Proxy Servers

Building and Deploying

System Improvement and Protection

Elvin Smith & Jose Robles

IT 4444 Capstone Spring 2013

Outline
Topic: Proxy Server
1. Introduction

a. Technical definition of a proxy server

b. Reason for research paper
i. Build and configure a proxy server at low cost
ii. Improve network performance
iii. Improve network security
iv. Create web filtering for the work place
v. Traffic monitoring

2. Body

a. Background
i. Introducing squid
ii. History of squid
iii. Software and hardware requirements
iv. Installation
b. Configuration
i. Configure as a web filter
ii. Configure authentication and access
iii. Configure as a caching server
iv. Configure to monitor traffic
v. Configure transparent mode
c. Results
i. Test access to websites
ii. Monitor Traffic
3. Conclusion
a. Summary

network administrators secure those

Abstract
Proxy servers act as intermediaries
between computing devices, to provide
security and to shield the hosts on an
internal network. It is important that
we

understand

the

purposes

and

processes of this technology, in order

to

help

protect

our

information,

networks but may not provide the level

they want.

With the addition of a

secure Proxy Server, they can add an

additional level of security, improve
network performance and monitor web
activity that is being accessed over
their network.

systems and networks. This research

As we attempt to increase our security

will provide us with the ability to

of the network by adding a proxy

build, configure and deploy a Squid

server, we must understand that Proxy

proxy server. This paper will describe

servers are basically separated into two

Squid

discuss

types, Transparent and Anonymous

configuration and discuss results of

Proxies. Transparent Proxies forward

authentication, performance and Web

user requests to a destination without

access testing.

hiding or concealing any information.

proxy

servers,

This type of proxy server is usually

Introduction

used on internal networks, where the

The uses of internet connectivity
by

Universities,

and

warranted because the computers on

Organization networks, have grown

that network are safe from external

exponentially in the last twenty years.

threats.

With

other hand, allow users to surf the web

that

comes

Businesses

need to obscure the IP address in not

connectivity

the

potential

explosion,
vulnerability

while

Anonymous Proxies, on the

keeping

their

IP

address

exploitation by attackers, malicious

anonymous

or

code and other threats being directed

universities,

large

toward those networks. The ability to

organizations today use these proxies

secure the network and control access

to act as a middle point between a user

from workstations has become a

and the destination address.

difficult

network

middle point or Proxy makes a

The use of Access

request on behalf of a user on the

Controls, Intrusion Detection Systems,

network and obscures their IP address

Firewalls

from that destination site.

task

administrators.

and

for

Scanners,

all

help

hidden.
businesses

Most
and

This

These

proxies also improve the performance

accessed the internet. (2)

of the network by using a caching

internet usage and complexity resulted

system to save network users recent

in an increase in security incidents. In

request responses from the web to its

1995 2540 incidents were reported.

local hard drive. By caching this web

Just five years later 3234 incidents

data, it eliminates the need for other

were reported.

users on the network to download that

incidents reported climbed to 82,064

same information from the Web again,

reports. (3)

providing faster access to those sites,

servers used was a windows service

images and files and saving network

named Wingate. Wingate was used to

bandwidth. This anonymous type of

share internet dial up connection

Proxy server will be used in the

among multiple devices. The program

purposes

we

came with a security hole and people

concentrate our efforts toward the

quickly learned how to connect to

building of a Squid Server.

Wingate externally.

of

this

paper,

as

Increase

From 2000 to 2003

One of the first proxy

External users

could then piggy back of Wingate and

Efforts in building a secure server at a
low cost, configuring that server to
increase network performance while
aiding in network security from outside
threats and monitoring traffic on the
network

are key for

a network

administrators success. We will use

this research paper to enhance our
knowledge and ability to accomplish
this in our future endeavors as IT
professionals.
Previous Work

telnet to other devices obscuring their

source information. (4) Modern Day
network administrators have to be
extra careful when configuring proxy
servers. New trends and increase in
proxy server abuse are greater now
than ever before. (4) Understanding
the

different

methods

will

help

correctly configure our squid proxy

server.

Two methods that will be

explored are the transparent method

and the traditional method.

The

traditional method will capture traffic

Over the last 15 years internet usage in

by configuring the web proxy settings

the United States alone has increased.

of network devices to point traffic to

In 1995 one out of ten adults accessed

the proxy server. (5) The transparent

the internet. More than a decade later

method will place the proxy server in

78% of adults and 98% of teenagers

line with the gateway.

