Disable Squid
Ensures the squid.service (Squid caching/forward proxy) is neither enabled at boot nor running, unless the host is intentionally a proxy.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Squid is a caching forward proxy, typically listening on 3128 (or 8080). A proxy that is reachable and open lets attackers tunnel traffic, anonymize attacks through your host, reach internal services it can route to, and abuse your bandwidth, open proxies are routinely scanned for and weaponized. It also adds a complex HTTP parser to the attack surface. On any host that is not meant to provide proxy/caching, Squid is needless exposure and should be stopped and disabled.
What Pavois checks
Pavois reads the effective state of squid.service from systemd, asserting it is neither enabled nor running. This reflects what is actually bound to the proxy port regardless of whether /etc/squid/squid.conf exists, and catches a daemon started by a drop-in override. A package/config check cannot tell you whether Squid is currently accepting connections.
describe service('squid.service') do
it { should_not be_enabled }
it { should_not be_running }
endHow to verify it is applied
Run systemctl is-enabled squid.service and systemctl is-active squid.service; expect disabled/masked and inactive. Confirm nothing listens with ss -tlnp | grep -E ':3128|:8080'.
Inspect & investigate
Inspect journalctl -u squid.service for start/stop events, and /var/log/squid/access.log for past proxy usage. systemctl show squid.service -p ActiveState -p UnitFileState gives the machine-readable state. Confirm the proxy port is closed with ss -tlnp | grep -E ':3128|:8080'.
Remediation
Pavois's harden plan acts on the service resource named squid with actions disable then stop: it removes boot enablement and stops the proxy. Applied with pavois harden apply. Existing config and cache under /etc/squid/ and /var/spool/squid/ are left in place.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | disable, stop |
|---|---|
| name | squid |
| resource | service |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling Squid cuts off any client that routes web traffic through this proxy: workstations or services with http_proxy/HTTP_PROXY pointing here, or PAC/WPAD configs, will lose Internet access or fail egress through the proxy's allow-lists. Before applying: confirm no clients depend on it (check /var/log/squid/access.log for recent activity, and network proxy settings/PAC files), and that it is not an outbound egress chokepoint enforcing policy. If the host is a proxy, exclude this rule; if it must stay, lock ACLs so it is not an open proxy.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.17 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.