Hey Roee,
>From what I remember the best solution would be to use an eCAP module in the long term.
You can use the debug_options and it will work good.
The main issue with this is the DISK IO.
If you do have beefy hardware and SSD+RAM on the machine then the debug_options might be good enough for you.
But the most important thing is to test and verify if it works in your specific environment.
All The Bests,
Eliezer
----
Eliezer Croitoru
Tech Support
Mobile: +972-5-28704261
Email: ngtech1ltd@xxxxxxxxx
-----Original Message-----
From: squid-users <squid-users-bounces@xxxxxxxxxxxxxxxxxxxxx> On Behalf Of Amos Jeffries
Sent: Tuesday, November 17, 2020 2:09 AM
To: squid-users@xxxxxxxxxxxxxxxxxxxxx
Subject: Re: Gather POST request on HTTPS traffic?
On 17/11/20 12:14 pm, roee klinger wrote:
> Hello everyone,
>
> I work at a digital agency that has quite a few machines that are
> managing some Instagram accounts, they are all running in the same LAN
> and we are using Squid as a proxy to log and analyze some usage
> statistics and to make sure the machines are only used for Instagram.
>
> We had an idea to use Squid to capture the POST data of users on the
> proxy level, for example, likes, follows, comments, etc so we can log
> and analyze everything in a convenient central way, so we can analyze it
> and even send out clients a monthly report of all the actions their
> accounts made (who they followed, what they liked, etc).
>
> I can easily see the requests that I want to capture inside the
> "network" tab in Chrome but the problem is that Instagram uses HTTPS, so
> I can't seem to be able to capture this data.
>
>
> Is there any way for me to log this data via Squid using the POST data
> or any other way?
>
Access to HTTPS transactions for a domain you do not own requires the
SSL-Bump feature to decrypt ("bump") the TLS layer.
see <https://wiki.squid-cache.org/Features/SslPeekAndSplice>.
You could use cache.log with "debug_options ALL,1 11,2" configured to
log the transactions. However an ICAP service or eCAP module that does
both the record and analyze for you is probably better.
>
> Note: We are aware of the legal issues, all machines connected to the
> network are company property, and all the accounts are client accounts
> that allow us to gather statistics. No personal account data will be
> gathered.
Please be aware:
That statement conflicts with the stated purpose(s) of your plan.
Personal data *will* be part of the messages you are decrypting and
recording for analysis. Further, to perform targeted reports such as
described you must also associate the data with accounts somehow.
Amos
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
