Qubes/core-agent-linux
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
e52f4f1341
core-agent-linux/network/tinyproxy-updates.conf

30 lines
724 B
Plaintext
Raw Normal View History

vm: qubes-yum-proxy service (#568) Introduce proxy service, which allow only http(s) traffic to yum repos. The filter rules are based on URL regexp, so it isn't full-featured content inspection and can be easy bypassed, but should be enough to prevent some erroneus user actions (like clicking on invalid link). It is set up to intercept connections to 10.137.255.254:8082, so VM can connect to this IP regardless of VM in which proxy is running. By default it is started in every NetVM, but this can be changed using qvm-service or qubes-manager (as always).
2012-05-31 02:24:49 +02:00
User tinyproxy
Group tinyproxy
Port 8082
Timeout 60
DefaultErrorFile "/usr/share/tinyproxy/default.html"
#StatHost "tinyproxy.stats"
StatFile "/usr/share/tinyproxy/stats.html"
Syslog On
LogLevel Notice
updates-proxy: use separate directory for PID file And also use systemd-tmpfiles for that directory creation. Fixes QubesOS/qubes-issues#1401
2015-11-11 05:39:30 +01:00
PidFile "/var/run/tinyproxy-updates/tinyproxy.pid"
vm: qubes-yum-proxy service (#568) Introduce proxy service, which allow only http(s) traffic to yum repos. The filter rules are based on URL regexp, so it isn't full-featured content inspection and can be easy bypassed, but should be enough to prevent some erroneus user actions (like clicking on invalid link). It is set up to intercept connections to 10.137.255.254:8082, so VM can connect to this IP regardless of VM in which proxy is running. By default it is started in every NetVM, but this can be changed using qvm-service or qubes-manager (as always).
2012-05-31 02:24:49 +02:00
MaxClients 50
MinSpareServers 2
MaxSpareServers 10
StartServers 2
MaxRequestsPerChild 0
updates-proxy: Disable 'Via: tinyproxy' header Fixes QubesOS/qubes-issues#1187
2015-10-05 06:24:30 +02:00
DisableViaHeader Yes
vm: qubes-yum-proxy service (#568) Introduce proxy service, which allow only http(s) traffic to yum repos. The filter rules are based on URL regexp, so it isn't full-featured content inspection and can be easy bypassed, but should be enough to prevent some erroneus user actions (like clicking on invalid link). It is set up to intercept connections to 10.137.255.254:8082, so VM can connect to this IP regardless of VM in which proxy is running. By default it is started in every NetVM, but this can be changed using qvm-service or qubes-manager (as always).
2012-05-31 02:24:49 +02:00
Allow 127.0.0.1
Allow 10.137.0.0/16
ConnectPort 443
updates-proxy: explicitly block connection looping back to the proxy IP Explicitly block something like "curl http://10.137.255.254:8082" and return error page in this case. This error page is used in Whonix to detect if the proxy is torrified. If not blocked, it may happen that empty response is returned instead of error. See linked ticket for details. Fixes QubesOS/qubes-issues#1482
2015-12-04 14:57:07 +01:00
# Explicitly block connections to the proxy IP, to return an error in such
# case. This error page contains a magic string which is used in Whonix to
# detect whether proxy is torified or not.
# See https://github.com/qubesos/qubes-issues/issues/1482 for details
Filter "/etc/tinyproxy/updates-blacklist"
Reference in New Issue Copy Permalink