Detections
Analytics

2.1.17 Ensure web proxy server services are not in use

Information

squid - OR - squid-openssl is a standard proxy server used in many distributions and environments.

Unless a system is specifically set up to act as a proxy server, it is recommended that the squid package be removed to reduce the potential attack surface.

Note: Several HTTP proxy servers exist. These should be checked and removed unless required.

Solution

Run the following commands to stop squid.service and remove the squid and squid-openssl packages:

# systemctl stop squid.service
# apt purge squid squid-openssl

- OR - If the squid package is required as a dependency:

Run the following commands to stop and mask the squid.service :

# systemctl stop squid.service
# systemctl mask squid.service

Impact:

There may be packages that are dependent on the squid - OR - squid-openssl package. If the squid - OR - squid-openssl package is removed, these dependent packages will be removed as well. Before removing the squid package, review any dependent packages to determine if they are required on the system.

- IF - a dependent package is required: stop and mask the squid.service leaving the squid - OR - squid-openssl package installed.

See Also

https://workbench.cisecurity.org/benchmarks/21369

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: e657af646fc84a91c9193386d7d99c67d569a42443f1eaa401102e7b24f26d02