You can simplify this quite a bit which might make things clearer. Though please ensure that you are using a current 3.5.19 or later since you are using SSL-Bump feature. Then run "squid -k parse" and erase the obsolete options from your config file. On 23/11/2016 12:40 a.m., chcs wrote: > My squid (3.5.21) conf file: > > http_port 192.168.10.1:3128 ssl-bump generate-host-certificates=on > dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem > capath=/usr/local/share/certs/ > cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS > dhparams=/etc/dh-parameters.2048 options=NO_SSLv2,NO_SSLv3,SINGLE_DH_USE > > http_port 5.5.5.1:3128 ssl-bump generate-host-certificates=on > dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem > capath=/usr/local/share/certs/ > cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS > dhparams=/etc/dh-parameters.2048 options=NO_SSLv2,NO_SSLv3,SINGLE_DH_USE > > http_port 127.0.0.1:3128 intercept ssl-bump generate-host-certificates=on > dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem > capath=/usr/local/share/certs/ > cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS > dhparams=/etc/dh-parameters.2048 options=NO_SSLv2,NO_SSLv3,SINGLE_DH_USE > > https_port 127.0.0.1:3129 intercept ssl-bump generate-host-certificates=on > dynamic_cert_mem_cache_size=10MB cert=/usr/local/etc/squid/serverkey.pem > capath=/usr/local/share/certs/ > cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS > dhparams=/etc/dh-parameters.2048 options=NO_SSLv2,NO_SSLv3,SINGLE_DH_USE > For all of the above; * you have not configured an EC cipher to use (tls-dh= option) - so none of the ECDHE ciphers will work * you have disabled DES - so none of the DES ciphers will work * you have disables RC4 - so none of the RC4 ciphers will work Please run the comand: openssl ciphers -v \ 'EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS' \ | grep -v EC to see what ciphers your Squid machine actually has available after that reduction. > icp_port 0 > dns_v4_first on > pid_filename /var/run/squid/squid.pid > cache_effective_user squid > cache_effective_group proxy > error_default_language es > icon_directory /usr/local/etc/squid/icons > visible_hostname chcs > cache_mgr chca@xxxxxxxxxxx > access_log /var/squid/logs/access.log > cache_log /var/squid/logs/cache.log > cache_store_log none > netdb_filename /var/squid/logs/netdb.state > pinger_enable on > pinger_program /usr/local/libexec/squid/pinger Most of the above are default values. Check them against your Squid version documentation and remove the ones that actually are default. <http://www.squid-config.org/Doc/config/> > sslcrtd_program /usr/local/libexec/squid/ssl_crtd -s /var/squid/lib/ssl_db > -M 4MB -b 2048 > sslcrtd_children 5 > sslproxy_capath /usr/local/share/certs/ > sslproxy_options NO_SSLv2,NO_SSLv3,SINGLE_DH_USE > sslproxy_cipher > EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:HIGH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS > Similar problem as with the ports. Only the EC ciphers should work here because client does not need to configure a cipher. > logfile_rotate 10 > debug_options rotate=10 Above are more defaults you can remove. > shutdown_lifetime 3 seconds > # Allow local network(s) on interface(s) > acl localnet src 192.168.10.0/24 5.5.5.0/24 Your LAN contains global IP address space 5.5.5.0/24? > forwarded_for on > via off > httpd_suppress_version_string on > uri_whitespace strip > > acl dynamic urlpath_regex cgi-bin \? > cache deny dynamic You already have the required refresh_pattern to handle these objects correctly. You may want to consider removing the above two lines. > > cache_mem 1200 MB > maximum_object_size_in_memory 256 KB > memory_replacement_policy heap GDSF > cache_replacement_policy heap LFUDA > minimum_object_size 0 KB > maximum_object_size 50 MB > cache_dir aufs /var/squid/cache 128000 32 256 These... > offline_mode off > cache_swap_low 90 > cache_swap_high 95 > cache allow all ... are more unnecessary defaults. > # Add any of your own refresh_pattern entries above these. > refresh_pattern ^ftp: 1440 20% 10080 > refresh_pattern ^gopher: 1440 0% 1440 > refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 > refresh_pattern . 0 20% 4320 > If you actually read the text in the comments below you will see that most of these lines can be erased from your config file: > # Setup some default acls > # From 3.2 further configuration cleanups have been done to make things > easier and safer. The manager, localhost, and to_localhost ACL definitions > are now built-in. > # acl localhost src 127.0.0.1/32 > acl allsrc src all > acl safeports port 21 70 80 210 280 443 > acl sslports port 443 563 8500 443 563 > > # From 3.2 further configuration cleanups have been done to make things > easier and safer. The manager, localhost, and to_localhost ACL definitions > are now built-in. > #acl manager proto cache_object > NP: the "allsrc" ACL is pointless. "all" works just fine still. It is built-in too. ... leaving you with just: acl safeports port 21 70 80 210 280 443 acl sslports port 443 563 8500 443 563 (though why you rename the default Safe_ports and SSL_ports ACLs is beyond me). > acl purge method PURGE > acl connect method