From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4.2) Gecko/20040301 Description of problem: /etc/squid/squid.conf may contain a plaintext password in the cachemgr_passwd directive. Users with access may be able to see the list of cached objects and shutdown the cache itself. A message on the mailing list suggests non-world-readable permissions for this file (http://www.squid-cache.org/mail-archive/squid-users/200201/0539.html). I suggest using ownership root:squid and permissions 0640. A fix to the SPEC file might be: 130c130 < %config(noreplace) /etc/squid/squid.conf --- > %config(noreplace) %attr(640,root,squid) /etc/squid/squid.conf Version-Release number of selected component (if applicable): squid-2.5.STABLE3-5.3E How reproducible: Always Steps to Reproduce: 1. install 2. examine permissions of /etc/squid/squid.conf Actual Results: File readable by all users. Expected Results: Should be readable only by root and user 'squid'. Additional info:
This issue also affects RHEL2.1
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2005-489.html