The only

physical path to the gateway will be

Netapps Netcache. The other path

through

resulted in the project creating Squid.

the

proxy

server.

In

transparent mode, users will not see

Initially the funding was provided by a

that the proxy server is being used. (5)

grant. The grant was part of a project

Companies with heavy usage networks

called IRCache which in turn created

turn to caching to cater the needs of the

processes for the squid caching softare.

user. (7) There are many factors on

Eventually funding for IRCache would

effectiveness of using a caching server.

run out. Squid would be eventually

Incorrect configuring of a proxy server

developed by donations and

can lead to more bandwidth usage as

volunteers. To this day Squid is an

opposed to bandwidth conservation.

open source software ran by donations

(6)

and volunteers with some investments.

Correctly configuring the squid

proxy

server

for

security

and

[8]

performance will be a major focus in

this paper.
Background

Software and Hardware Requirements

The platform chosen for the
installation of Squid is CentOS Linux

Introducing Squid

operating system. There are many

advantages fo a company to use

Squid is a software that provides the

ability to implement access controls,
traffic optimization, authorization, and
logging. Squid provides full features
for the http/1.0 proxy. [8]
History

CentOS. To understand the

advantages of CentOS we will
introduce Red Hat Linux. Red Hat
Linux has built a reputation for being
dependable, supported, and resourceful
operating system in a serve
environgment. [15] The advantage of

The history of squid can be traced back

using CentOS over Red Hat Linux is

to the early 1990s. It is a branch off

the lower cost. Red hHat Linux must

of a caching project with the name of

be purchased with warranties and

Harvest project. During the

technical support. CentOS can be

completion of Harvest the project

obtained freely with no cost, making it

broke off into two different paths. One

the cheaper alternative to Red Hat

path become a project known as

Linux. CentOS is one hundred percent

compatible with Red Hat Linux. [15]

mounted server with an Asus PMR15

Both Red Hat Linux and CentOS are

mother board. The server has three

open source software. The consumer

1Gig Ethernet ports. Two sticks of

is free to manipulate code to suit their

ddr2 ram at two Gigbytes per stick. A

needs. For the purpose of this paper

64 bit processor with a 500 Gigabyte

CentOS 6 will be used over Red Hat

hard drive.

Linux to keep costs to a minimal. The

disadvantage of using CentOS 6 over
Red Hat Linux is the loss of technical
support and warranties. Although
CentOS lacks tech support, solutions to
problems with the operating system
can be researched through the CentOS
community. CentOS community
provides forums for users to share their
solutions and problems with the
internet community. As long as the
server is not responsible for critical
tasks that require minimal downtime
CentOS can be used as a cheap
alternative to Red Hat. [15] The
CentOS operating system will be
installed on a clean desk environment.
To install the operating system users
must download CentOS from the
CentOS website
http://www.centos.org. Instructions on
installing and updating can also be
found on the support section of the
website. Recommended requirements
for hardware include 10 MB of RAM
per GB of the total of all cache_dirs
plus an additional 20 MB. [17] The
hardware used in this research is a rack

Installation
The version of Squid that will be
installed is version 3.3.1. When
downloading squid the user will find
that there are multiple methods to
choose from. The easiest method for
CentOS is to use the command yum
install squid. CentOS will
automatically download and install the
necessary packages for running Squid.
Another method can be achieved by
browsing the Squid website and
downloading preconfigured binaries.
For this paper we will use the method
of downloading the source code and
compiling it. Downloading the source
code and compiling it gives the user
more control of configuration and
location of the directories. The source
packages can be found at the Squid
website. In this case the latest stable
version was downloaded (Version 3.3).
The source code will be a compressed
file available in a tar.gz format. After
downloading the source code the
compressed file has to be extracted into

a directory. In this case the

--enable-cache-digests

compressed file was extracted to the

--with-large-files

directory named squid-3.3.1. After the

Fig.1

directory is created the ./configure

command is executed to configure the

Configuration

source code and choose the directory.

Within the configure command,

Configure as a web filter

features can be enabled or disabled

depending on what features the user

To be able to configure services on a

needs. Features enabled during

squid server a user must locate and edit

configuration and what value they are

the file named squid.con. This

set to can be found in figure 1.

configuration file will contain most of

Completion of the configure command

the configuration options available in

will create files that are executable.

sqid. The location of the squid.conf

These file are called make files in the

for the server used in this paper can be

linux world. Final step of installation

found by changing to the directory in

can be made by executing the

this path

command make install. This will

/usr/local/squid/etc/squid.conf.

complete the installation of Squid.

