Don’t panic – this page isn’t intended for spammers who look for new ways to send their crap. It’s merely here to tell Squid administrators how a wrong ACL/http_access configuration can quickly turn your HTTP proxy into an SMTP (mail) spamming machine.
(This page needs some work. But basically the problem is described in these lines I captured from IRC…)
04:56 < chalco> I’m trying to understand something. I’ve been working with some one setting up a wireless
ISP. squid is a large part of the set up. to make a long story short, we accidentally
configured an open relay, spammers found it, and we got blacklisted. what I’m trying to
understand is how squid processed those connections. I thought squid was only an http proxy
08:58 < ChrisH> chalco: That’s right. Squid is mainly a HTTP proxy. But to allow HTTPS connections (which
are encrypted so that Squid has trouble looking into the data stream) it supports the
CONNECT protocol to tunnel it through.
08:59 < ChrisH> chalco: Basically Squid opens a TCP tunnel on port 443 and just lets the browser
communicate with the web server directly. That’s why CONNECT requests are limited to port
08:59 < ChrisH> chalco: If you configured your http_access statements or ACLs incorrectly you could allow
CONNECT requests on port 25 thus allowing mail connections.
09:01 < ChrisH> chalco: OTOH there is a dirty way to do HTTP requests on port 25, too. Squid will send the
HTTP headers and the web server will ignore all the SMTP parts. But since you (or the
browser) can send additional HTTP headers you can send something like "MAIL FROM:" or
"RCPT TO:" in the HTTP header. And some SMTP servers are stupid enough to not bother about
the many wrong lines and just look for what they know.
09:01 < ChrisH> chalco: This seldom works but is also a way to allow spamming. So you should make sure
that you don’t allow HTTP and CONNECT (HTTPS) requests on those "special lower TCP ports".