Pingree On Security

Optimized Squid 3.1 Proxy Configuration Settings

Lawrence Pingree — Mon, 20 Feb 2012 18:05:52 +0000

I’ve spent 3 months perfecting the cache capabilities of my squid cache proxy and come up with the following…although I occasionally still have some problems with http11 support this configuration has performed optimally for me. I have a 75 gig hard drive and a 2.66 celeron processor operating on opensuse 12.2.

#
# Recommended minimum configuration:
#
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method GET POST HEAD CONNECT PUT DELETE

#
# Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access allow manager

# Deny requests to certain unsafe ports
http_access allow !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access allow CONNECT !SSL_ports

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on “localhost” is a local user
#http_access deny to_localhost

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost

# allow localhost always proxy functionality
http_access allow localhost

# And finally deny all other access to this proxy
http_access allow all

# Squid normally listens to port 3128
http_port 8080 transparent

# We recommend you to use at least the following line.
hierarchy_stoplist cgi-bin ?

# Uncomment and adjust the following to add a disk cache directory.
cache_dir ufs /var/cache/squid 12288 36 256

# Leave coredumps in the first cache dir
coredump_dir /var/cache/squid

# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i \.(deb|rpm|exe|zip|tar|tgz|ram|rar|bin|ppt|doc|docx|tiff|pdf|uxx|gz|xls|swf|psd|js|js?|crl)$ 3440 90% 5760
refresh_pattern -i \.(gif|png|jpg|jpeg|ico|bmp|tiff|png?|gif?|jpg?)$ 2440 90% 5760
refresh_pattern -i \.(html|htm|html?|htm?)$ 1440 90% 5760
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
ignore_expect_100 on
log_icp_queries off
check_hostnames off
#minimum_object_size 1 KB
buffered_logs on
pipeline_prefetch on
cache_effective_user squid
cache_effective_group squid
dns_v4_fallback on
read_ahead_gap 512 KB
cache_replacement_policy heap GDSF
memory_replacement_policy heap GDSF
header_replace User-Agent Mozilla/5.0 (X11; U;) Gecko/20080221 Firefox/2.0.0.9
maximum_object_size 256 MB
visible_hostname shadow
unique_hostname shadow
client_db off

Tags: application, applications, com, end, internal, just, run, service, src, use

Don’t miss the Gartner Security and Risk Management Summit 2012!

Lawrence Pingree — Tue, 14 Feb 2012 19:00:37 +0000

A Must-Attend for 2012

11 – 14 June 2012 | National Harbor, MD (Washington, D.C. area)

The Gartner Security & Risk Management Summit is the most comprehensive and definitive information download for CISOs as well as security, risk management and business continuity professionals.

It brings together all the issues related to infrastructure protection, governance, risk management, compliance, business continuity, disaster preparedness, and response and recovery.

Why You Should Attend –>

Tags: business, com, compliance, end, infrastructure, infrastructure protection, management, National, Protection, response, risk, Security

Save the Environment

Lawrence Pingree — Sun, 12 Feb 2012 20:39:17 +0000

For those interested in saving the environment, they can buy my emanagement skills ebook on Kindle, Apple or Android eBook Stores.

Tags: management

My latest Gartner Research:How to Control File Synchronization Services and Prevent Corporate Data Leakage

Lawrence Pingree — Wed, 01 Feb 2012 18:34:41 +0000

A growing number of enterprise decision makers are concerned that ubiquitous file sharing onto personal devices via the cloud needs to be controlled. We discuss the risks, offer recommendations, and look at the growing set of technical solutions offering mitigation, while maintaining productivity. Gartner customers can read this research by clicking here.

· How to Control File Synchronization Services and Prevent Corporate Data Leakage

Tags: cloud, com, data, device, end, product, risk, service

My Latest Gartner Research:Best Practices for Mitigating Advanced Persistent Threats

Lawrence Pingree — Thu, 19 Jan 2012 20:39:13 +0000

This note provides information security practitioners with tactical and strategic best practices to mitigate the latest threats by leveraging existing and emerging security technologies. Gartner customers can access this research by clicking here.

Tags: practice, Security, threats

Gartner Webinar:Can Chip-Level Security Lower the Risks of Cloud Computing?

Lawrence Pingree — Mon, 16 Jan 2012 23:57:14 +0000

Mobility and cloud computing are introducing exciting new directions for consumer and business technology and services. While this can significantly increases the utility and appeal of technology, it also dramatically raises the security risk as sensitive and personal data is shared across a network. Purpose built hardware can help deal with increasing network speeds and more complex threats. This is where semiconductor technology plays a fundamental role. Chip providers are developing business cases for implementing secure features on their products, and these are paving the way for new services for consumers and businesses. Gartner customers can view this latest webcast by registering here.

Tags: business, cloud, com, computing, data, direction, product, risk, Security, service, technology, threats

Latest Gartner Research:Marketing Essentials: Three Key Buying Centers for Print Security Solutions That Will Help Your Business Grow

Lawrence Pingree — Mon, 16 Jan 2012 23:54:03 +0000

Gartner customers can access my latest research on how to market and sell printers using security as a driver by clicking here.

Tags: business, market, Security

Politically Correct Way to Say Merry Christmas

Lawrence Pingree — Fri, 16 Dec 2011 17:10:49 +0000

Please accept with no obligation, implied or implicit, my best wishes for an environmentally conscious, socially responsible, low-stress, non-addictive, gender-neutral celebration of the winter solstice holiday, practiced within the most enjoyable traditions of the religious persuasion of your choice, or secular practices of your choice, w ith respect for the religious/secular persuasion and/or traditions of others, or their choice not to practice religious or secular traditions at all. I also wish you a fiscally successful, personally fulfilling and medically uncomplicated recognition of the onset of the generally accepted calendar year 2012, but not without due respect for the calendars of choice of other cultures whose contributions to society have helped make America great. Not to imply that America is necessarily greater than any other country nor the only America in the Western Hemisphere. Also, this wish is made without regard to the race, creed, color, age, physical ability, religious faith or sexual preference of the wishee.

Tags: able, america, calendar, celebration, choice, com, Correct Way, day, end, faith, holiday, Merry Christmas, obligation, persuasion, practice, preference, race, recognition, religious, respect, secular, traditions, wish

Bestselling Management Book: Now on Apple iBooks!

Lawrence Pingree — Mon, 12 Dec 2011 02:38:47 +0000

If you are looking for management books, my book just released on iBooks, download a copy today by searching for “The Manager’s Guide to Becoming Great” or by searching “Lawrence Pingree” in your iBooks application on an apple device or in iTunes.

Tags: application, com, day, device, just, Law, management, today

Latest Gartner Research:News Reports Can Help Inform Your Printer Security Strategy

Lawrence Pingree — Wed, 07 Dec 2011 04:54:48 +0000

If you’ve seen recent headlines about printer security risks and you’re a Gartner customer you can access our latest research by clicking here.

Tags: risk, Security