Locations of files and directories will

After installation, the squid

be different depending on initial

command is executed to start the

configurations during installation. A

services provided by squid.

snippet of the configuration file can be

found in fig.3. Filtering can be

--prefix

/local/usr/squid

accomplished by configuring access

--with-logdir

/var/log/squid

control lists. The configuration of

--with-pidfile

/var/run/squid/pid

access control lists are configured be

--enable-store

Ufs,aufs

editing the squid.conf file. The syntax

--enable-removal-

Lru,heap

of the access control list start with the

policies

name of the access control list or (acl).

--enable-icmp

Followed by a directive that will

--enable-useragent-log

control the action of the will happen

--enable-referer-log

once a match is made with the (acl).

For an example, to block yahoo you
will create an acl named block_yahoo.

This acl can be anything the user

access. Squid can also deny access to

wishes to name it. The following line

a specific mac address. This can be

will be entered into the squid.conf file:

done by adding the line acl bad_mac

acl bad_yahoo destdomain

arp (mac address goes here). More

.yahoo.com. This acl will match up

options using acl can be found in

any request that has yahoo.com in the

chapter 2 of Squid Proxy Server 3.1.

domain. After naming the acl we have

[12]

to define what we want to do with the

request. The directive http_access
deny will deny http accesss to the acl.
We can deny a user connected to the

# Recommended minimum
configuration:
#

proxy by adding the line http_access

deny bad_yahoo. Squid will now
match requests containing yahoo.com
and deny access to this request. It is

# Example rule allowing access from

important to add http_deny all to the

your local networks.

bottom of the directives in the file.

Squid will work from top to bottom

# Adapt to list your (internal) IP

networks from where browsing

matching acls and deny access to

anyone else. For this example we add

# should be allowed

the lines to allow access to squid from

clients on the 192.168.0.0/24 network.

acl localnet src 10.0.0.0/8

The following lines were added to the

RFC1918 possible internal network

squid.conf file: acl safe_network src

192.168.0.0/24 http_access allow

cl localnet src 172.16.0.0/12 #

RFC1918 possible internal network

safe_network. This will allow any

machine with the source ip address in

acl localnet src 192.168.0.0/16

the 192.168.0.0/24 network http

access. Multiple websites can be

acl localnet src fc00::/7

denied In one acl by using the

4193 local private network range

following syntax: acl all_bad_sites

dstdomain .youtube.com .google.com
.ytimg.com .yahoo.com .woopra.com.
Then add the line bad_sites http_deny

acl localnet src fe80::/10

# RFC

# RFC

4291 link-local (directly plugged)

[12] Basic authentication on squid is

machines

the easiest to configure and used the

acl notworkreg dstdomain

most simple encryption. It is also the

www.youtube.com .googlevideo.com
.ytimg.com .yahoo.com .cnn.com
.theblaze.com .facebook.com
.nbcnews.com .abcnews.go.com
.twitter.com .foxnews.com

most insecure of the squid

authentication methods. Basic
configuration transmits in a Base64code string format. This format is
easily decoded by an observer using a

.newsok.com .kswo.com .abc.go.com

.aol.com .tds.net .woopra.com
acl my_machine src 192.168.0.254

sniffer on the network. For the private

environment in this test lab, basic
authentication can be used without
concern of intrusion. Authentication
can be implemented by using the

acl SSL_ports port 443

auth_param directive in the squid

acl Safe_ports port 80

# http

acl Safe_ports port 21

# ftp

configuration file. The auth_param

directive comes with many options,
one option is the auth_param basic

acl Safe_ports port 443

# https

program option. This option will

specify what directory to send

acl Safe_ports port 70

# gopher

authentication requests to check

credentials. The directory in this Squid

acl Saf

configuration can be found in

Fig. 3

/usr/local/squid/libexec/. An acl also

has to be created to configure

Configure authentication and access

Basic authentication

authentication. Figure 4 will give an

example of basic authentication code
in the squid configuration file.

There are many options for configuring

authentication and access for the squid
server. For this paper basic
configuration will be discussed. For
the complete list of options refer to
chapter 7 in Squid Proxy Server 3.1.

auth_param basic program

/usr/local/squid/libexec/basic_pam_aut
h
acl authenticated proxy_auth

The error log file logs errors in the squid

REQUIRED

server. To monitor traffic check both of

http_access allow authenticated
http_access deny all

these files for information. The access log

is in a format that is hard to read by
humans.

