UNSTABLE / INCOMPLETE guide dueto time shortage.
probably it will be replaced with squid 3.2 with ssl support and dynamic cert geenration
The aim of writing this basic howto is to find methods in SQUID to inspect SSL / HTTPS traffic at very minimum level. In this method, The SQUID will act as a MITM (man in the middle). The aim behind doing this config is to decrypt HTTPS connections to apply content filtering which is usually not possible with traditional http methods.
Please be aware that RIPPING and decrypting HTTPS is fundamentally against the reasons for using HTTPS. HTTPS is designed for secure connectivity and privacy. Since secure HTTP connections are encrypted SSL sessions between your browser and the secure site, and are meant to be reliably secure. Your users will not trust you if you use it without proper implementation. Every SSL request to the HTTPS site will present an invalid certificate window. Users will get a certificate miss match with the SSL enabled sites they try to visit. They will have to add exceptions to trust the self-signed cert from above for each site (This bump can be covered by a workaround but I will NOT go in that detail for some reasons)
Also if you are ripping SSL traffic, You’re exposing yourself to potential lawsuits for doing ripping user private stuff and possible hacking purposes.
IMPO, This approach is OK for content filtering purposes or for government surveillance or only according to law . There are methods to bypass CERTIFICATE mismatching and via using iptables nat, you can do transparent redirection of 443 to your proxy.
↓
↓
Compiling SQUID by source code with –enable-ssl
Update apt and install few required packages by following
apt-get update apt-get install -y build-essential libssl-dev fakeroot devscripts gawk gcc-multilib dpatch
Now create temporary directory where we will download squid source packages for compilation.
mkdir /temp cd /temp wget ftp://artfiles.org/squid-cache.org/pub/archive/3.1/squid-3.1.19.tar.gz tar zxvf squid-3.1.19.tar.gz cd squid-3.1.19/
Now compile squid with –enable-ssl option
#===========
#For 64bit =
#===========
./configure \ --prefix=/usr \ --exec_prefix=/usr \ --bindir=/usr/sbin \ --sbindir=/usr/sbin \ --libexecdir=/usr/lib/squid \ --sysconfdir=/etc/squid \ --localstatedir=/var/spool/squid \ --datadir=/usr/share/squid \ --enable-async-io=24 \ --with-aufs-threads=24 \ --with-pthreads \ --enable-storeio=aufs \ --enable-linux-netfilter \ --enable-arp-acl \ --enable-epoll \ --enable-removal-policies=heap,lru \ --with-aio --with-dl \ --enable-snmp \ --enable-delay-pools \ --enable-htcp \ --enable-cache-digests \ --disable-unlinkd \ --enable-large-cache-files \ --with-large-files \ --enable-err-languages=English \ --enable-default-err-language=English --with-maxfd=65536 \ --enable-carp \ --enable-ssl \ --enable-follow-x-forwarded-for \ --with-maxfd=65536 \ 'amd64-debian-linux' 'build_alias=amd64-debian-linux' 'host_alias=amd64-debian-linux' 'target_alias=amd64-debian-linux' 'CFLAGS=-Wall -g -O2' 'LDFLAGS=-Wl,-Bsymbolic-functions' 'CPPFLAGS='
Now install it
make make install
Now edit SQUID CONFIG file and paste the following (remove all old entries, make sure to backup original config file for alter retrieval for backup purposes)
nano /etc/squid/squid.conf
Paste Following SAMPLE config file.
# SQUID 3.1.19 CONFIG FILE FOR SSL FILTERING [ Zaib]
# Thsi file also contains many other JUNK ENTRIES FOR CACHING with some VIDEOCACHE entries,
# Remove them if not required
# By - Syed Jahanzaib
# Email: aacable@hotmail.com
# Web : http://aacable.wordpress.com
# SSL BUMP
always_direct allow all
ssl_bump allow all
# PORT OPTIONS. for http and https
# Repalce the IP 10.0.0.1 as per your local squid box ip
http_port 8080
http_port 10.0.0.1:8081 ssl-bump cert=/etc/squid3/cert/squid.pem key=/etc/squid3/cert/squid.pem
# for videocache, not required for general setup
acl vc_deny_url url_regex -i \.blip\.tv\/(.*)filename \.hardsextube\.com\/videothumbs \.xtube\.com\/(.*)(Thumb|videowall)
acl vc_url url_regex -i \/youku\/[0-9A-Z]+\/[0-9A-Z\-]+\.(flv|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg)
acl vc_url url_regex -i \/(.*)key=[a-z0-9]+(.*)\.flv
acl vc_url url_regex -i \.(youtube|youtube-nocookie)\.com\/feeds\/api\/videos\/[0-9a-zA-Z_-]{11}\/
acl vc_url url_regex -i \.(youtube|youtube-nocookie)\.com\/(videoplayback|get_video|watch|watch_popup|user_watch)\?
