Re: [squid-users] Require SSL version 3

Amos,

When I added the option=NO_SSLv2,NO_SSLv3 lines and tried to start squid,
I got a fatal error. It said something about the syntax being wrong on
the line. I took the lines out and tried to start squid and my swap file
got corrupted. I had to rename the swap file and let squid create a new
one. Then it started. Phew!!

Any reason why it wouldn't let me put in the option line? I stuck right
at the end of the https_port line right after the key= definition.

Thanks,

Jack Siergiej

Amos Jeffries <squid3@treenet.co.nz>
01/15/2008 07:41 AM

To
JSiergiej@pennsoftware.com
cc
squid-users@squid-cache.org
Subject
Re: [squid-users] Require SSL version 3

JSiergiej@pennsoftware.com wrote:
>
> Amos,
>
> I am not running the version= on any of the sites right now, I only
> included the version= in the provided code so you can see where I placed

> it and see if there was anything wrong with how I did it. So, answering

> your first question, the outside test is talking about all of the sites.
>
> In terms of further info for the version not working, when I place it in

> my code and launch squid and try to go to the https portion of the site,

> my browser (firefox) told me that the transmission was interrupted. In
> the squid terminal window, I get the following:
>
> clientNegotiateSSL: Error negotiating SSL connection on FD 22: error
> 1408A09F: SSL routines: SSL3_Get_Client_Hello: length mismatch (1/-1)
> clientNegotiateSSL: Error negotiating SSL connection on FD 22:
> error:1408F10B: SSL routines: SSL3_Get_Record: wrong version number
(1/-1)
>
> I have not tried the option=NO_SSLv2,NO_SSLv1. That will be my next
move.
>
> In terms of the upgrade to Squid 2.6STABLE17+ or 3.0STABLE1+, is it an
> easy upgrade or is there alot of configuration involved?

Relatively easy upgrade config-wise. I did not see anything in your
posted lines which was deprecated in 2.6 and killed in 3.0.

There is a short list if you have further config at
http://www.squid-cache.org/Versions/v3/3.0/RELEASENOTES.html#modifiedtags

