Squid 7.8 on AWS User Guide

Overview

This guide covers launching and verifying Squid 7.8 on Ubuntu 24.04 from cloudimg on Amazon EC2. It is one version of the cloudimg Hardened WireGuard VPN & VPN, Proxy and Remote Access AMIs listing on AWS Marketplace; you pick it as the software version when you subscribe and launch. The other VPN, proxy and remote access servers in the listing are described on the listing's guide hub.

Squid is a caching forward web proxy: clients send their HTTP requests to it, it fetches the pages for them, keeps cacheable responses in memory and on disk, and tunnels HTTPS with CONNECT. Typical uses are giving instances in private subnets controlled web access, caching package and artifact downloads, and having one place to see and limit what leaves your network. It is a headless network service with no web console.

What cloudimg adds

• The current upstream release, verified. Ubuntu 24.04 carries the older Squid 6 series; several 2025 and 2026 Squid security advisories (including two rated critical) were fixed upstream in the 7 series. This image ships Squid 7.8, built from the unmodified upstream release tarball after its SHA-256 checksum and its OpenPGP signature (Squid release key 29B4 B1F7 CE03 D1B1 DED2 2F30 28F8 5029 FEF6 E865) were verified. Every Squid security advisory published so far is fixed in 7.8. The compiler and build tools are removed again before the image is captured.
• No HTTPS interception code. The binary is built without any TLS library, so it cannot decrypt HTTPS (no SSL-Bump). HTTPS passes through as normal encrypted CONNECT tunnels, to port 443 only.
• A password on every instance. First boot generates a password for the proxy user cloudimg on each instance. Squid's own Basic authentication helper checks it against a SHA-512 hash; there is no default login.
• Not an open proxy. Requests from any source outside loopback and the private ranges 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 and fc00::/7 are refused before a password is even asked for, private sources need the password, and the last rule denies everything else. The security group opens SSH only.
• No route to the instance's own services or metadata. Squid refuses destinations on loopback, link-local addresses (169.254.0.0/16, fe80::/10), the instance metadata addresses (169.254.169.254 and fd00:ec2::/32) and the instance's own IP addresses. Independently of those rules, the Squid service is blocked from the metadata service at the system level. FTP through the proxy is turned off.
• Fewer moving parts. Only the Basic authentication helper is built: ICAP, eCAP, SNMP, HTCP, WCCP, cache digests, the ICMP pinger and transparent interception are not compiled in. The cache manager answers on loopback only.
• Hardened service. Squid runs as the unprivileged proxy user with no capabilities, a read-only system apart from its cache and log directories, and a restricted set of system calls. A start guard refuses to start Squid with a configuration that would make it an open proxy.
• Private logs. The access log records the time, client address, user, status, size and URL without its query string; never the password or the Proxy-Authorization header. Squid does not add Via or X-Forwarded-For, so the sites you visit do not see your clients' private addresses.

Prerequisites

1. An AWS account and permission to launch EC2 instances
2. An EC2 key pair in the Region you launch in
3. A VPC subnet for the proxy, and the CIDR ranges of the clients that will use it

Recommended instance type: m5.large. A proxy for a handful of clients runs on t3.small or larger; give a busy cache more memory and a larger root volume.

Connecting to your instance

Step 1: Launch the instance

Option A: AWS Marketplace console

1. Open the cloudimg Hardened WireGuard VPN & VPN, Proxy and Remote Access AMIs listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
2. Once the subscription is active, choose Launch your software.
3. Choose One-click launch from AWS Marketplace (or Launch from EC2 Console for the full launch wizard). In Version, choose Squid 7.8 on Ubuntu 24.04, then choose your Region.
4. Pick an instance type (m5.large recommended; the software charge is $0.04 per vCPU per hour) and your key pair.
5. Security group: the listing's default group allows SSH (22) only. Restrict it to your own IP address. You will open the proxy port to your clients in Step 5.
6. Choose your VPC and subnet, leave the metadata defaults (the image already requires IMDSv2), then choose Launch.

Option B: AWS CLI

Run this on your own workstation. It creates a security group that allows SSH from your management address and the proxy port from your VPC only, then launches the instance. Replace the AMI ID with the one shown for your Region on the Marketplace launch page, and the VPC, subnet, key pair and CIDR ranges with your own:

SG=$(aws ec2 create-security-group --group-name squid \
  --description "Squid caching proxy" --vpc-id vpc-0123456789abcdef0 \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 22 --cidr <your-mgmt-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 3128 --cidr <vpc-cidr>
aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids "$SG" \
  --subnet-id subnet-0123456789abcdef0 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=squid}]'

You do not need --metadata-options: the AMI already makes IMDSv2 required.

