Re: [squid-users] Detecting and blocking child proxy servers

Juraj Sakala wrote:
> On Wednesday 25 July 2007 14:42, Tek Bahadur Limbu wrote:
>> Juraj Sakala wrote:
>>> On Tuesday 24 July 2007 12:56, Tek Bahadur Limbu wrote:
>>>> Is this possible? In other words, I want my proxy servers to detect
>>>> squid or other proxy severs which are being used or operated by others
>>>> besides me.
>>> May it is bepossible:
>>> - if you know your network you can use header x_forwarded_for to detect
>>> unknown networks.
>>> - if you wont to allow only your proxy servers use http_access directive
>>> with acl which contains only your proxy's
>>> - try something like this:
>>> acl myproxy req_header Via MyProxy
>>> http_access allow myproxy
>>> http_access deny all
>>> - use authentication
>> Hi Juraj,
>>
>> Thanks for sharing your tips.
>>
>> Suppose I have the following:
>>
>> acl myproxy req_header Via 192.168.100.0/24
>> http_access allow myproxy
>> http_access deny all
>
> It was only tip. I am not sure, but i think squid puts in this header his
> visible hostname and port in format 1.1 <vysible_hostname>:<port>. So if
> someone use Squid in default configuration you can block it easily. But it
> is true, that headers are easily spoofable
>
>> Now if I use this, my normal clients (192.168.101.0/24) won't be able to
>> access my proxy server right?
>
> There is question if normal client sends Via header in request, I am sure that
> not.
>
> So we need acl that permits requists from our proxy's with correct Via header
> or clients with no header and denies all other requests.
>
> It will be hard, maybe external acl will be useful.
>
>
>

Hi Juraj,

Thanks once again for sharing light on this. Do you have any examples
where I can use req_header to detect if my clients have their own proxy
servers?

Any clue, web links or posts will highly be appreciated.

Also is req_header the only option whereby we can detect child proxies?
Or do we also have other options for detecting child proxies?

I googled and found the Follow X-Forwarded-For headers (follow_xff) tag.
Do you have any ideas regarding this?

Thanking you...

-- 
With best regards and good wishes,
Yours sincerely,
Tek Bahadur Limbu
(TAG/TDG Group)
Jwl Systems Department
Worldlink Communications Pvt. Ltd.
Jawalakhel, Nepal
http://www.wlink.com.np