CONNECT > > # Define protocols used for redirects > acl HTTP proto HTTP > acl HTTPS proto HTTPS > acl allowed_subnets src 192.168.10.0/24 5.5.5.0/24 So "allowed_subnets" is identical to localnet. Replace all 0 uses of "allowed_subnets" with "localnet" and remove the above line. Current recommendations are to move all these manager and purge: > http_access allow manager localhost > http_access deny manager > http_access allow purge localhost > http_access deny purge ... from here ... > http_access deny !safeports > http_access deny CONNECT !sslports ... down to here after the quicker port checks have blocked attacks. Also, your Squid does not appear to be doing anything that would make you need PURGE functionality. You can remove the purge stuff and your Squid will work a bit faster and with less memory. > > request_body_max_size 0 KB > delay_pools 1 > delay_class 1 2 > delay_parameters 1 -1/-1 -1/-1 > delay_initial_bucket_level 100 > delay_access 1 allow allsrc The delay pool feature is doing nothing for your Squid except wasting CPU time and memory. Erase all the above delay pool lines. > > always_direct allow all Unnecessary old hack for Squid-3.1 SSL-Bump. Remove the above line. If you are still using Squid-3.1 upgrade *urgently*. > > # Determina IPs para todopermitido > acl todopermitido src "/usr/local/etc/squid/reglas/todopermitido.ips" > > # Determina IPs para parcialpermitido > acl parcialpermitido src "/usr/local/etc/squid/reglas/parcialpermitido.ips" > > # Determina IPs para dhcp_lanwifi > acl dhcp_lanwifi src "/usr/local/etc/squid/reglas/dhcp_lanwifi.ips" > parcialpermitido and dhcp_lanwifi are of the same type and the rules applied to both are identical. You can simplify quite a bit by loading them into the same ACL check. Liks this: # Determina IPs para parcialpermitido acl parcialpermitido src "./parcialpermitido.ips" # Determina IPs para dhcp_lanwifi acl parcialpermitido src "./dhcp_lanwifi.ips" ... then removing all other lines mentioning "dhcp_lanwifi". > # Reglas para permitidos > acl permitidos dstdomain "/usr/local/etc/squid/reglas/permitidos.acl" > > # Reglas para no permitidos > acl nopermitidos dstdomain "/usr/local/etc/squid/reglas/nopermitidos.acl" > > # Determina archivos no permitidos para descargar > acl extNO urlpath_regex -i "/usr/local/etc/squid/reglas/extNO.acl" > > # Accesos > > # Permisos para IPs "todopermitido" > # http_reply_access allow todopermitido skype > # http_reply_access allow todopermitido skypeIP > http_access deny todopermitido sxl > http_access deny todopermitido adsNO "sxl" is not defined. "adsNO" is also not defined. Are you sure this is actually the config being run by your Squid? > http_reply_access allow todopermitido all Use of "all" is pointless here. Replace with: http_reply_access allow todopermitido > > # Permisos para IPs "parcialpermitido" > http_access deny parcialpermitido adsNO > http_access deny parcialpermitido extNO > http_reply_access allow parcialpermitido permitidos > http_reply_access deny parcialpermitido nopermitidos > > # Permisos para IPs "dhcp_lanwifi" > http_access deny dhcp_lanwifi adsNO > http_access deny dhcp_lanwifi extNO > http_reply_access allow dhcp_lanwifi permitidos > http_reply_access deny dhcp_lanwifi nopermitidos > Since the next thing done is "deny all" you can remove all the liens involving "nopermitidos". It is a waste of CPU cycles checking. > # Sitios no SSL interceptados > acl step1 at_step SslBump1 > acl excludeSSL ssl::server_name_regex > "/usr/local/etc/squid/reglas/nossl.acl" > ssl_bump peek step1 > ssl_bump splice todopermitido excludeSSL > ssl_bump splice parcialpermitido excludeSSL > ssl_bump splice dhcp_lanwifi excludeSSL > ssl_bump bump all > > # Deniega todo por defecto > http_reply_access deny all > Your http_access rules look very bad. You have just the default rule of "what is not denied explicitly is allowed". So any visitor who is _not_ part of your todopermitido, parcialpermitido, and dhcp_lanwifi files *is* allowed access to do whatever the like with your proxy. Also, any of the clients listed there is allowed to do anything they like that is not explicitly forbidden. Also, denying dstdomain, src, urlpath_* things at reply time is far too late. All the badness they may be doing has already completed by the time a reply starts coming back to Squid from the server. So I advise re-writing your access rules as: http_access deny !safeports http_access deny CONNECT !sslports http_access allow localhost http_access deny manager http_access deny !localnet http_access deny todopermitido sxl http_access deny todopermitido adsNO http_access allow todopermitido http_access deny parcialpermitido adsNO http_access deny parcialpermitido extNO http_access allow parcialpermitido permitidos http_access deny all NP: You may find there are things that have been happening that are not allowed anymore with that. If you want them to keep happening add rules to allow them. As you your infobae problem. It might be a sie effect of that weird permissions setup. But I think it is more likely to be certificate pinning done by your browser, or the restricted set of ciphers you are using. Amos _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
