Hey everyone and welcome back. So now what I want to talk to you about is the concept
of what is called a proxy server. So what is a proxy server? What does it do for us?
Let's find that out then shall we? So at its core really what a proxy server acts as as
kind of like a middleman. Okay such that when you have a little computer here this can be the client
and this can be the server you're trying to reach to as opposed to you directly connecting to that
server from your IP address directly to the server's IP address instead there's going to be a type of
really involved i.e in the middle we will have this proxy server. So when you go to visit
this website the connection is not direct from here to here instead as we can see above the
request instead goes directly to the proxy server and then the proxy server makes that request on
the client's behalf to the server and when the server responds the server sends the response back to
the proxy server who then relays that information back to you. Now if you happen to have let's say
a VPN this is a very common technology nowadays let's maybe say you have a Netflix account and
you want to access some geo restricted content well think about what that actually means that would
mean that the server let's maybe say you wanted to watch some content that was on Netflix UK and
you happen to be residing within the USA. Some people although i'm not saying me nor am I recommending
you do this some people will just implement a VPN i.e they'll pay for a service and this example
which may have a UK server which can make that request on their behalf so the Netflix customer
in the USA tunnels that traffic through a UK server to request information from Netflix UK and
Netflix UK sees that request is coming from a UK IP address and says hey i'm allowed to serve up this
content to people within this area so i can send that information back i.e send the movie you want
to watch and that is ultimately relayed back to the customer so we have this middleman in play
right here the VPN is effectively acting as a proxy for your request so what you're getting here
is a form of anonymity now not total anonymity of course because the middleman who you're connecting
to they can see both sides of the connection they can see who is making the request and where that
request is going to but nevertheless from the point of the server the server actually cannot see
who the client they're actually serving is so this can be useful like i say if you want to be able to
protect your IP address from being sent to a particular server or if you want to just hide
your location of where you're browsing from but that only tells one part of the story with respect
to proxies now the proxy which i'm talking about right now is something called a forward proxy now
we will get to talk about a reverse proxy within the next nugget but understand for now the transaction
i just described here was relating to a forward proxy now the way we can tell this is that the
forward proxy is based around protecting the client i.e the person making the request to the server
they are the ones with the proxy configuration now like i said the idea of being able to hide
your location and your IP address from a particular server that is only one function that we can use
with respect to a proxy server or one function we can leverage to our advantage should i say so
another thing that we can do is we can ultimately implement filtering so think about it like this
then okay so let's say we have the big bad internet out there who knows what you can find out on there
you know it's not always a safe place and let's say that we have our local network here we have a
bunch of computers within our company and what we do is we implement this proxy server okay now we
can configure things in such a way that all the devices within our network they are configured
to talk directly to our proxy server so that means that whenever they want to make a particular
request out to the big bad internet now they have to go through this proxy server and this proxy
server can be tightly controlled so think about it like this so let's say we have this company here
and the company they do not want their employees to be slacking off so they do not want their employees
to access things like youtube now youtube can be very educational as i'm sure you are aware but
let's just say this company are taking a very harsh stance maybe it would be better to block
something like say netflix which is more explicitly an entertainment platform okay so whatever it may
be we have a whole bunch of websites that we do not want our team here to be wasting their time so
to speak and accessing during work hours so if a user happens to go to say for example netflix.com
the request here has to go through the proxy server now the proxy server can ultimately
filter here okay so that means for anyone in our network trying to access this website it's going
to be filtered and therefore the connection can ultimately be denied so the users cannot make
that particular request however let's maybe say the user wants to go to say for example wikipedia.org
that might actually be whitelisted ie this is something that is allowed and as such the proxy
is going to allow this connection and we can make that request and contact wikipedia out there on the
internet so we ultimately have this little bottleneck of control whereby we can implement
any type of policy that we want to do so now another example of which is remember we talked about in
previous skills we talked about dns but we know dns is how we can actually resolve ip addresses and
domain names so this can be a good source of control for us i.e we can allow particular request
via their dns lookup by putting the domain on a whitelist or we could deny particular dns requests
using a blacklist so think about it in this case here the dns name is how we are actually determining
where the user wants to go and if that is in line with our particular policy now remember we also have
google's public dns server such as 8.8.8.8 a crafty and a savvy employee may actually change
their dns server to point to google's public dns server i.e bypassing the dns control that you
have in your local dns now if you want to be able to control and force everyone to use that dns server
well again via your proxy you could ultimately block access to these type of public dns servers
i.e if someone wants to resolve some type of domain name they're going to have to use the only
one available which is your local one which is the one whereby you have explicit control now
there are different types of proxies available but the one we're going to quickly focus on just now
is one called squad now squad should not be installed by default on your system so you're
going to want to install that let me just walk through the installation process we'll just say
sudo in fact let me take caps lock off i will say sudo apt install quid it really is that simple
so now i'll type in my password okay now the installation will begin i will just say yes hit
enter and there we go now this should only take a minute or so just give it some time okay great
so let me just clear the screen and now with squad installed we should now have a squad
configuration file now that configuration file should be able to be found within the etsy directory