Step 2: Connect and read the credentials

Connect as ubuntu with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>

First boot finishes within a minute of launch. It generates this instance's proxy password, stores only a SHA-512 hash of it in /etc/squid/passwd, starts Squid and checks that it refuses requests without the password, accepts them with it and refuses the metadata service. The details are in /root/squid-credentials.txt, readable only by root. This command prints everything except the password line:

sudo grep -v '^PROXY_PASSWORD=' /root/squid-credentials.txt

# Squid 7.8 - generated on first boot by squid-firstboot.service.
# The password below is unique to this instance; nothing was baked into the image. Keep this file private.
#
# VPC clients: HTTP proxy 172.31.81.132:3128 with the user and password below (open TCP 3128 in the security group to
# your VPC or client security group only - never 0.0.0.0/0). Only private (RFC 1918 / fc00::/7) sources are served.
PROXY_HOST=172.31.81.132
PROXY_PORT=3128
PROXY_USER=cloudimg

# Self-test: sudo squid-selftest   New password: sudo squid-access rotate-password   Status: sudo squid-access status
# Guide: https://www.cloudimg.co.uk/guides/squid-7-8-on-ubuntu-24-04-aws/

PROXY_HOST is your instance's private IP address. To see the password when you need it, run sudo cat /root/squid-credentials.txt.

Step 3: Confirm the proxy is running

systemctl is-active squid squid-firstboot
sudo ss -Hltn | awk '{print $4}' | sort

active
active
*:3128
0.0.0.0:22
127.0.0.53%lo:53
127.0.0.54:53
[::]:22

Squid listens on port 3128 (IPv4 and IPv6). The two :53 sockets are Ubuntu's local DNS resolver on loopback, which Squid uses for name lookups.

Step 4: Run the self-test

The image includes a self-test that exercises the whole path without printing the password:

sudo squid-selftest

SELFTEST_OK squid=active user=proxy port=3128 no-credential=407 wrong-password=407 password=200 imds=403 imds6=403 loopback=403

Step 5: Open the proxy to your clients

Clients in your VPC connect to the instance's private IP address on port 3128. In the EC2 console, edit the instance's security group and add an inbound rule:

• Type: Custom TCP, Port range: 3128
• Source: your VPC CIDR (for example 10.0.0.0/16) or the security group your client instances use

Never use 0.0.0.0/0. Squid refuses public source addresses and still needs the password, but the port should not be exposed to the internet at all.

Step 6: Make requests through the proxy

From a client instance in your VPC, pass the user and password from Step 2. With curl:

curl -sS -o /dev/null -w '%{http_code}\n' --proxy http://<PROXY_HOST>:3128 --proxy-user '<PROXY_USER>:<PROXY_PASSWORD>' https://example.com/

200

For tools that read the standard environment variables (apt, pip, curl, wget, most SDKs), set http_proxy and https_proxy to http://<PROXY_USER>:<PROXY_PASSWORD>@<PROXY_HOST>:3128. The proxy password travels with HTTP Basic authentication on the proxy connection, which is not encrypted: keep port 3128 inside your VPC, and use an SSH tunnel (ssh -L 3128:127.0.0.1:3128 ..., then the proxy 127.0.0.1:3128 with the same user and password) when you use it across the internet.

Step 7: Confirm it is not an open proxy

Without a password, Squid answers 407 and asks for Basic credentials. On the instance:

curl -s -D - -o /dev/null -x http://127.0.0.1:3128 http://example.com/ | tr -d '\r' | grep -E '^(HTTP|Proxy-Authenticate|Server)'

HTTP/1.1 407 Proxy Authentication Required
Server: squid
Proxy-Authenticate: Basic realm="cloudimg Squid proxy"

A wrong password gets the same answer. Requests from addresses outside the private ranges are refused with 403 before any password is asked for. The rules are in /etc/squid/squid.conf:

grep -E '^http_access' /etc/squid/squid.conf

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny to_localhost
http_access deny to_linklocal
http_access deny to_metadata
http_access deny to_self
http_access allow localhost manager
http_access deny manager
http_access deny FTP
http_access deny !localnet !localhost
http_access allow localnet authenticated
http_access allow localhost authenticated
http_access deny all

The order matters (the first match wins): unsafe ports and non-443 CONNECT first, then the forbidden destinations, the cache manager for loopback only, FTP, sources outside your networks, and only then the password-protected allows, with deny all last.