Fig. 4

A Pearl script can be used to

decipher the logs.

Adding the tail f

command to the beginning of the script

Configure as a caching server
Creating cache directories
When configuring squid for a caching

will let a user see the access attempts in

real time without having to refresh.
Cache manager

server the cache directives can be used.

Squid also has a gui interface that can be

To create a directory for caching web

accessed by a web server. In this example

documents, the rule in cache_dir aufs

Apache is installed on the centos machine.

/squid_cache/ 51200 32 512 is placed in

A pearl script is added to the Apache

the squid.conf file. This directive creates a

configuration file that will point clients to

directory named squid_cache with 50 GB

the cgi file in the Squid directory. The cgi

of free space. Squid organizes files into

file in squid is named cachemgr.cgi and is

hierarchical levels.

an executable file. The location of the file

The previous rule

created the first level with 32 directories,

in

and the second level with 512 directories.

squid/libexec/.

This is the minimal configuration for the

manager allows you to monitor a wealth of

server to start caching objects. There are

useful information.

many more options for the cache directive

information on the cache manager are

that can be found in chapter 2 of Squid 3.1.

general runtime information, IP cache stats

[12]

and contents, http header statistics, traffic

Monitoring traffic

the

directory

is

Accessing

/usr/local/
the

cache

Some examples of

resource counters, and request forwarding

statistics. These are just a few statistics

Access and error log

that can be monitored by the network. A

complete list of options with the Squid

Squid has two very useful log files. One

cache manager can be found on chapter 6

log is the access log, this log file will log

of Squid Proxy Server 3.1. [12]

all connections to the squid proxy server.

Transparent mode

For the first test my PC will be pointed to

Intercept

the Squid server by configuring my

To configure Squid in transparent mode
we have to use a router to forward the
traffic to the server. In the router
forwarding rules, all traffic using port 80
needs to be directed to the IP address of
the Squid server. The router also has to
redirect traffic to the port Squid server is
listening to.

In this case traffic is

redirected to 192.168.0.181 and port 3128.

On the Squid server machine IP tables is

browser to use proxy setting with IP

address 192.168.0.181. To test the access
control list I pointed the address to
www.google.com:897 to verify the squid
access denied page. I also accessed the url
www.yahoo.com, and confirmed the same
result.

The additional four pcs were

pointed to the squid server and access

denied pages were verified for the domains
that were inserted in the squid.conf file.

used to handle incoming traffic to the

Squid server. In the squid.conf file we

Testing monitoring

need to add the directive http_port 3128

intercept. Configure these three steps and
clients will not be able to see evidence of a
proxy server being used.

To test the monitoring the following

command

was

executed:

tail

/var/log/squid/access.log | ccze CA.

This will convert the time stamps to a

Results

readable format and also log the access

attempts in real time. Monitoring the log

Test Lab
The test environment includes a lan on the
192.168.0./24 network. The Squid server
shares the network with five PCs with
windows 7 installed. There will be five
machines including my PC that will be
connecting to the squid proxy server.
Refer to figure 5 for the diagram of the
network topology.
Testing web Filtering

allowed me to observe repeated connection

from www.woopra.com. A google search
showed this website to be a tracking
software recording what website clients
were visiting on the network. The site was
blocked using Squids access control lists.

parent server is placed in line with the

network gateway. Child servers can be set
behind this parent server. Child servers
can also be parents of other child servers.
Specific content can be handled by a child
server to optimize performance on the
network.
Reverse Proxy Mode
Squid also provides a function to cache
Fig 5.

static data for websites.

The Squid

configuration is called accelerator mode or

Future Works

reverse proxy mode. It will do the busy

work of providing static data to clients

Authentication

reducing the client requests to the server.

Squid

Proxy

of

When dealing with large amounts of

Some of the function

clients on the internet, this reduction can

provided by Squid Proxy Server is out of

increase the performance of the web

the scope of this paper. For example when

servers.

functionality.

Server

has

lot

implementing authentication there are

several methods for encrypting user name
and passwords sent by the client. There

Conclusion
Summary

are different methods for storing the user

name and passwords. Squid can use data

Squid Proxy Server provides protection on

base software such as MySql for storing

two fronts.

usernames and passwords. Radius servers

accessing harmful data, and protects the

can also be implemented to handle

network from incoming intrusion using

authentication requests.

access control lists.

