RE: How to launch squid

From: Larmour, Jonathan <>
Date: Thu, 9 Oct 1997 15:36:45 +0100

Hash: SHA1

Sent: 09 October 1997 14:58
Subject: Re: How to launch squid

I've been playing with a RunCache-replacement I wrote that puts squid
a chroot-jail in /usr/local/squid and starts squid itself as the
unpriviledged squid user rather than as root; various bits of
system need to get copied to places like /usr/local/squid/etc and
/usr/local/squid/lib and it gets a bit hairy and system-dependent.
not allowed to modify its own binaries or config files in the bin and
subdirectories. IMHO this is the way to go if you might be thinking
about running squid as a firewall proxy.

If you are interested, I have already done this for Linux 2.0.30.
Details available if anyone wants! Also be warned that chrooting in
itself is not sufficient to guarantee security. e.g. if hacked, the
hacker can call mknod() to provide access to any device on the system
- - most relevantly, hard disks. Similarly you can mount() /proc in a
chrooted area, and have access to all memory as well!

Also note that the chroot command as supplied does not change
directory to one inside the chrooted area, so depending where you ran
it, you can still access any file in that directory. The secure
solution is to either ensure you always do a cd after the chroot, or
it is probably safer to change the directory in the kernel after a

I patched my kernel to prevent mounting, unmounting, mknod's,
accessing the cwd after a chroot, and changing IP firewall/forwarding
rules from within a chrooted area. The mods are very simple, and I'll
provide them if anyone wants, but be warned its not strictly correct
Unix (not that anything _should_ mind).

Jonathan L.
Origin, 323 Cambridge Science Park,Cambridge,UK. Tel:+44 (1223)
 ---[ It is impossible to enjoy idling thoroughly unless one has ]---
 ------------[ plenty of work to do - Jerome K. Jerome ]-------------
Fight spam!
Version: PGP for Personal Privacy 5.0
Charset: noconv

Received on Thu Oct 09 1997 - 07:40:02 MDT

This archive was generated by hypermail pre-2.1.9 : Tue Dec 09 2003 - 16:37:16 MST