Uninstall squid Package
Ensures the squid HTTP proxy package is not installed on hosts that are not dedicated proxy servers.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
squid is a caching/forwarding HTTP proxy server. If there is no need to make proxy server software available, removing it provides a safeguard against its activation. A proxy left running can be abused as an open relay for outbound traffic, used to pivot through network boundaries, or exploited via the proxy's own CVEs, all unnecessary exposure on a host that is not a deliberate proxy.
What Pavois checks
Pavois asserts absence of squid via CINC/InSpec's package resource against the effective package database (dpkg/rpm). If squid is installed it can bind a listener (typically TCP/3128) regardless of config-file state, so the package-level check is the authoritative signal.
describe package('squid') do
it { should_not be_installed }
endHow to verify it is applied
Run dpkg -s squid (Debian/Ubuntu) or rpm -q squid (RHEL/Alma/Fedora); a compliant host reports not installed. Confirm no proxy listener with ss -tlnp | grep ':3128' (no output).
Inspect & investigate
- Removal events appear in
/var/log/dpkg.log(Debian) or/var/log/dnf.log(RHEL). - After removal,
systemctl status squidreports not-found and TCP/3128 is no longer bound (ss -tlnp).
Remediation
The harden plan declares a package resource for squid with action remove; pavois harden apply uninstalls it via the native package manager (apt/dnf). The proxy listener disappears.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | squid |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Do not apply on a deliberate proxy/gateway host, removing squid cuts off every client that routes web traffic or pulls cached content through it, which can break internet access for a whole subnet. Verify the host's role and current clients (ss -tnp against :3128) before applying. Cache data under /var/spool/squid is preserved by a removal (purge would delete it).
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.17, 2.1.18 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.