To my knowledge, it shouldn't matter whether Squid, run as a proxy server, is placed on the LAN side or the DMZ side (or NET side, for that matter). If the box was run as an accelerator / reverse proxy, you'd want to have it sit in the DMZ, presumably to protect the internal network from a Squid-based exploit or box mis-configuration.

Typically people don't run Squid as a proxy and accelerator at the same time, though I think it's possible.

Security being relative, I can recall only one security concern I've had with Squid in the two years I've worked with it. That's fewer incidents than what OpenSSH has had (not that I'm bashing OpenSSH, mind you, just comparing the two in terms of recently discovered holes).

And Happy Holidays to you too!  : )
(10 hours to LotR...)

Ryan




Craig Caughlin wrote:


Hi folks,
I see in Tom's documentation for Shorewall that he runs Squid
transparently on a box in his DMZ rather than on his LAN, and I'm just
curious why?

Thank you, Happy Holidays!
Craig





------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click ------------------------------------------------------------------------ leaf-user mailing list: [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html

Reply via email to