Re: [squid-users] Squid: reverse proxy security advantages

[Amos Jeffries]

Jeff Peng wrote:
在 2010-02-08一的 22:14 -0300，Alejandro Facultad写道：
Dear all, I have a webmail which must be accesed by users from another 
network.


The content of the webmail is not static obviously, so the content caching 
is not an advantage here. Also the webmail is just one server, not load 
balancing is important here.


So are there any security advantage of using a Squid as a reverse proxy in 
front of my webmail ??? Because I can't see any security benefit...

DDoS reduction? Squid raises your server traffic threshold for DDoS 
attack before it falls over by several order of magnitude.
Then there is the source security controls Jeff points out below.


At some points you can consider Squid as an application firewall, and
setup some rules like:

acl badip src 192.168.0.100
http_access deny badip

acl badsite referer_regex -i qq.com
http_access deny badsite

acl badconn maxconn 20
http_access deny badconn

acl badbrow browser -i Sosospider
http_access deny badbrow


Those may help improve some security,but it depends... 
Squid is just a cache, if you don't need the cache feature, you may not
want to use it.


"just a cache" ha!

It's a general-use HTTP proxy. Doing load balancing, full set of CDN 
features for HTTP-as-service, HTTP flow redirection/reflection, 
bandwidth shaping, caching, HTTP security, and protocol conversion.

I'm sure I've left off a bunch of things too.

But yes, I see the point, Squid might not be _that_ beneficial for a 
single load-critical non-cachable app.

Amos
--
Please be using
  Current Stable Squid 2.7.STABLE7 or 3.0.STABLE23
  Current Beta Squid 3.1.0.16