Koozali.org: home of the SME Server

Obsolete Releases => SME Server 7.x => Topic started by: bjoyce on October 16, 2007, 12:54:50 AM

Title: porn image in squid cache
Post by: bjoyce on October 16, 2007, 12:54:50 AM

Hi,
Somehow a porn image has got into my squid cache.  One of my users notified me that a image search for a sunrise brought up a porn page.  When connecting to the internet without any proxy settings the image was clean but when the proxy settings were set to the SME 7.2 box it brought up the image.

I want to get rid of the image from the squid cache but don't know how to do that and I want to stop it from happening again.  Any ideas would be much appreciated.

Regards Brad

Title: Re: porn image in squid cache
Post by: raem on October 16, 2007, 01:31:42 AM

Brad

Answered quite a few times here, search on flush squid cache  or similar.
Did it for you
http://forums.contribs.org/index.php?topic=11077.0
http://forums.contribs.org/index.php?topic=38450.new#new

With sme7.2 this should probably read

sv d /service/squid
echo "" > /var/spool/squid/swap.state
sv u /service/squid

& to check it's running
sv s /service/squid

Title: Re: porn image in squid cache
Post by: bjoyce on October 16, 2007, 03:43:46 AM

Thanks Ray,  :oops:
Should have searched more thoroughly.

Do you have any idea how the image got in my cache?  should i be worried about external attack?

Regards Brad

Title: Re: porn image in squid cache
Post by: raem on October 16, 2007, 05:12:17 AM

bjoyce

> Do you have any idea how the image got in my cache?


Ask your users !!!

Title: Re: porn image in squid cache
Post by: bjoyce on October 17, 2007, 03:27:37 AM

let me rephrase what happened.
A user was searching msn for a sunrise image.  When the browser was set to the proxy the image link went to a porn site.  When the browser was set to no proxy the same search and link produced a sunrise.

How did the porn site link get into the squid cache?

Should I be worried about security?  or is it just a matter of a crosslinked disk cluster.

Brad

Title: Re: porn image in squid cache
Post by: girkers on October 17, 2007, 07:17:45 AM

As Ray stated you need to check your users, cause generally for something to get into the cache a user would have had to go to the page that contained the image.

Title: Re: porn image in squid cache
Post by: bjoyce on October 17, 2007, 08:08:49 AM

Sorry but I don't understand how a link to a sunset without proxy can change to a link to a porn site unless it was changed somehow.  That changing has me worried about the security of the box.

B

Title: Re: porn image in squid cache
Post by: raem on October 17, 2007, 08:41:27 AM

bjoyce

The cache on your server is a memory of sites and pages visited by your users.
So at sometime your users requested the sunset search and got the porn image due to a incorrect search engine result, or in fact your users did surf to the porn image at some time.
It's probably just a wrong search engine result which is still in your cache, or perhaps there is external hijacking of the site going on.

I don't really think any of us can give you a definitive answer of what your system is doing.

Title: Re: porn image in squid cache
Post by: bjoyce on October 17, 2007, 08:53:37 AM

Thanks Ray,
I am reassured, I was worried about the security.

B

Title: Re: porn image in squid cache
Post by: girkers on October 22, 2007, 05:14:22 AM

I came across an resultant image I didn't expect when I did a google image search on the word "sunset" I got a picture of a rather large naked lady sitting on the head of a naked man. Funnily enough the image had the word "sunset" in the file name, so that is just an example of how it could have got there.