RE: [squid-users] squid 3.3.5 http and https transparent proxy

Hi,
 i have this warning when starting ./squid,
 # ./squid
 2013/06/10 08:52:08| SECURITY NOTICE: auto-converting deprecated "ssl_bump allow <acl>" to "ssl_bump client-first <acl>" which is usually inferior to the newer server-first bumping mode. Update your ssl_bump rules.
 squid.conf:
 # cat squid.conf
 #
 # Recommended minimum configuration:
 #
 # Example rule allowing access from your local networks.
 # Adapt to list your (internal) IP networks from where browsing
 # should be allowed
 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
 acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
 acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
 acl localnet src fc00::/7 # RFC 4193 local private network range
 acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
 acl yournet src 192.168.4.0/24
 http_access allow yournet
 acl SSL_ports port 443
 acl Safe_ports port 80 # http
 acl Safe_ports port 21 # ftp
 acl Safe_ports port 443 # https
 acl Safe_ports port 70 # gopher
 acl Safe_ports port 210 # wais
 acl Safe_ports port 1025-65535 # unregistered ports
 acl Safe_ports port 280 # http-mgmt
 acl Safe_ports port 488 # gss-http
 acl Safe_ports port 591 # filemaker
 acl Safe_ports port 777 # multiling http
 acl CONNECT method CONNECT
 #
 # Recommended minimum Access Permission configuration:
 #
 # Deny requests to certain unsafe ports
 http_access deny !Safe_ports
 # Deny CONNECT to other than secure SSL ports
 http_access deny CONNECT !SSL_ports
 # Only allow cachemgr access from localhost
 http_access allow localhost manager
 http_access deny manager
 # We strongly recommend the following be uncommented to protect innocent
 # web applications running on the proxy server who think the only
 # one who can access services on "localhost" is a local user
 #http_access deny to_localhost
 #
 # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
 #
 # Example rule allowing access from your local networks.
 # Adapt localnet in the ACL section to list your (internal) IP networks
 # from where browsing should be allowed
 http_access allow localnet
 http_access allow localhost
 always_direct allow all
 ssl_bump allow all
 # the following two options are unsafe and not always necessary:
 sslproxy_cert_error allow all
 sslproxy_flags DONT_VERIFY_PEER
 # And finally deny all other access to this proxy
 http_access deny all
 # Squid normally listens to port 3128
 http_port 3128 intercept
 https_port 3127 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/usr/local/squid/ssl_cert/myCA.pem
 # Uncomment and adjust the following to add a disk cache directory.
 #cache_dir ufs /usr/local/squid/var/cache/squid 100 16 256
 # Leave coredumps in the first cache dir
 coredump_dir /usr/local/squid/var/cache/squid
 #
 # Add any of your own refresh_pattern entries above these.
 #
 refresh_pattern ^ftp: 1440 20% 10080
 refresh_pattern ^gopher: 1440 0% 1440
 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
 refresh_pattern . 0 20% 4320
 and my # iptables -L -n
 Chain INPUT (policy ACCEPT)
 target prot opt source destination
 Chain FORWARD (policy ACCEPT)
 target prot opt source destination
 Chain OUTPUT (policy ACCEPT)
 target prot opt source destination
 *
 I want this as a proxy to log all traffic JUST for log with VISITED URLs, If you know can propose any other config :)
 *
 Thanks in advance
> From: npf-mlists_at_eurotux.com
> To: squid-users_at_squid-cache.org
> Date: Fri, 7 Jun 2013 17:07:03 +0100
> Subject: Re: [squid-users] squid 3.3.5 http and https transparent proxy
>
>
>> On 8/06/2013 2:39 a.m., MyName IsLive wrote:
>>> Look i just need a server to set it as gateway on all my clients ALL their traffic passing from my server and me can log all the traffic all http, https traffics.
>>>
>>> i already paste all my config i did all changes npf-mlists_at_eurotux.com said, but that is the log file!
>>> i can visit http sites but as i said http://yahoo.com is ok i can visit but when im clicking on other link from inside yahoo.com website i cannot visit "Internet explorer cannot display the webpage" same with chrome and Firefox!
>>>
>>> for https i tries with https://facebook.com not working means this:
>>>
>>>>> 1370611784.763 2407 192.168.4.99 TCP_MISS/200 1376 GET http://www.facebook.com/ - HIER_DIRECT/31.13.86.8 text/html
>>>>> 1370611784.790 0 192.168.4.99 NONE/400 3972 NONE error:invalid-request - HIER_NONE/- text/html
>>>>> 1370611801.238 0 192.168.4.99 NONE/400 3972 NONE error:invalid-request - HIER_NONE/- text/html
>>> i compiled from source code and this is parameter that i passed to configure:
>>> ./configure --enable-ssl --enable-ssl-crtd --enable-linux-netfilter --enable-ltdl-convenienc
>>>
>>> if you need more information that i missed please let me know :)
>>
>> His instructions were not quite correct. You require intercept flag on
>> *both* Squid receiving ports to de-NAT the TCP layer and parse the HTTP
>> origin server message syntax which is used on port 80 and 443. You
>> require ssl-bump flag and the related ssl settings on the https_port to
>> enable proper security handling of intercepted port 443 traffic. The
>> ssl-bump settings usage on the http_port along with intercept is
>> optional, but rarely useful as CONNECT messages on port 80 are undefined.
>
> Yes.. Amos is correct. My mistake.
>
> When i said:
>
>>>>>> Change
>>>>>>
>>>>>> http_port 3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/usr/local/squid/ssl_cert/myCA.pem
>>>>>>
>>>>>> to
>>>>>>
>>>>>> http_port 3128 intercept
>>>>>> https_port 3127 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/usr/local/squid/ssl_cert/myCA.pem
>>>>>>
>
> Should be:
>
> Change
> http_port 3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/usr/local/squid/ssl_cert/myCA.pem
>
> to
>
> http_port 3128 intercept
> https_port 3127 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/usr/local/squid/ssl_cert/myCA.pem
>
> Best regards,
> Nuno Fernandes
Received on Mon Jun 10 2013 - 06:58:53 MDT