Re: [Devil-linux-develop] squid authorization modules

[Bruce S. <bw...@ar...>]

> >> Not necessary.  All the squid authorization modules are completely stand
> >> alone binaries.  They only take up a little space on the CD.  They are
> >> not run unless you add a line in  /etc/squid.conf  something like:
> >>
> >>   auth_param basic program /usr/sbin/yp_auth ...
> >
> > Ok, good, but for a real firewall can we offer a configure option so
> > those modules can be selected on an per module basis or just "auth
> > modules yes or no"? So the security consious people can create their
> > own stripped down firewall only version. Just a thought.
> >
> He got a point again....
> 
> Bruce already added the option to (de-)select the nis and port mapper stuff.
> I would suggest that you (Bruce) add some more intelligence to the squid 
> script.  This should make everybody happy.

I'm sorry, but this is crazy.  These are small stand alone programs
which are part the squid package, and should be included.  All they do
is check a password crypt and send "OK" or "ERR" to stdout.

There are tons of other non-optional programs that are just as much of a
security risk (none) as these are.  We could go crazy making every
binary optional.

 - BS