Email spamming through a misconfigured Squid proxy

Don’t panic – this page isn’t intended for spammers who look for new ways to send their crap. It’s merely here to tell Squid administrators how a wrong ACL/http_access configuration can quickly turn your HTTP proxy into an SMTP (mail) spamming machine.

(This page needs some work. But basically the problem is described in these lines I captured from IRC…)

04:56 < chalco> I’m trying to understand something. I’ve been working with some one setting up a wireless
                ISP. squid is a large part of the set up. to make a long story short, we accidentally
                configured an open relay, spammers found it, and we got blacklisted. what I’m trying to
                understand is how squid processed those connections. I thought squid was only an http proxy
08:58 < ChrisH> chalco: That’s right. Squid is mainly a HTTP proxy. But to allow HTTPS connections (which
                are encrypted so that Squid has trouble looking into the data stream) it supports the
                CONNECT protocol to tunnel it through.
08:59 < ChrisH> chalco: Basically Squid opens a TCP tunnel on port 443 and just lets the browser
                communicate with the web server directly. That’s why CONNECT requests are limited to port
                443.
08:59 < ChrisH> chalco: If you configured your http_access statements or ACLs incorrectly you could allow
                CONNECT requests on port 25 thus allowing mail connections.
09:01 < ChrisH> chalco: OTOH there is a dirty way to do HTTP requests on port 25, too. Squid will send the
                HTTP headers and the web server will ignore all the SMTP parts. But since you (or the
                browser) can send additional HTTP headers you can send something like "MAIL FROM:" or
                "RCPT TO:" in the HTTP header. And some SMTP servers are stupid enough to not bother about
                the many wrong lines and just look for what they know.
09:01 < ChrisH> chalco: This seldom works but is also a way to allow spamming. So you should make sure
                that you don’t allow HTTP and CONNECT (HTTPS) requests on those "special lower TCP ports".

Leave a Reply

Your email address will not be published. Required fields are marked *

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close