Subject: RE: squid, http-gw and squid-gw

From: "Luis Fernando Barrera" <[email-masked]>
Date: Fri, 29 Sep 2000 12:48:26 -0600

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Thanks you all for trying to desmitify squid, http-gw and squid-gw...

You're right about the several ways to put the squid and http-gw and squid-gw
together. My problem was that in the list there were too many
comments and it is hard to get something clear from them.

Maybe you guys can clarify more some points...

The *first* part of my questions is concerning the security of the firewall
and the internal network...
The *second* part is concerning the security of some web server and the
security of the internal network...

> Squid:  Squid is a fabulous cache with lots of tuning and security
> for destination, source, method, and lots of other options.  Squid
> was not designed from scratch for security, but it has been tested
> and debugged extensively so that it is probably very secure by now.

My question is if I put the squid software in my firewall, would it be
secure enough to avoid the hackers exploit the squid itself and take
over the firewall? 

Right now I'm using squid on the firewall for performance reasons,
as you did say.

>  Serial mode is probably the "most" secure,
> since it adds extra layers of security.  The idea is that you utilize
> the strenghts of both pieces of software.  I don't use serial mode
> because it's overkill and slows down requests.  

Serial mode means something like this...?

Internal Client (browser) ---> squid box ---> FW w/ SQUID-GW ----> router w/packet filter ----> Internet

I just read that squid-gw cannot do the thing described above.... With squid-gw you
have to do something like this...?

Internal Client (browser) ----->  FW w/ SQUID-GW ---> squid box ----> router w/packet filter ---> Internet

Am I right?
 If so, then this is the where http-gw comes to the game...?

Internal Client (browser) -----> squid box ----> FW w/HTTP-GW  ---> router w/packet filter ----> Internet

Right?

Someone said that if you put squid *behind* the firewall and then you try to
relay the internal client requests to the http-gw or squid-gw, you'd find trouble... 

>If you have the
> hardware and are very security conscious, I recommend that you run
> squid in accelerated mode behind the http-gw.  

I understand that using squid in accelerated mode, means to put a web server which contains
public information (i.e. a web server used by a company to show itself in the Internet) behind
the firewall, AND squid is supposed to hide all services of the web server from the Internet,
except the port designated for the service (usually 80)???

*second part*

Which method do you recommend to put  the company web server ?

1) The easiest is to put it the the public network... Totally exposed (bad idea)
2) To put it behind the firewall, using squid in accelerated mode... Some people
    says that if the web server is compromised, so you whole internal network would be... How
    true it is?
3) Put the web server behind the firewall in a separated segment from the internal network,
    using squid again...
4) Using http-in to forward the incoming requests from the internet to the internal webserver ?????
5) Using squid-gw to forward the incoming requests from the internet to the internal webserver???

In the readme of http-in says its function is to forward the internet request to an internal
web server, but cannot protect from data driver attacks.... The most attacks in these days are
of this kind... SO what's the diference of using squid in accelerated mode than http-in

Thanks again,

Luis Fernando Barrera
[email-masked]

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 29 Sep 2000 17:41:27 -0400

On Fri, Sep 29, 2000 at 12:48:26PM -0600, Luis Fernando Barrera wrote:
...
> secure enough to avoid the hackers exploit the squid itself and take

Maybe.  Probably not.  Do you really like playing Russian roulette with
your network?

> Right now I'm using squid on the firewall for performance reasons,

Best performance == worst security.  In general.  Although I can't
think of any exceptions.  I try for fairly high security and acceptable
performance.  Because if security is blown, you may get NO performance.

...
> relay the internal client requests to the http-gw or squid-gw, you'd find trouble... 

One of them will know which ones it has spoken to before.  One will
not.  You choose.

>     says that if the web server is compromised, so you whole internal network would be... How

Entirely and completely true.

> 4) Using http-in to forward the incoming requests from the internet to the internal webserver ?????

These last two are not incompatible.  Probably best to do both.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.