Amos

>
> Thanks,
>
> Jack Siergiej
>
>
>
>
> *Amos Jeffries <squid3@treenet.co.nz>*
>
> 01/15/2008 02:43 AM
>
>
> To
> JSiergiej@pennsoftware.com
> cc
> squid-users@squid-cache.org
> Subject
> Re: [squid-users] Require SSL version 3
>
>
>
>
>
>
>
>
> JSiergiej@pennsoftware.com wrote:
> > Hello all,
> >
> > I have a client that is requiring the use of only SSL version 3 for
> their
> > websites. When a vulnerability scan is done by an outside firm
against
> > squid, the report states that SSLV2 is allowed and we can't have
that.
>
> Firstly, I see several HTTPS address/port open in the config below.
> Several do not have a version= limit set on them. Are you certain the
> outside test report is not talking about one of those?
>
> >
> > I went to the
> > http://www.squid-cache.org/Versions/v2/2.6/cfgman/https_port.html
> page and
> > tried appending the option "version=3" to the end of my https_port
line
> > for one of the sites (see below), but after I do this, I cannot view
the
> > https portion of the site. It tells me that the page was
> interrupted. If
> > I remove the version=3 line, I am fine.
> >
> > What do I need to do to make each of the sites below only accept
SSLV3
> > connections? Any help would be appreciated.
>
> version not working is a bug. Any further info you can provide would be
> welcome in tracking it down
>
> Secondly, for your production use there are also appear to be the
> alternatives:
> https_port ... option=NO_SSLv2,NO_SSLv1
>
> >
> > # Run Squid in virtual host mode
> > http_port 80 vhost
> >
> > # Client1 reverse proxy config
> > https_port 172.16.0.107:443 protocol=https vhost
> > cert=/usr/local/squid/etc/devstore.pem
> > key=/usr/local/squid/etc/devstore.key version=3
> > cache_peer 192.168.0.7 parent 80 0 no-query originserver
> > name=store.client1.com
> > #acl client1 dstdomain store.client1.com
> > acl client1 dstdomain xxx.xxx.xxx.xxx store.client1.com
> > http_access allow client1
> > cache_peer_access store.client1.com allow client1
> >
> >
> > # Client2 reverse proxy config
> > https_port 172.16.0.111:443 protocol=https
> > cert=/usr/local/squid/etc/ctccert.pem
> key=/usr/local/squid/etc/ctccert.key
> > vhost
>
> no version= there...
>
> > cache_peer 192.168.0.11 parent 80 0 no-query originserver
> > name=store.client2.com
> > acl client2 dstdomain xxx.xxx.xxx.xxx store.client2.com
> > http_access allow client2
> > cache_peer_access store.client2.com allow client2
> >
> > # Client3 reverse proxy config
> > https_port 172.16.0.105:443 protocol=https
> > cert=/usr/local/squid/etc/devstore.pem
> > key=/usr/local/squid/etc/devstore.key vhost
>
> And another missing the version.
>
> > cache_peer 192.168.0.05 parent 80 0 no-query originserver
> > name=store.client3.com
> > acl client3 dstdomain store.client3.com
> > http_access allow client3
> > cache_peer_access store.client3.com allow client3
> >
> > # Client4 reverse proxy config
> > https_port 172.16.0.106:443 protocol=https
> > cert=/usr/local/squid/etc/cycert.pem
key=/usr/local/squid/etc/cycert.key
> > vhost
>
> And another missing the version.
>
> > cache_peer 192.168.0.06 parent 80 0 no-query originserver
> > name=store.client4.com
> > acl client4 dstdomain store.client4.com
> > http_access allow client4
> > cache_peer_access store.client4.com allow client4
> >
> > # Client5 reverse proxy config
> > https_port 172.16.0.120:443 protocol=https
> > cert=/usr/local/squid/etc/opaccess.pem
> > key=/usr/local/squid/etc/opaccess.key vhost
>
> And another missing the version.
>
> > cache_peer 192.168.0.20 parent 443 0 no-query originserver ssl
> > name=store.client5.com
> > acl client5 dstdomain store.client5.com
> > http_access allow client5
> > cache_peer_access store.client5.com allow client5
> >
> >
> >
> > # --- Begin default config options --- #
> >
> > hierarchy_stoplist cgi-bin ?
> >
> > acl QUERY urlpath_regex cgi-bin \?
> > cache deny QUERY
> >
> > acl apache rep_header Server ^Apache
> > broken_vary_encoding allow apache
> >
> > access_log /usr/local/squid/var/logs/access.log squid
> >
> > refresh_pattern ^ftp: 1440 20% 10080
> > refresh_pattern ^gopher: 1440 0% 1440
> > refresh_pattern . 0 20% 4320
> >
> > acl all src 0.0.0.0/0.0.0.0
> > acl manager proto cache_object
> > acl localhost src 127.0.0.1/255.255.255.255
> > acl to_localhost dst 127.0.0.0/8
> > acl SSL_ports port 443
> > acl Safe_ports port 80 # http
> > acl Safe_ports port 21 # ftp
> > acl Safe_ports port 443 # https
> > acl Safe_ports port 70 # gopher
> > acl Safe_ports port 210 # wais
> > acl Safe_ports port 1025-65535 # unregistered ports
> > acl Safe_ports port 280 # http-mgmt
> > acl Safe_ports port 488 # gss-http
> > acl Safe_ports port 591 # filemaker
> > acl Safe_ports port 777 # multiling http
> > acl CONNECT method CONNECT
> > acl TRACE method TRACE
> >
> > # Deny HTTP TRACE method
> > http_access deny TRACE
> > # Only allow cachemgr access from localhost
> > http_access allow manager localhost
> > http_access deny manager
> > # Deny requests to unknown ports
> > http_access deny !Safe_ports
> > # Deny CONNECT to other than SSL ports
> > http_access deny CONNECT !SSL_ports
> > # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
> >
> > # And finally deny all other access to this proxy
> > http_access deny all
> >
> > # and finally allow by default
> > http_reply_access allow all
> >
> > #Allow ICP queries from everyone
> > icp_access allow all
> >
> > # Leave coredumps in the first cache dir
> > coredump_dir /usr/local/squid/var/cache
> >
> > Thanks,
> >
> > Jack Siergiej
> >
>
>
> --
> Please use Squid 2.6STABLE17+ or 3.0STABLE1+
> There are serious security advisories out on all earlier releases.
>

-- 
Please use Squid 2.6STABLE17+ or 3.0STABLE1+
There are serious security advisories out on all earlier releases.