<Group id="proxy">
<title>Proxy Server</title>
<description>A proxy server is a very desirable target for a
potential adversary because much (or all) sensitive data for a
given infrastructure may flow through it. Therefore, if one is
required, the machine acting as a proxy server should be dedicated
to that purpose alone and be stored in a physically secure
location. The system's default proxy server software is Squid, and
provided in an RPM package of the same name.</description>

<Group id="disabling_squid">
<title>Disable Squid if Possible</title>
<description>If Squid was installed and activated, but the system
does not need to act as a proxy server, then it should be disabled
and removed.
</description>

<Rule id="disable_squid">
<title>Disable Squid</title>
<description>
<service-disable-macro service="squid" />
</description>
<ocil>
<service-disable-check-macro service="squid" />
</ocil>
<rationale>
Running proxy server software provides a network-based avenue
of attack, and should be removed if not needed.
</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="service_squid_disabled" />
</Rule>

<Rule id="uninstall_squid">
<title>Uninstall squid Package</title>
<description>
<package-remove-macro package="squid" />
</description>
<ocil>
<package-check-macro package="squid" />
</ocil>
<rationale>
If there is no need to make the proxy server software available,
removing it provides a safeguard against its activation.
</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="package_squid_removed" />
</Rule>
</Group>
</Group>

