete syntax and usage examples for all.

Many, if not most, Squid installations don't go much beyond a few src ACLs, along with perhaps a few simple dstdomain blacklist entries thrown in for good measure. Many of the other most useful ACL types, such as myip, time, port, proto, method, dst_mime_type and rep_mime_type, should be reasonably self-explanatory (or at least easy enough to understand from the examples shown in squid.conf's comments).

One category of less-intuitive ACL types is particularly powerful and useful: the ones that enable Squid to authenticate client users via external authentication authorities. Before we tackle authentication, however, we should give a little more attention to ACL operators, the tags that perform some action (most commonly, to allow or deny a request) based on a matched ACL.

By far, the most important ACL operator is http_access, which specifies whether Squid should allow the transaction matching the specified ACL to proceed. Going back to the example ACL/operator pair from the beginning of this section, after we defined the ACL mick_network as all transactions involving client/source IP addresses within 10.0.2.0/24, we operated on it with this line:

http_access allow mick_network

This is simple enough to understand: “allow HTTP requests matching the ACL named mick_network.”

The most common use of ACLs is to specify a list of ACLs and http_access statements, ending (as we've seen) with a “drop by default” line, like this:

http_access deny all

This has the effect of creating a “whitelist”— a list of types of transactions that are allowed, with all others being denied.

Squid recognizes a number of additional ACL operators besides http_allow, including no_cache, ident_lookup_access, always_direct, never_direct and snmp_access. Because most of these concern cache performance, HTTP redirects and communications with other Squid servers rather than security per se, I'll leave it to you to explore those (or not) as your particular needs dictate. The Squid User's Guide referenced in the Resources section is a good source of information about Squid's various ACL operators.

______________________

Webinar
One Click, Universal Protection: Implementing Centralized Security Policies on Linux Systems

As Linux continues to play an ever increasing role in corporate data centers and institutions, ensuring the integrity and protection of these systems must be a priority. With 60% of the world's websites and an increasing share of organization's mission-critical workloads running on Linux, failing to stop malware and other advanced threats on Linux can increasingly impact an organization's reputation and bottom line.

Learn More

Sponsored by Bit9

Webinar
Linux Backup and Recovery Webinar

Most companies incorporate backup procedures for critical data, which can be restored quickly if a loss occurs. However, fewer companies are prepared for catastrophic system failures, in which they lose all data, the entire operating system, applications, settings, patches and more, reducing their system(s) to “bare metal.” After all, before data can be restored to a system, there must be a system to restore it to.

In this one hour webinar, learn how to enhance your existing backup strategies for better disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible bare-metal recovery solution for UNIX and Linux systems.

Learn More

Sponsored by Storix