Step 8: Metadata and local services are unreachable through the proxy

A proxy that will fetch any URL could be used to read the instance metadata service or to reach services that listen only on the instance itself. With the password (written to a curl config file on your session's private tmpfs, so it never appears on a command line or on disk):

sudo sh -c 'printf "proxy-user = \"cloudimg:%s\"\n" "$(sed -n "s/^PROXY_PASSWORD=//p" /root/squid-credentials.txt)"' > /run/user/$(id -u)/squid-curl
for u in http://169.254.169.254/latest/meta-data/ 'http://[fd00:ec2::254]/latest/meta-data/' http://127.0.0.1:22/ http://localhost:8080/; do
  printf '%s %s\n' "$(curl -s -o /dev/null -w '%{http_code}' -K /run/user/$(id -u)/squid-curl -x http://127.0.0.1:3128 "$u")" "$u"
done
rm -f /run/user/$(id -u)/squid-curl

403 http://169.254.169.254/latest/meta-data/
403 http://[fd00:ec2::254]/latest/meta-data/
403 http://127.0.0.1:22/
403 http://localhost:8080/

403 is Squid refusing the destination before any connection is made. Independently of those rules, the Squid service (and its authentication helper) is blocked from the metadata service at the system level:

systemctl show -p IPAddressDeny squid

IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32

Step 9: The cache manager

Squid's cache manager reports statistics. It answers on the instance's loopback address only, and no password-protected action (shutdown, reconfigure) is enabled:

curl -s http://127.0.0.1:3128/squid-internal-mgr/info | head -4

Squid Object Cache: Version 7.8
Build Info: 
Service Name: squid
Start Time: Sat, 31 Oct 2026 18:56:55 GMT

Step 10: Allow another of your own networks (optional)

If your clients use addresses outside the private ranges (for example a 100.64.0.0/10 secondary VPC range), add an acl localnet src line after the existing ones in /etc/squid/squid.conf (with any editor, or as below), then check and apply it:

sudo sed -i '/^acl localnet src fc00::\/7/a acl localnet src <vpc-cidr>' /etc/squid/squid.conf
sudo squid-guard && sudo systemctl reload squid

squid-guard runs before every start and reload. It refuses a configuration in which an http_access allow rule does not require the password, the destination denies are missing or come after an allow, deny all is not last, or the cache manager has a password; and it re-renders the list of this instance's own addresses. The security group still decides who can reach port 3128 at all.

Step 11: Rotate the password (optional)

sudo squid-access rotate-password

This generates a new password, replaces the hash in /etc/squid/passwd, restarts Squid (which also empties its authentication cache, so the old password stops working at once) and writes the new password to /root/squid-credentials.txt. sudo squid-access status shows the proxy address and the allowed source ranges without printing the password. To add more users, append user:hash lines to /etc/squid/passwd with hashes from openssl passwd -6.

Step 12: Allow more HTTPS ports (optional)

CONNECT tunnels are allowed to port 443 only. To allow another port, add acl SSL_ports port 8443 below the existing acl SSL_ports port 443 line in /etc/squid/squid.conf, then sudo squid-guard && sudo systemctl reload squid.

Step 13: Cache and logs

The disk cache is 1 GB in /var/spool/squid and the memory cache 256 MB (cache_dir and cache_mem in squid.conf; size them to your volume and instance). Logs are in /var/log/squid:

sudo tail -n 3 /var/log/squid/access.log

Each line holds the time, response time, client address, cache result and status, size, method, URL (without its query string), user and the upstream address. cache.log holds start-up messages and errors. Both rotate daily and are kept for seven days.

How the secure start works

squid.service only starts once first boot has written /var/lib/cloudimg/squid-ready. Before each start and reload, squid-guard checks the configuration as described in Step 10 and that /etc/squid/passwd holds only crypt hashes; if a check fails, Squid does not start. Check the current configuration with:

sudo squid-guard && echo guard OK

guard OK

Security recommendations

• Keep port 3128 open only to the networks that need the proxy, and use an SSH tunnel across the internet.
• Rotate the proxy password when someone who knew it no longer needs it.
• Keep the instance patched. Ubuntu security updates install automatically every day; Squid itself is updated by launching a newer version from the listing.
• Treat the access log as personal data: it names the sites your users visit.

Support and licensing

Squid is free software under the GNU General Public License, version 2 or (at your option) any later version. The unmodified source tarball this binary was built from (release SQUID_7_8), its OpenPGP signature, the licence text and the build record are in /usr/local/share/doc/squid/.

Squid is developed by the Squid Software Foundation and its contributors (https://www.squid-cache.org/). cloudimg is not affiliated with or endorsed by the Squid project. For help with this image, contact cloudimg support through the AWS Marketplace listing.