Description
Squid (squid.service) is the HTTP caching proxy packaged by Debian.
The control passes when the unit is masked or not installed at all.
A unit that does not exist counts as compliant, so removing the package is an equally valid fix.
Rationale
A proxy relays connections for its clients. A misconfigured one lets outsiders reach internal systems or use the host to hide attacks, and its cache can hold sensitive responses.
Impact
Masking the unit stops it and prevents it from starting again. Proxy servers must exclude this control in their tailoring file.
Audit
Run systemctl is-enabled squid.service. It must print masked, or fail because the unit does
not exist.
Automated: every check must pass. Scanners report each check by its id.
squid
Squid proxy server.
unit: squid.service
state: masked
Remediation
Run systemctl mask --now squid.service, or apt purge squid if the package is not needed.
| Restart | none |
| Disruption | low |
Rollback
Run systemctl unmask squid.service then systemctl enable --now squid.service.
squid
Generated from check squid: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- squid(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
- systemctl(1), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
- ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62) ANSSI, guide, accessed 2026-10-18
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0 | R62 | partial | R62 asks to disable every unneeded service; this control covers the web proxy. |
| NIST SP 800-53 Rev. 55.1.1 | CM-7 | partial |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| MITRE ATT&CK | T1090 |
Related controls
- related
CB-DEB-SVC-008Disable web server services on systems that do not serve web content
People and lifecycle
| Authors |
|
| Verified | 2026-10-18 by Sn0wAlice on 12, Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64. Fresh image passes; with squid installed the check fails, fix masks, audit passes after reboot. |
| Verified | 2026-10-18 by Sn0wAlice on 13, Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64. Fresh image passes; with squid installed the check fails, fix masks, audit passes after reboot. |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-18, 2026-10-18 |
| Translations | fr |