acl vc_url url_regex -i \.(youtube|youtube-nocookie)\.com\/(v|e|embed)\/[0-9a-zA-Z_-]{11}
acl vc_dom_r dstdom_regex -i msn\..*\.(com|net)
acl vc_dom_r dstdom_regex -i msnbc\..*\.(com|net)
acl vc_dom_r dstdom_regex -i video\..*\.fbcdn\.net
acl vc_dom_r dstdom_regex -i myspacecdn\..*\.footprint\.net
acl vc_dom dstdomain .stream.aol.com .videos.5min.com msn.com .blip.tv .vid.ec.dmcdn.net .break.com .vimeocdn.com
acl vc_dom dstdomain .cdn.turner.com .dailymotion.com .c.wrzuta.pl .v.imwx.com .mccont.com .myspacecdn.com
acl vc_dom dstdomain .hardsextube.com .public.extremetube.phncdn.com .redtubefiles.com .video.pornhub.phncdn.com
acl vc_dom dstdomain .public.keezmovies.com .public.keezmovies.phncdn.com .slutload-media.com .public.spankwire.com .xtube.com
acl vc_dom dstdomain .public.youporn.phncdn.com .xvideos.com .tube8.com .public.spankwire.phncdn.com .pornhub.com
refresh_pattern \.youtube\.com\/videoplayback\? 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern stream\.aol\.com\/(.*)/[a-zA-Z0-9]+\/(.*)\.(flv|mp4) 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern videos\.5min\.com\/(.*)/[0-9_]+\.(mp4|flv) 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern proxy[a-z0-9\-]?[a-z0-9]?[a-z0-9]?[a-z0-9]?\.dailymotion\.com\/(.*)\.(flv|on2|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg) 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern vid\.akm\.dailymotion\.com\/(.*)\.(flv|on2|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg) 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern vid\.ec\.dmcdn\.net\/(.*)\.(flv|on2|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg) 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern video\.(.*)\.fbcdn\.net\/(.*)/[0-9_]+\.(mp4|flv|avi|mkv|m4v|mov|wmv|3gp|mpg|mpeg) 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern (.*)\.myspacecdn\.com\/(.*)\/[a-zA-Z0-9]+\/vid\.(flv|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg) 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern (.*)\.myspacecdn\.(.*)\.footprint\.net\/(.*)\/[a-zA-Z0-9]+\/vid\.(flv|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg) 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern c\.wrzuta\.pl\/wv[0-9]+\/[a-z0-9]+/[0-9]+/ 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern c\.wrzuta\.pl\/wa[0-9]+\/[a-z0-9]+ 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern vs[a-z0-9]?[a-z0-9]?[a-z0-9]?\.hardsextube\.com\/(.*)\/(.*)\.(flv|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg) 120 80% 180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
acl vc_deny_url url_regex -i crossdomain.xml
acl vc_method method GET
acl vc_header req_header X-Requested-With -i videocache
url_rewrite_access deny !vc_method
url_rewrite_access deny vc_header
url_rewrite_access deny vc_deny_url
url_rewrite_access allow vc_dom
url_rewrite_access allow vc_url
url_rewrite_access allow vc_dom_r
url_rewrite_bypass on
strip_query_terms off
maximum_object_size 1 GB
# If you want to enable DATE time n SQUID Logs,use following
emulate_httpd_log on
logformat squid %tl %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt
log_fqdn off
# 1 year = 525600 mins, 1 month = 43800 mins
refresh_pattern imeem.*\.flv 0 0% 0 override-lastmod override-expire
refresh_pattern \.rapidshare.*\/[0-9]*\/.*\/[^\/]* 161280 90% 161280 ignore-reload
