Aeon mike guide transparent ssl filtering
- 1. AEONMike Guide – SQUID 3.3 SSLBUMP under Debian #Michael Cabalin http://www.PH-LWUG.org Pinoy Linux : http://www.facebook.com/groups/117595725078450/ #Install Debian OS #apt-get install build-essential gcc make #wget https://launchpad.net/squid/3.3/3.3.0.3/+download/squid-3.3.0.3.tar.gz #tar xvf squid-3.3.0.3.tar.gz #cd squid-3.3.0.3 ./configure –enable-icap-client –enable-ssl make make install Generate Self Sign • self-signed certificate (pem format) generation : openssl req -new -newkey rsa:1024 -days 3650 -nodes -x509 -keyout your.company.com.pem -out your.company.com • if needed, you can generate the certificate to import on browsers (to avoid the warnings about the security breach) : openssl x509 -in www.yourcompany.com.pem -outform DER -out www.yourcompany.com.der Onto the actual SQUID configuration. Edit the /etc/squid.conf file to show the following: always_direct allow all ssl_bump allow all http_port 192.9.200.32:3128 transparent
- 2. #the below should be placed on a single line https_port 192.9.200.32:3129 transparent ssl-bump cert=/etc/squid/ssl_cert/ your.company.com.pem key=/etc/squid/ssl_cert/private/your.company.com.pem Note you may need to change the “cert=” and the “key=” to point to the correct file in your environment. Also of course you will need to change the IP address The first directive (always_direct) is due to SslBump. By default ssl_bump is set to accelerator mode. In debug logs cache.log you’d see “failed to select source for”. In accelerator mode, the proxy does not know which backend server to use to retrieve the file from, so this directive instructs the proxy to ignore the accelerator mode. More details on this here: The first directive (always_direct) is due to SslBump. By default ssl_bump is set to accelerator mode. In debug logs cache.log you’d see “failed to select source for”. In accelerator mode, the proxy does not know which backend server to use to retrieve the file from, so this directive instructs the proxy to ignore the accelerator mode. More details on this here: http://www.squid-cache.org/Doc/config/always_direct/ The second directive (ssl_bump) instructs the proxy to allow all SSL connections, but this can be modified to restirct access. You can also use the “sslproxy_cert_error” to deny access to sites with invalid certificates. More details on this here: http://wiki.squid-cache.org/Features/SslBump Start squid and check for any errors. If no errors are reported, run: netstat -nap | grep 3129 to make sure the proxy is up and running. Next, configure iptables to perform destination NAT, basically to redirect the traffic to the proxy: iptables -t nat -A PREROUTING -i eth0 -p tcp –dport 80 -j DNAT –to-destination 192.9.200.32:3128 iptables -t nat -A PREROUTING -i eth0 -p tcp –dport 443 -j DNAT –to-destination 192.9.200.32:3129 Last thing to be done was to either place the proxy physically in line with the traffic or to redirect the traffic to the proxy using a router. Keep in mind that the proxy will change the source IP address of the requests to it’s own IP. In other words, by default it does not reflect the client IP. That was it in my case. I did try to implement something similar to the above but using explicit mode. This was my squid.conf file, note only one port is needed for both HTTP and HTTPS since HTTPS is tunneled over HTTP using the CONNECT method:
- 3. always_direct allow all ssl_bump allow all #the below should be placed on a single line http_port 8080 ssl-bump cert=/etc/squid/ssl_cert/proxy.testdomain.deCert.pem key=/etc/squid/ssl_cert/private/proxy.testdomain.deKey_without_Pp.pem SSL Filtering example SQUID.Conf • Squid configuration (squid.conf) : I post here only important parts. acl … acl … # you must have CONNECT acl acl CONNECT method CONNECT acl metrobank dstdomain www.metrobank.com.ph acl securitybank dstdomain www.securitybank.com.ph # maybe not in the future, but we need this : always_direct allow all # permissions sections (allow / deny) http_access allow… http_access allow…
- 4. http_access allow… http_access deny … http_access deny … http_access deny … # some sites need this : sslproxy_cert_error allow metrobank #sslproxy_flags DONT_VERIFY_PEER # ssl_bump means that you want to intercept (MITM) this SSL connection ssl_bump allow metrobank ssl_bump allow securitybank # and we don’t want to intercept others SSL sites : ssl_bump deny all # now, you can tell Squid you want to forbid theses HTTPS url : … http_access allow localnet http_access allow localhost http_access deny all # tell Squid you want to intercept SSL # /! SSL interception is not compatible with transparent proxy # so DON’T write here ‘intercept’ (new name for ‘transparent’) http_port 3128 ssl-bump cert=/path/to/your/self- signed/cert/www.yourcompany.com.pem