Squid

Search Marketplace for Squid, select the SecureAnyCloud publisher and select Create. Configure the network security group to allow TCP 3128 (proxy) from your client subnets and TCP 22 for administration. Restrict port 3128 to trusted client networks and never expose it to the public internet.

RG="proxy-prod"; LOCATION="eastus"; VM_NAME="squid1" IMAGE_URN="sac1647283583153:squid-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:squid-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
# Open the proxy and admin ports on the VM's NSG (restrict 3128 to your client subnet):
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 3128 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1002

On first boot, the image resolves the VM address, asserts the secure defaults (not an open proxy) and tests the Squid configuration. It then initializes the cache, starts the service, proves that a proxied round trip works and that a repeat request is served from cache, and writes /root/squid-credentials.txt. This completes within a minute. Connect over SSH as azureuser and read the endpoint details.

sudo cat /root/squid-credentials.txt

Confirm that squid.service is active and owns port 3128. The ss command shows that the squid process is the listener on :3128.

systemctl is-active squid.service
sudo ss -tulnp | grep -E ':3128 '

Expected output:

active tcp LISTEN 0 256 *:3128 *:* users:(("squid",pid=2247,fd=18))

Point a request at the proxy with curl -x. The proxy forwards the request to the origin and returns the response. Then run the bundled self-test tool. It fetches a local object through the proxy twice, so the repeat is served from cache (a cache HIT), and it confirms that a denied request is refused.

curl -x http://127.0.0.1:3128 -s -o /dev/null -w 'via proxy: HTTP %{http_code}\n' http://example.com/
sudo /usr/local/sbin/squid-roundtrip.sh

Expected output:

via proxy: HTTP 200 round-trip OK: proxied fetch succeeded, repeat served from cache (TCP_MEM_HIT), request to a denied port refused (HTTP 403); the shipped config is not an open proxy (http_access deny all is the final rule; only localhost + RFC1918 allowed)

The SecureAnyCloud configuration is the whole of /etc/squid/squid.conf. The stock file is backed up to squid.conf.orig. Run squid -k parse to validate the configuration. The version is 6.14 from the Ubuntu archive.

squid -v | head -1 sudo squid -k parse >/dev/null 2>&1 && echo "squid -k parse: OK (configuration is valid)" grep -vE '^[[:space:]]*#|^[[:space:]]*$' /etc/squid/squid.conf

The expected output follows, with comments and blank lines removed.

Squid Cache: Version 6.14 squid -k parse: OK (configuration is valid) visible_hostname squid.sac.internal acl localnet src 10.0.0.0/8 acl localnet src 172.16.0.0/12 acl localnet src 192.168.0.0/16 acl localnet src fc00::/7 acl localnet src fe80::/10 acl SSL_ports port 443 acl Safe_ports port 80 ... acl CONNECT method CONNECT http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager http_access allow localhost http_access allow localnet http_access deny all http_port 3128 icp_port 0 cache_mem 256 MB maximum_object_size 256 MB cache_dir ufs /var/spool/squid 1024 16 256 httpd_suppress_version_string on via off forwarded_for delete

This check confirms the key security property. The http_access rules allow only localhost and the private localnet ranges and end with http_access deny all, so the proxy is not open to the public internet. A request that matches a deny rule, here a request to a non-web port, is refused with HTTP 403.

grep -E '^[[:space:]]*http_access' /etc/squid/squid.conf curl -x http://127.0.0.1:3128 -s -o /dev/null -w 'request to denied port: HTTP %{http_code}\n' http://127.0.0.1:9/
sudo grep -E '^squid\.' /root/squid-credentials.txt

Expected output:

http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager http_access allow localhost http_access allow localnet http_access deny all request to denied port: HTTP 403 squid.host=10.0.0.11 squid.proxy=10.0.0.11:3128

Configure the clients on your local network to use the VM as their HTTP and HTTPS proxy. On a Linux client, set the standard proxy environment variables. Replace <proxy-ip> with the VM public IP address, or with its private IP address inside the VNet.

export http_proxy="http://<proxy-ip>:3128"
export https_proxy="http://<proxy-ip>:3128"

Because of the source address ACLs, the proxy serves only clients on a private (RFC1918) subnet, or the VM itself. Keep the proxy and its clients on the same VNet or on a peered network. For an application, set its proxy setting to http://<proxy-ip>:3128.