refresh_pattern (get_video\?|videoplayback\?|videodownload\?|\.flv?) 10800 80% 10800 ignore-no-cache ignore-private override-expire override-lastmod reload-into-ims
refresh_pattern (get_video\?|videoplayback\?id|videoplayback.*id|videodownload\?|\.flv?) 10800 80% 10800 ignore-no-cache ignore-private override-expire override-lastmod reload-into-ims
#refresh_pattern -i (get_video\?|videoplayback\?id|videoplayback.*id||videodownload\?|\.flv?) 10800 80% 10800 ignore-no-cache ignore-private override-expire override-lastmod reload-into-ims
refresh_pattern \.(ico|video-stats) 10800 80% 10800 override-expire ignore-reload ignore-no-cache ignore-private ignore-auth override-lastmod
refresh_pattern \.etology\? 10800 80% 10800 override-expire ignore-reload ignore-no-cache
refresh_pattern galleries\.video(\?|sz) 10800 80% 10800 override-expire ignore-reload ignore-no-cache
refresh_pattern brazzers\? 10800 80% 10800 override-expire ignore-reload ignore-no-cache
refresh_pattern \.adtology\? 10800 80% 10800 override-expire ignore-reload ignore-no-cache
#refresh_pattern ^.*(utm\.gif|ads\?|rmxads\.com|ad\.z5x\.net|bh\.contextweb\.com|bstats\.adbrite\.com|a1\.interclick\.com|ad\.trafficmp\.com|ads\.cubics\.com|ad\.xtendmedia\.com|\.googlesyndication\.com|advertising\.com|yieldmanager|game-advertising\.com|pixel\.quantserve\.com|adperium\.com|doubleclick\.net|adserving\.cpxinteractive\.com|syndication\.com|media.fastclick.net).* 10800 20% 10800 ignore-no-cache ignore-private override-expire ignore-reload ignore-auth negative-ttl=40320 max-stale=10
refresh_pattern ^.*safebrowsing.*google 10800 80% 10800 override-expire ignore-reload ignore-no-cache ignore-private ignore-auth
refresh_pattern ^http://((cbk|mt|khm|mlt)[0-9]?)\.google\.co(m|\.uk) 10800 80% 10800 override-expire ignore-reload ignore-private
refresh_pattern ytimg\.com.*\.jpg 10800 80% 10800 override-expire ignore-reload
refresh_pattern images\.friendster\.com.*\.(png|gif) 10800 80% 10800 override-expire ignore-reload
refresh_pattern garena\.com 10800 80% 10800 override-expire reload-into-ims
refresh_pattern photobucket.*\.(jp(e?g|e|2)|tiff?|bmp|gif|png) 10800 80% 10800 override-expire ignore-reload
refresh_pattern vid\.akm\.dailymotion\.com.*\.on2\? 10800 80% 10800 ignore-no-cache override-expire override-lastmod
refresh_pattern mediafire.com\/images.*\.(jp(e?g|e|2)|tiff?|bmp|gif|png) 10800 80% 10800 reload-into-ims override-expire ignore-private
refresh_pattern ^http:\/\/images|pics|thumbs[0-9]\. 10800 80% 10800 reload-into-ims ignore-no-cache ignore-reload override-expire
refresh_pattern ^http:\/\/www.onemanga.com.*\/ 10800 80% 10800 reload-into-ims ignore-no-cache ignore-reload override-expire
# ANTI VIRUS
refresh_pattern guru.avg.com/.*\.(bin) 10800 80% 10800 ignore-no-cache ignore-reload reload-into-ims
refresh_pattern (avgate|avira).*(idx|gz)$ 10800 80% 10800 ignore-no-cache ignore-reload reload-into-ims
refresh_pattern kaspersky.*\.avc$ 10800 80% 10800 ignore-no-cache ignore-reload reload-into-ims
refresh_pattern kaspersky 10800 80% 10800 ignore-no-cache ignore-reload reload-into-ims
refresh_pattern update.nai.com/.*\.(gem|zip|mcs) 10800 80% 10800 ignore-no-cache ignore-reload reload-into-ims
refresh_pattern ^http:\/\/liveupdate.symantecliveupdate.com.*\(zip) 10800 80% 10800 ignore-no-cache ignore-reload reload-into-ims
refresh_pattern windowsupdate.com/.*\.(cab|exe) 10800 80% 10800 ignore-no-cache ignore-reload reload-into-ims