It protects the client from

Performance is

increased by using cache directories and

Peer Caching

fronting data to the clients. Performance

Squid has the ability to coordinate between

and security can be monitored by access

other proxy servers. Multiple server can

logs and Squids graphical interface cache

be set up in a hierarchical pattern. The

manager.

Bibliography
[1] Lambert, P. (December, 2012 05). The basics of using a proxy server for privacy and security.
Retrieved from http://www.techrepublic.com/blog/security/the-basics-of-using-a-proxy-server-forprivacy-and-security/8762
[2] Smith, A., & Zichuhr, K. (2012, April 13). Internet adoption over time. Retrieved from
http://pewinternet.org/Reports/2012/Digital-differences/Main-Report/Internet-adoption-overtime.aspx
[3] Dixit, S., & Kumar Jha, P. (2008, April 01). Network security: It is a process, not a product.
Retrieved from http://www.scribd.com/doc/20364810/Network-Security-Research-Paper
[4] Exposing the underground: Adventures of an open proxy server. (n.d.). Retrieved from
http://www.secureworks.com/resources/articles/other_articles/proxies/
[5] DOI: Guide to Web Filtering Deployments Why Pass-By Filtering is Pass
[6] Felmann, A., Caceres, R., Douglis, F., Glass, G., & Rabinovich, M. (1999). Performance of web
proxy caching in heterogeneous bandwidth environments. Retrieved from
http://www.kiskeya.net/ramon/work/pubs/infocom99.proxy.pdf
[7] Mao, Z., & Herley, C. (2011). A robust link-translating proxy server mirroring the whole web. ACM SIGAPP
Applied Computing Review, 11(2), 30-42.
[8] Squid. (10, 12 20). Retrieved from http://www.squid-cache.org/Intro/
[9] Grance, T., Stevens, M., & Myers, M. (2003, October). Special Publication 800-36: Guide to
Selecting Information Technology Security Products. Retrieved from National Institute of
Standards and Technology: Publications: http://csrc.nist.gov/publications/PubsFL.html
[10] Radack, S. (2009, October). PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED
GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES. Retrieved from National Institute
of Standards and Technology: Publications, ITL Security Buletins:
http://csrc.nist.gov/publications/index.html.
[11]Roberts, H., Zuckerman, E., Faris, R., & Palfrey, J. (2010, October 14). 2010 Circumvention Tool
Usage Report. Retrieved from Berkman Center for Internet & Society at Harvard University:
http://cyber.law.harvard.edu/publications
[12] Saini, K. (2011). Squid Proxy Server 3.1: Beginner's Guide. Birmingham - Mumbai: PACKT
Publishing.
[13] Scarfone, K., & Hoffman, P. (2009, September). Special Publication 800-41 r1: Guidelines on
Firewalls and Firewall Policy. Retrieved from National Institute of Standards and Technology:
Publications: http://csrc.nist.gov/publications/PubsFL.html
[14] Scarfone, K., & Mell, P. (2012, July). Special Publication 800-94 r1(Draft): Guide to Intrusion
Detection and Prevention Systems(IDPS)(Draft). Retrieved from National Institute of
Standards and Technology: Publications: http://csrc.nist.gov/publications/index.html

[15] Smyth, N. (2012). CentOS 6 Essentials. Retrieved from Techotopia: http://www.techotopia.com

[16] Tracy, M., Jansen, W., Scarfone, K., & Winograd, T. (2007, September). Special Publication 80044 ver2: Guidelines on Securing Public Web Servers. Retrieved from National Institute of
Standards and Technology: Publications: http://csrc.nist.gov/publications/index.html
[17] (n.d.). Retrieved from http://wiki.squid-cache.org/SquidFaq/SquidMemory

Plan of Work

Dates
Jan 09 -11
Jan 12-24
Jan 25
Jan 26-feb 1

Week
1
2
3
4

Feb 02-08
Feb 09-15
Feb 16-22
Feb 23-march 1
March 2-08
March 25-29
March 30-april
5
Apr6-12

5
6
7
8
9
10
11

Work Done
Integration of teams.
Write abstract, bibliography, and outline.
Present abstract, bibliography, and outline.
Write introduction, submit outline, bibliography, abstract, and plan of
work.
Present introduction and Plan of Work.
Submit introduction.
Work on research installing linux CentOS and Squid.
Work on research to configure squid as a caching server.
Work on research to configure squid to filter web content.
Work on research to configure squid to monitor traffic.
Run tests on network performance, filtering, and monitoring.

12

Finish conclusion, finalize research paper and present research.