If your clients are on a network range outside the default RFC1918 ranges, add an ACL for it. Create a file such as /etc/squid/conf.d/20-clients.conf, or edit /etc/squid/squid.conf, with your own network. Keep the deny all rule last.

# allow an extra trusted client subnet acl mynet src 100.72.0.0/16 http_access allow mynet

Validate the change with sudo squid -k parse, then apply it live with sudo squid -k reconfigure. Allow only networks that you control, and never add http_access allow all.

A common use of a forward proxy is to restrict which destinations clients may reach. To allow only a named set of sites, add a destination ACL and place it before the allow rules.

# only allow the listed destination domains acl allowed_sites dstdomain .ubuntu.com .github.com .microsoft.com http_access deny localnet !allowed_sites

Validate the change with sudo squid -k parse and apply it with sudo squid -k reconfigure. Squid then refuses client requests to any domain that is not on the list.

To require a username and password instead of, or in addition to, source address control, enable Basic authentication with a per-VM credential that you generate on the VM. The credential is never baked into the image. Install the helper, create a user, then add the auth stanza to /etc/squid/conf.d/10-auth.conf.

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords auth_param basic realm sac squid proxy acl authenticated proxy_auth REQUIRED http_access allow localnet authenticated

Create the password file with sudo apt-get install -y apache2-utils followed by sudo htpasswd -c /etc/squid/passwords <username>, which prompts you for a password. Make the file readable by the proxy user, validate with sudo squid -k parse and apply with sudo squid -k reconfigure.

• Restrict the NSG. Allow TCP 3128 only from the client networks that need the proxy, and TCP 22 for administration only. Never expose port 3128 to the public internet.
• Keep the proxy closed by default. The shipped configuration ends in http_access deny all. Keep that rule last, so that a new client range is allowed only where you add an explicit rule.
• Prefer destination allow lists for egress control. Step 10 shows how to limit which sites clients may reach through the proxy.
• Keep the OS and Squid patched. Unattended security upgrades remain enabled on the running VM.
• Watch the logs. /var/log/squid/access.log records every request with a cache result code, for example TCP_MEM_HIT or TCP_MISS. /var/log/squid/cache.log records service messages.

Squid is free software maintained by the Squid Software Foundation and contributors, distributed under the GNU General Public License, version 2 (GPL-2.0). This SecureAnyCloud image bundles the unmodified Ubuntu archive package. SecureAnyCloud provides the packaging, the caching proxy hardening, the not-an-open-proxy defaults, the bundled self-test tool, and 24/7 support with a guaranteed 24 hour response SLA.

SecureAnyCloud is not affiliated with or endorsed by the Squid project or the Squid Software Foundation. Squid is used here only to identify the software.

Deploy on Azure

Find Squid on Ubuntu 24.04 LTS on the Azure Marketplace, published by SecureAnyCloud. Deploy from the portal or the Azure CLI as shown above.

Need Help?

Email sales@secureanycloud.com for deployment help, configuration questions or licensing inquiries.

Deploy on Azure

Launch Squid 6.14 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Subscribe to the Squid listing, choose Launch through EC2 and pick your instance type, key pair, subnet and security group. Configure the security group to allow TCP 22 for administration and TCP 3128 for proxy clients, scoped to your trusted client subnets. Assign a public IP address (or an Elastic IP) if your clients connect from outside the VPC.

