Tinyproxy on Ubuntu 24.04 LTS

Tinyproxy is a small, fast, low footprint HTTP and HTTPS forward proxy daemon. It sits between clients and the wider web, forwarding outbound requests while applying access control over which clients may use it. This cloudimg image runs Tinyproxy 1.11.1 on Ubuntu 24.04 LTS, configured as a responsible, secure by default forward proxy for a lightweight outbound web gateway, a jump host proxy, or controlled egress in a private network where a full caching proxy would be overkill.

Security is built in as a non open proxy, with two independent locks. First, source address ACLs: the proxy answers only the machine itself and hosts on private RFC1918 ranges, and every other source, including the public internet, is refused. There is deliberately no allow all rule. Second, mandatory HTTP Basic proxy authentication: every request must carry a valid username and password, so even a client on an allowed subnet is refused unless it authenticates, returning HTTP 407. CONNECT tunnels are restricted to TLS ports only, and the Via header is disabled to reduce information leakage.

No proxy password is baked into the image. On first boot the VM generates a unique per VM password and writes it to a root only credentials file, so every VM you deploy gets its own password and there is no default credential to leak. A shipped self test tool proves an anonymous request is refused with HTTP 407 and an authenticated request succeeds with HTTP 200.

Tinyproxy is distributed under the GNU General Public License version 2, free and open source with no per CPU or per deployment fee. cloudimg is not affiliated with or endorsed by the Tinyproxy project. cloudimg provides packaging, secure by default hardening, per VM authentication, security patching, and 24/7 support with a guaranteed 24 hour response SLA.