# Ensure web proxy server services are not in use

Necessity: A web proxy server forwards web traffic between clients and the internet, often for caching, filtering, or anonymity. If a system is not explicitly designated to be a proxy server, the service should not be installed. An unnecessary or misconfigured proxy (e.g., an open proxy) can be exploited by attackers to relay malicious traffic, obscure their origin, scan internal networks, or launch attacks against other systems. This increases the server's attack surface and could lead to the server's IP address being blacklisted. Auditing and Remediation: The audit script verifies whether the 'squid' package, a common web proxy server, is installed on the system. The remediation script uninstalls the 'squid' package to remove the service and its associated security risks. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Not Installed'. This adheres to the security principle of least functionality, which dictates that systems should only run services essential for their intended purpose. For a system not meant to be a web proxy, there is no secure level of configuration other than complete removal. Installing this service unnecessarily introduces a potential attack vector without providing any benefit to the system's primary function.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks if the 'squid' package is installed. The script should query the package manager for the installation status of 'squid'. If the package is installed, the script must output the string 'Installed'. If it is not installed, it must output 'Not Installed'. The script must not produce any other output.

## Remediation Script Working

bash script that accepts one positional argument which will be the desired state, 'Not Installed'. If the argument is 'Not Installed', the script must use the system's package manager to remove the 'squid' package. The script must return 'true' if the operation is successful or if the package is already uninstalled, and 'false' otherwise.

