Search squid archive

Re: Squid Explicit Proxying

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 

First, thank you very much for your help, you re awesome !

I can in fact browse HTTP pages, but not HTTPS.

Can i ask you a bit more help :) ?

I applied some changes :
Regarding the certificate, i read the man page http://man.openbsd.org/ssl 
cd /etc/squid
openssl genrsa -out squid.key 4096
openssl req -new -key squid.key -out squid.csr
openssl x509 -sha256 -req -days 365 -in squid.csr -signkey squid.key -out squid.crt 
cat squid.crt squid.key > squid.pem
chown _squid:_squid *.pem
chmod 700 *.pem
openssl x509 -in squid.pem -outform DER -out browser.der
Now when i try : curl --proxy http://127.0.0.1:3128 --cacert /etc/squid/squid.pem -l https://www.google.com I get : curl: (60) SSL certificate problem: unable to get local issuer certificate...
On the Windows 10 laptop, i configured the proxy using inetcpl.cpl see attached screenshot (IE options). I also added the browser.der to root certification in the snap certmgr.msc (see attached screenshot).
On Firefox, I get SEC_ERROR_UNKNOWN_ISSUER when trying to browse https website. On Chrome, I get ERR_CONNECTION_CLOSED when trying to browse https website. 

HTTP website is OK.

I enabled the debug in squid.conf like you suggested me :)

Here the squid -k parse :

  --8<--

obsd-proxy# squid -k parse
2020/08/26 10:35:44| Startup: Initializing Authentication Schemes ...
2020/08/26 10:35:44| Startup: Initialized Authentication Scheme 'basic'
2020/08/26 10:35:44| Startup: Initialized Authentication Scheme 'digest'
2020/08/26 10:35:44| Startup: Initialized Authentication Scheme 'negotiate' 
2020/08/26 10:35:44| Startup: Initialized Authentication Scheme 'ntlm'
2020/08/26 10:35:44| Startup: Initialized Authentication.
2020/08/26 10:35:44| Processing Configuration File: /etc/squid/squid.conf (depth 0) 
2020/08/26 10:35:44| Processing: debug_options ALL,5
2020/08/26 10:35:44| Processing: acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN) 2020/08/26 10:35:44| Processing: acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN) 2020/08/26 10:35:44| Processing: acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN) 2020/08/26 10:35:44| Processing: acl localnet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines 2020/08/26 10:35:44| Processing: acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN) 2020/08/26 10:35:44| Processing: acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN) 2020/08/26 10:35:44| Processing: acl localnet src fc00::/7 # RFC 4193 local private network range 2020/08/26 10:35:44| Processing: acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines 
2020/08/26 10:35:44| Processing: acl SSL_ports port 443
2020/08/26 10:35:44| Processing: acl Safe_ports port 80          # http
2020/08/26 10:35:44| Processing: acl Safe_ports port 21          # ftp
2020/08/26 10:35:44| Processing: acl Safe_ports port 443         # https
2020/08/26 10:35:44| Processing: acl Safe_ports port 70 # gopher 
2020/08/26 10:35:44| Processing: acl Safe_ports port 210         # wais
2020/08/26 10:35:44| Processing: acl Safe_ports port 1025-65535 # unregistered ports 2020/08/26 10:35:44| Processing: acl Safe_ports port 280 # http-mgmt 2020/08/26 10:35:44| Processing: acl Safe_ports port 488 # gss-http 2020/08/26 10:35:44| Processing: acl Safe_ports port 591 # filemaker 2020/08/26 10:35:44| Processing: acl Safe_ports port 777 # multiling http 
2020/08/26 10:35:44| Processing: acl CONNECT method CONNECT
2020/08/26 10:35:44| Processing: http_access deny !Safe_ports
2020/08/26 10:35:44| Processing: http_access deny CONNECT !SSL_ports
2020/08/26 10:35:44| Processing: http_access allow localhost manager
2020/08/26 10:35:44| Processing: http_access deny manager
2020/08/26 10:35:44| Processing: acl bad_urls urlpath_regex -i "/etc/squid/bad_urls" 2020/08/26 10:35:44| Processing: acl bad_domains dstdomain "/etc/squid/bad_domains" 
2020/08/26 10:35:44| Processing: http_access deny bad_urls
2020/08/26 10:35:44| Processing: http_access deny bad_domains
2020/08/26 10:35:44| Processing: http_access allow localnet
2020/08/26 10:35:44| Processing: http_access allow localhost
2020/08/26 10:35:44| Processing: http_access deny all
2020/08/26 10:35:44| Processing: http_port 3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB tls-cert=/etc/squid/squid.pem 
2020/08/26 10:35:44| Processing: acl step1 at_step SslBump1
2020/08/26 10:35:44| Processing: ssl_bump peek step1
2020/08/26 10:35:44| Processing: acl step2 at_step SslBump2
2020/08/26 10:35:44| Processing: ssl_bump stare step2
2020/08/26 10:35:44| Processing: ssl_bump bump all
2020/08/26 10:35:44| Processing: sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/ssl_db -M 4MB 
2020/08/26 10:35:44| Processing: sslcrtd_children 5
2020/08/26 10:35:44| Processing: sslproxy_cert_sign signTrusted
2020/08/26 10:35:44| Processing: coredump_dir /var/squid/cache
2020/08/26 10:35:44| Processing: refresh_pattern ^ftp: 1440 20% 10080 2020/08/26 10:35:44| Processing: refresh_pattern ^gopher: 1440 0% 1440 2020/08/26 10:35:44| Processing: refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 2020/08/26 10:35:44| Processing: refresh_pattern . 0 20% 4320 
2020/08/26 10:35:44| Processing: cache_mgr informatique@xxxxxx
2020/08/26 10:35:44| Initializing https:// proxy context
2020/08/26 10:35:44| Initializing http_port [::]:3128 TLS contexts
2020/08/26 10:35:44| Using certificate in /etc/squid/squid.pem
2020/08/26 10:35:44| Using certificate chain in /etc/squid/squid.pem
2020/08/26 10:35:44| Adding issuer CA: ...CN=proxy.lab.local...
2020/08/26 10:35:44| Using key in /etc/squid/squid.pem
2020/08/26 10:35:44| Initializing http_port 0.0.0.0:3128 TLS contexts
2020/08/26 10:35:44| Using certificate in /etc/squid/squid.pem
2020/08/26 10:35:44| Using certificate chain in /etc/squid/squid.pem
2020/08/26 10:35:44| Adding issuer CA: ...CN=proxy.lab.local...
2020/08/26 10:35:44| Using key in /etc/squid/squid.pem
2020/08/26 10:35:44.677| 20,5| src/store.cc(352) ~StoreEntry: StoreEntry destructed, this=0x4b943c9abb0 2020/08/26 10:35:44.678| 83,5| src/security/PeerOptions.h(112) operator(): SSL_CTX destruct, this=0x4bb9e638b00 2020/08/26 10:35:44.686| 83,5| src/security/PeerOptions.h(112) operator(): SSL_CTX destruct, this=0x4bc0acfac80 2020/08/26 10:35:44.686| 83,5| src/security/PeerOptions.h(112) operator(): SSL_CTX destruct, this=0x4bb4a362600 

