CIS Squid Proxy Benchmark

This recommendation verifies that Squid runs as a non-root user on the Squid caching proxy server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Squid caching proxy server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify Squid runs as a non-root user
ps -eo user,pid,comm | grep squid
grep 'cache_effective_user\|cache_effective_group' /etc/squid/squid.conf

# Configure Squid to run as proxy user
# In squid.conf:
cache_effective_user proxy
cache_effective_group proxy
chown -R proxy:proxy /var/spool/squid /var/log/squid

This setting ensures that configuration file permissions are restricted on the Squid caching proxy server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Squid caching proxy server is essential for defense in depth.

# Check configuration file permissions
stat -c '%a %U %G' /etc/squid/squid.conf
find /etc/squid -type f -exec stat -c '%a %n' {} \;

# Restrict configuration permissions
chmod 640 /etc/squid/squid.conf
chown root:proxy /etc/squid/squid.conf
chmod 750 /etc/squid/

This recommendation verifies that ACLs restrict access to authorized networks on the Squid caching proxy server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Squid caching proxy server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify ACLs restrict access
grep -E '^acl|^http_access' /etc/squid/squid.conf | grep -v '^#'

# Configure restrictive ACLs
# In squid.conf:
acl localnet src 10.0.0.0/8
acl localnet src 172.16.0.0/12
acl localnet src 192.168.0.0/16
acl SSL_ports port 443
acl Safe_ports port 80 443 21 70 210 280 488 591 777 1025-65535
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access deny all

This recommendation ensures that proxy authentication is required on the Squid caching proxy server. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Squid caching proxy server may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check if authentication is required
grep -E 'auth_param|proxy_auth' /etc/squid/squid.conf | grep -v '^#'

# Configure NCSA authentication
# In squid.conf:
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd
auth_param basic children 5
auth_param basic realm Squid Proxy
auth_param basic credentialsttl 2 hours
acl authenticated proxy_auth REQUIRED
http_access allow authenticated
http_access deny all
# Create password file:
htpasswd -c /etc/squid/passwd first_user

This recommendation verifies that TLS is configured with minimum version 1.2 on the Squid caching proxy server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Squid caching proxy server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify HTTPS/TLS interception certs
grep -E 'ssl_bump|https_port|tls_outgoing' /etc/squid/squid.conf | grep -v '^#'

# Configure HTTPS port with TLS
# In squid.conf:
https_port 3129 cert=/etc/squid/certs/proxy.pem key=/etc/squid/certs/proxy-key.pem
tls_outgoing_options min-version=1.2
tls_outgoing_options options=NO_SSLv3,NO_TLSv1,NO_TLSv1_1

This recommendation verifies that listening port is bound to specific interface on the Squid caching proxy server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Squid caching proxy server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify listening port is non-default or restricted
grep '^http_port' /etc/squid/squid.conf
ss -tlnp | grep squid

# Bind to specific interface and restrict port
# In squid.conf:
http_port 10.0.0.1:3128
# Do NOT use 0.0.0.0:3128

This recommendation verifies that detailed access logging is enabled on the Squid caching proxy server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Squid caching proxy server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check access logging configuration
grep 'access_log\|logformat' /etc/squid/squid.conf | grep -v '^#'

# Enable detailed access logging
# In squid.conf:
logformat combined %>a %[ui %[un [%tl] "%rm %ru HTTP/%rv" %>Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh
access_log daemon:/var/log/squid/access.log combined

This recommendation verifies that log rotation is configured on the Squid caching proxy server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Squid caching proxy server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check log rotation
cat /etc/logrotate.d/squid
ls -la /var/log/squid/

# Configure log rotation
cat > /etc/logrotate.d/squid <<'EOF'
/var/log/squid/*.log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    postrotate
        squid -k rotate
    endscript
}
EOF

This recommendation verifies that cache size limits are configured on the Squid caching proxy server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Squid caching proxy server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify cache size limits
grep -E 'cache_dir|maximum_object_size|cache_mem' /etc/squid/squid.conf | grep -v '^#'

# Configure appropriate cache limits
# In squid.conf:
cache_mem 256 MB
maximum_object_size 50 MB
maximum_object_size_in_memory 1 MB
cache_dir ufs /var/spool/squid 10000 16 256

This recommendation verifies that sensitive headers are stripped on the Squid caching proxy server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Squid caching proxy server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check if sensitive headers are stripped
grep -E 'request_header_access|reply_header_access' /etc/squid/squid.conf | grep -v '^#'

# Strip sensitive headers
# In squid.conf:
request_header_access Via deny all
request_header_access X-Forwarded-For deny all
request_header_access Referer deny all
reply_header_access X-Squid-Error deny all
reply_header_access Server deny all

This recommendation verifies that server version string is suppressed on the Squid caching proxy server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Squid caching proxy server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify server version string is hidden
grep 'httpd_suppress_version_string\|visible_hostname' /etc/squid/squid.conf | grep -v '^#'

# Hide version information
# In squid.conf:
httpd_suppress_version_string on
visible_hostname proxy

This recommendation verifies that connection timeout limits are configured on the Squid caching proxy server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Squid caching proxy server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check connection timeout settings
grep -E 'connect_timeout|request_timeout|persistent_request_timeout' /etc/squid/squid.conf | grep -v '^#'

# Configure connection timeouts
# In squid.conf:
connect_timeout 30 seconds
request_timeout 60 seconds
persistent_request_timeout 30 seconds
client_lifetime 8 hours
pconn_timeout 30 seconds

This recommendation verifies that Squid is running the latest stable version on the Squid caching proxy server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Squid caching proxy server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Squid version
squid -v | head -3
dpkg -l squid 2>/dev/null || rpm -q squid 2>/dev/null

# Update Squid to latest stable
apt-get update && apt-get install --only-upgrade squid
# Or:
yum update squid

This recommendation verifies that URL/domain filtering is configured on the Squid caching proxy server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Squid caching proxy server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify blocked sites/domains list exists
grep 'dstdomain\|url_regex\|urlpath_regex' /etc/squid/squid.conf | grep -v '^#'
ls -la /etc/squid/blocked*

# Configure URL filtering
# Create blocked domains file:
echo '.malware-domain.com' > /etc/squid/blocked_domains.txt
# In squid.conf:
acl blocked_sites dstdomain "/etc/squid/blocked_domains.txt"
http_access deny blocked_sites