Securing and Optimizing Linux: RedHat Edition -A Hands on Guide
Prev Chapter 28. Software -Server/Proxy Network Next

28.9. Configure the /etc/logrotate.d/squid file

Configure your /etc/logrotate.d/squid file to rotate your log files automatically each week. Create the squid file, touch /etc/logrotate.d/squid and add:


               /var/log/squid/access.log {
               weekly
               rotate 5
               copytruncate
               compress
               notifempty
               missingok
               }
               /var/log/squid/cache.log {
               weekly
               rotate 5
               copytruncate
               compress
               notifempty
               missingok
               }

               /var/log/squid/store.log {
               weekly
               rotate 5
               copytruncate
               compress
               notifempty
               missingok
               # This script asks squid to rotate its logs on its own.
               # Restarting squid is a long process and it is not worth
               # doing it just to rotate logs
               postrotate
               /usr/sbin/squid -k rotate
               endscript
               }

28.9.1. Securing and Immunize Squid

By having more control on mounting the cache directory of Squid, if you have created the cache directory of Squid in a separate partition of your Linux system i.e. /cache, like we have done during the install setup, then you can use the noexec, nodev, and nosuid features to improve and consolidate the cache security. These features can be set up in the /etc/fstab file to tell the system to not allow execution of any binaries; noexec to not interpret character or block special devices; nodev and to not allow set-user-identifier or set-group-identifier bits to take effect, nosuid on the mounted file system /cache in our example. Applying this procedure on the partition where the Squid Cache resides will help to eliminate the possibility of DEV, SUID/SGID, and execution of any binaries.

As an example, assuming /dev/sda8 is the partition in the system where the /cache directory of Squid lives, you must edit the fstab file, vi /etc/fstab and change the line related to /dev/sda8:


                   /dev/sda8                      /cache          ext2            defaults        1 2
To read: 

                   /dev/sda8                      /cache          ext2            noexec,nodev,nosuid 1 2
Dont you forget to reboot your system for the changes to take effect.

You should immunize important configuration file like squid.conf. As we already know, the immutable bit can be used to prevent deletion, overwriting, or creation of a symbolic link to a file. Once your squid.conf file has been configured, it's a good idea to immunize it with the following command:


                 [root@deep /]# chattr +i /etc/squid/squid.conf

Prev Home Next
Configure the /etc/rc.d/init.d/squid script file -/all configurations Up Optimizing Squid