  -->8--

squid.conf, now looks like :

  --8<--

debug_options ALL,5

#
# Recommended minimum configuration:
#

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 0.0.0.1-0.255.255.255  # RFC 1122 "this" network (LAN)
acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN) acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN) acl localnet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN) acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN) acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines 

acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT

#
# Recommended minimum Access Permission configuration:
#
# Deny requests to certain unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#

acl bad_urls urlpath_regex -i "/etc/squid/bad_urls"
acl bad_domains dstdomain "/etc/squid/bad_domains"

http_access deny bad_urls
http_access deny bad_domains

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost

# And finally deny all other access to this proxy
http_access deny all

# Squid normally listens to port 3128
http_port 3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB \ 
  tls-cert=/etc/squid/squid.pem

acl step1 at_step SslBump1
ssl_bump peek step1
acl step2 at_step SslBump2
ssl_bump stare step2
ssl_bump bump all
sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/ssl_db -M 4MB 

sslcrtd_children 5
sslproxy_cert_sign signTrusted

# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /var/squid/cache 100 16 256

# Leave coredumps in the first cache dir
coredump_dir /var/squid/cache

#
# Add any of your own refresh_pattern entries above these.
#
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

cache_mgr informatique@lab.local

  --8<--


Le 2020-08-26 09:36, Amos Jeffries a écrit :

On 25/08/20 10:35 pm, Eric F. wrote:
FYI, LibreSSL is not formally supported due to the number of behavioural 
differences it now has with OpenSSL. SSL-Bump is a mix of custom Squid
code and relatively low-level calls into OpenSSL. While LibreSSL usually builds, we cannot guarantee those low-level calls do what SSL-Bump expects.
Which Linux distribution do you advise me ?? Do i need to forget OpenBSD ? 


Thank you so much!

Attachment: cert-added.png
Description: PNG image

Attachment: config-proxy-10.png
Description: PNG image

_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux