mirror of
https://github.com/3proxy/3proxy.git
synced 2026-04-07 05:40:12 +08:00
34 lines
1.8 KiB
HTML
34 lines
1.8 KiB
HTML
<h3>3proxy Security Considerations</h3>
|
|
<ul>
|
|
<li>Never install 3proxy suid. If you need it to run suid, write a
|
|
wrapper with a fixed configuration file.
|
|
<li>Make the configuration file accessible only to the account 3proxy starts with.
|
|
<li>Under Windows, if 3proxy is used as a service, create a new
|
|
unprivileged local account without "logon locally" rights. Assign this account
|
|
to the 3proxy service.
|
|
<li>Under Unix, use chroot to jail 3proxy (make sure files included in
|
|
the configuration file after the 'chroot' command, if any, are available from within the jail).
|
|
<li>Under Unix, either start 3proxy with an unprivileged account or, if you need
|
|
some privileged ports to be used by 3proxy, use setgid/setuid commands inside
|
|
3proxy.cfg immediately after the last occurrence of a service bound to a
|
|
privileged port in the configuration file (setgid must precede setuid).
|
|
<li>Always use full paths in the configuration file.
|
|
<li>Try to avoid 'strong' authentication, because only cleartext
|
|
authentication is currently available.
|
|
<li>Always specify internal and external interfaces.
|
|
<li>Always limit connections to the internal network and localhost (to 127.0.0.1 and
|
|
all interfaces) with ACLs. Be careful, because the BIND command in SOCKS requires the
|
|
BIND method with the external interface IP address to be allowed.
|
|
<li>Before 3proxy 0.8, always use nserver and nscache under Unix; otherwise, a DoS attack is possible
|
|
with an unreachable DNS server (because gethostbyname will block other threads).
|
|
<li>Keep logs in a secure location, because some confidential information from
|
|
user requests can be logged.
|
|
<li>Use -xyz+A character filtering sequences for 'logformat', especially with
|
|
ODBC logging, to prevent SQL and log record injections.
|
|
<li>Immediately report all service crashes to the developers.
|
|
<li>Participate in code audit :)
|
|
</ul>
|
|
|
|
<p>
|
|
|