within a directory called squad which will be newly created and then the actual file itself
will be quid.conf so how about we go and inspect this file then so what i will do is i will go
into my etsy directory i'll go into squad or do an ls we can see the actual squad.conf so what i'll
actually see here and you can probably hear me laughing is that when i open this file this is
a pretty massive file so just watch this if i open this up i'll use them so you can see in fact
let me just actually install them okay so let's open this up once again there we go so if you look
at the bottom right hand corner here we can see we're at the top of the file as i scroll down this
file you're going to see the percentage of how much i've scrolled through so i'll keep scrolling
and as you can see here as i'm moving i've only i'm at 1% and now 2% this file is absolutely
massive okay so what i'm trying to say is is that trying to scroll through this entire file is kind
of a futile thing at least in my opinion you really want to be knowing what you're looking for
and utilizing certain search tools maybe even just say grep to more quickly manage this particular
file because just opening the file and just trying to scroll to the relevant line this is going to
take you quite a while and it's not very efficient okay so let me just talk about the actual configuration
file from now okay let me just quickly escape here so i'll just quit out of them okay so within
this configuration file we can do a whole bunch of things as we know we can use our proxy server
to filter on particular criteria and it is within this configuration file that we can actually control
access to what we want to permit and deny this is going to be known as acl these are access control
lists so what i'm going to do here is i will actually just cat the file for now i'll say cat
squad dot conf now of course if i just hit enter it's going to be very very large i'm going to
grep for something very particular so i will grep for the words insert okay so it says here
insert your own rules here to allow access from your clients i actually want to know where abouts
within the text file this happens so i will say dash n to give me the line number we can see the
line number is 1184 so i could use one of my text editors say for example vim or if you prefer nano
and i will say nano plus and give that line number so that i open the text file directly at that
location so i'll give the actual name of the configuration file now and if i hit enter we
should snap open as we can see here directly right to this particular line and this is where we can
control our access now one thing to note is that we do have some particular keywords which are built
in to the squad configuration you want to understand these so we can recognize them say for example you
see this keyword here all okay so within our acl if we deny or allow all this is going to refer to
absolutely everything all of the systems whereas if you happen to see the keyword here local host
this just means the source ip of the server itself ie this actual server i'm working on where
squid happens to be installed the local host now we'll also see one called to underscore local host
this also refers to the local host ie the actual server here which squid is installed on but it
actually refers to destination ip addresses for the local server we're also going to see this
keyword here manager this is going to handle squids cache so remember how we can actually
cache particular information so that we don't have to resend the same request it can just be
stored within the system manager actually refers to the management of the squids server's actual
caching mechanism now we can see here we have the important keywords deny this is when we want to
deny something and of course when we want to allow something we can say allow we're also going to see
the keyword src if we want to refer to a source ip address or a source network address if we want to
be a little bit more broad we'll also see dst when we want to refer to a destination ip address or a
network address we'll also actually see this one right here ssl underscore port this is where we
can specify ports where secure sockets layer is actually permitted so we just talked about
ssl very very recently and we're also going to see one called safe underscore ports and that is
safe with a capital s this is going to be the ports where regular HTTP is going to be allowed
now one thing to note here is that within this configuration file when we see an exclamation
mark like we see right here this actually means an inversion of logic pretty much what i'm saying is
this means not now we're going to be reusing this HTTP access keyword whenever we want to allow or
deny anything you're going to see this keyword continually invoked over and over again now
another important concept i want to show you within this particular file as if i grep this time for
var bool go ahead and to enter this part right here i actually want to inspect this so let me open
this up at line 3461 so i'll just edit this 3461 and to enter snaps me open right here so with respect
to our caching and we can actually see this here with the description the cache disk directory if
we want to invoke this caching we would ultimately uncomment this i.e remove the hashtag and this
is what we actually see here var spoolsquid is going to be the directory where the cache actually is
stored now we do have some particular values here now the first one we can see is 100 what this is
ultimately referring to is the size of the cache that we're going to allow in this case here this
is going to be in the value of megabytes so not exactly a huge volume of data and these two values
here ultimately refer to directories the first one would be the top level directory i.e we could have
16 main directories caching things and within each of those 16 each of those 16 can have 256
directories within them and that really is what it is we can have 16 directories each of those
directories can have 256 directories within them and the total amount of data that we can store for
our cache is 100 megabytes in which case if we exceed this we're going to ultimately clean and
refresh that data so really if we want our proxy server to act as a caching server then we want to
uncomment this line and we want to specify the location of the cache directory as well as these
particular values to control how much we are actually allowing for the caching to happen if I
just escape out for now if I want to activate my squad server I can say sudo systemctl enable
squids and then I will say sudo systemctl start squids and then I should be able to say sudo
systemctl status squids and as we can now see here our squad proxy server is indeed active
and running and with this server now running we could ultimately configure our clients within
our network to actually point to this server and those clients would ultimately be bound by the
rules that are specified within the access control list within xasquid squad.conf as well as they could
also benefit from the caching mechanism of this squad server depending again on the caching settings
that you've chosen within xasquid squad.conf. Okay so that is us for our introduction into
forward proxies and squids I hope this has been informative for you and I'd like to thank you for viewing.