Subject: squid, http-gw and squid-gw

From: "Luis Fernando Barrera" <[email-masked]>
Date: Fri, 29 Sep 2000 00:26:24 -0600

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi all,

I recently asked whether squid versus http-gw versus squid-gw.... Somebody
"gracefully" sent me to the list archive... So I did it...

However some questions still bother me, maybe the guys who already
passed for this info nightmare can give me a hand...

1) http-gw is the same as squid-gw?
	
	I read that they are almost the same with a little advantage of
	squid-gw above http-gw?

2) It is not recommended to put squid in the firewall box, right?
	I saw several messages that squid alone and squid-gw (http-gw)
            are the same in terms of security...

3) You can put the squid software in an internal host and then all the http
    requests from the internal users, go "relayed" to the squid-gw?

4) If you want to put a public web server, it is not a good idea to put it 
   behind the firewall, even with the "accelerated options" of squid
   or another trick from squid-gw, right? 

5) You can put the web server in a third network segment, using a 3 nic in the
   firewall, and configure the squid-gw to ONLY permite http traffic from
   the web server to the internet and viceversa? 
	
How am I doing?  My head is a little mixed up, maybe some definitions
of the products and their intentions could help... Anybody know
these definitions?

Thanks a lot in advance

Luis Fernando Barrera
[email-masked]

---

From: [email-masked]
Date: Fri, 29 Sep 2000 14:32:48 +0400

-----BEGIN PGP SIGNED MESSAGE-----

nuqneH,

> 	I read that they are almost the same with a little advantage of

Wrong. squid-gw is much more paranoid ;)
See the README file, it will explain much to you.
 
>             are the same in terms of security...

Wrong again. Squid is not designed as security-oriented tool.
 
>     requests from the internal users, go "relayed" to the squid-gw?

You will get problems with distinguishing users one from another and
statistics gathering.
 
>    or another trick from squid-gw, right? 

Yep.
 
>    the web server to the internet and viceversa? 

squid-gw is designed to secure the client, not the server. Use http-in for it.
 	
> of the products and their intentions could help... Anybody know

Hope this helps..

P.S. about ssh-gw, i am working on a new version now but it will take some
time.. 

                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 29 Sep 2000 13:40:44 -0400

On Fri, Sep 29, 2000 at 12:26:24AM -0600, Luis Fernando Barrera wrote:
...
> 	I read that they are almost the same with a little advantage of

This was doubtless someone's opinion.  They provide different services,
though.  Each does its thing well.

The rest looks pretty OK.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.