You can also launch from the AWS CLI. Replace the AMI ID with the one shown on your subscription's launch page, and replace the other IDs with your own.

aws ec2 run-instances \
  --image-id ami-xxxxxxxxxxxxxxxxx \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids sg-xxxxxxxx \
  --subnet-id subnet-xxxxxxxx \
  --associate-public-ip-address

On the first boot of every instance, squid-firstboot.service runs once. It asserts that the shipped configuration is default deny with authentication required. It then generates the per-instance proxy password into /etc/squid/passwd, initializes the cache, starts Squid and writes the plaintext login to /root/squid-credentials.txt. Allow about 20 seconds after the instance first becomes reachable.

Squid runs under systemd and listens on port 3128. Confirm the version and that the service is active.

squid -v | head -1 systemctl is-active squid.service

Confirm that the configuration is valid and that Squid owns the proxy port.

sudo squid -k parse >/dev/null && echo "squid.conf OK"
sudo ss -tlnp | grep ':3128 '

First boot writes the per-instance proxy username and password to a root-only file. Confirm that the file exists with the correct owner and permissions. Do not print its contents into shared logs.

sudo ls -l /root/squid-credentials.txt

Read your credentials interactively when you need them.

sudo cat /root/squid-credentials.txt

The file records squid.proxy.user (the proxy username, proxyuser), squid.proxy.pass (this instance's unique password) and the proxy endpoint. Keep the password private.

The image ships a self-contained self-check. Without exposing your password, it proves that an authenticated request succeeds and is served from cache on repeat, that an unauthenticated request is refused with 407, and that a request to a denied port is refused with 403.

sudo /usr/local/sbin/squid-roundtrip.sh

You can also test from any client that has the credentials. Point the client at the instance on port 3128 with the username and password from /root/squid-credentials.txt.

curl -x http://<instance-ip>:3128 \
  --proxy-user 'proxyuser:<your-password>' \
  https://example.com/ -o /dev/null -sS -w '%{http_code}\n'

Squid serves a repeated request for the same cacheable object from its cache. The same request without credentials is refused with 407, which shows that this is not an open proxy.

The whole access policy lives in one file, /etc/squid/squid.conf. The rule order enforces the policy. Port safety checks come first, then the cache manager restricted to localhost, then the only proxying allow rule (http_access allow authenticated), and finally http_access deny all. There is no http_access allow all.

grep -E 'auth_param basic (program|realm)|^acl authenticated|^http_access|^http_port|^icp_port' /etc/squid/squid.conf

Although the proxy requires authentication, also limit network access to it. In the EC2 security group, restrict inbound TCP 3128 to your trusted client subnets or Elastic IPs rather than 0.0.0.0/0. Keep TCP 22 restricted to your administration network. Treat the per-instance password as a secret and rotate it if it is ever exposed.

The password database is a standard Apache-style htpasswd file at /etc/squid/passwd. Add a proxy user or change a password with the htpasswd tool, which requires apache2-utils. Then reload Squid without dropping connections.

sudo apt-get install -y apache2-utils
sudo htpasswd /etc/squid/passwd newuser
sudo squid -k reconfigure

To rotate the built-in proxyuser password, run sudo htpasswd /etc/squid/passwd proxyuser, then run sudo squid -k reconfigure and update any clients.

Edit /etc/squid/squid.conf to tune the cache. Common changes are the on-disk cache size (cache_dir ufs /var/spool/squid 1024 16 256, where 1024 is megabytes), the in-memory cache (cache_mem 256 MB), the maximum cacheable object size (maximum_object_size 256 MB) and the refresh_pattern rules that control object freshness. To chain to an upstream proxy, add a cache_peer line. After any change, validate the configuration and reload Squid.

sudo squid -k parse
sudo squid -k reconfigure

To filter or cache HTTPS traffic, you can enable TLS interception (SSL bump). This requires a certificate authority whose certificate you install on your client machines, and an http_port ... ssl-bump line with ssl_bump rules. Because TLS interception decrypts client traffic, deploy it only for clients that you own and administer, and generate the CA key per deployment. SecureAnyCloud engineers can help you design and deploy an SSL bump configuration after purchase.