refresh_pattern update.microsoft.com/.*\.(cab|exe) 10800 80% 10800 ignore-no-cache ignore-reload reload-into-ims
refresh_pattern download.microsoft.com/.*\.(cab|exe) 10800 80% 10800 ignore-no-cache ignore-reload reload-into-ims
#images facebook
refresh_pattern ((facebook.com)|(85.131.151.39)).*\.(jpg|png|gif|css) 10800 80% 10800 ignore-reload override-expire ignore-no-cache
refresh_pattern -i \.fbcdn.net.*\.(jpg|gif|png|swf|mp3) 10800 80% 10800 ignore-reload override-expire ignore-no-cache
refresh_pattern static\.ak\.fbcdn\.net*\.(jpg|gif|png) 10800 80% 10800 ignore-reload override-expire ignore-no-cache
refresh_pattern ^http:\/\/profile\.ak\.fbcdn.net*\.(jpg|gif|png) 10800 80% 10800 ignore-reload override-expire ignore-no-cache
#banner IIX
refresh_pattern ^http:\/\/openx.*\.(jp(e?g|e|2)|gif|pn[pg]|swf|ico|css|tiff?) 10800 99999% 10800 reload-into-ims ignore-reload override-expire ignore-no-cache
refresh_pattern ^http:\/\/ads(1|2|3).kompas.com.*\/ 10800 99999% 10800 reload-into-ims ignore-reload override-expire ignore-no-cache
refresh_pattern ^http:\/\/img.ads.kompas.com.*\/ 10800 99999% 10800 reload-into-ims ignore-reload override-expire ignore-no-cache
refresh_pattern .kompasimages.com.*\.(jpg|gif|png|swf) 10800 99999% 10800 reload-into-ims ignore-reload override-expire ignore-no-cache
refresh_pattern ^http:\/\/openx.kompas.com.*\/ 10800 99999% 10800 reload-into-ims ignore-reload override-expire ignore-no-cache
refresh_pattern kaskus.\us.*\.(jp(e?g|e|2)|gif|png|swf) 10800 99999% 10800 reload-into-ims ignore-reload override-expire ignore-no-cache
refresh_pattern ^http:\/\/img.kaskus.us.*\.(jpg|gif|png|swf) 10800 99999% 10800 reload-into-ims ignore-reload override-expire ignore-no-cache
#IIX DOWNLOAD
refresh_pattern ^http:\/\/\.www[0-9][0-9]\.indowebster\.com\/(.*)(mp3|rar|zip|flv|wmv|3gp|mp(4|3)|exe|msi|zip) 10800 99999% 10800 reload-into-ims ignore-reload override-expire ignore-no-cache ignore-auth
#All File
refresh_pattern -i \.(3gp|7z|ace|asx|avi|bin|cab|dat|deb|divx|dvr-ms) 10800 80% 10800 ignore-no-cache ignore-private override-expire override-lastmod reload-into-ims
refresh_pattern -i \.(rar|jar|gz|tgz|bz2|iso|m1v|m2(v|p)|mo(d|v)) 10800 80% 10800 ignore-no-cache ignore-private override-expire override-lastmod reload-into-ims
refresh_pattern -i \.(jp(e?g|e|2)|gif|pn[pg]|bm?|tiff?|ico|swf|css|js|jpg|png) 10800 80% 10800 ignore-no-cache ignore-private override-expire override-lastmod reload-into-ims
refresh_pattern -i \.(mp(e?g|a|e|1|2|3|4)|mk(a|v)|ms(i|u|p)|og(x|v|a|g)|rar|rm|r(a|p)m|snd|vob|wav) 10800 80% 10800 ignore-no-cache ignore-private override-expire override-lastmod reload-into-ims
refresh_pattern -i \.(pp(s|t)|wax|wm(a|v)|wmx|wpl|zip|cb(r|z|t)) 10800 80% 10800 ignore-no-cache ignore-private override-expire override-lastmod reload-into-ims
#########################################################################
refresh_pattern (cgi-bin|\?) 0 0% 0
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern ^ftp: 10080 95% 10800 override-lastmod reload-into-ims
refresh_pattern . 180 95% 10800 override-lastmod reload-into-ims
global_internal_static off
retry_on_error on
buffered_logs on
read_ahead_gap 32 KB
#header_access Accept-Encoding deny all
client_persistent_connections off
server_persistent_connections on
half_closed_clients off
strip_query_terms off
quick_abort_min 0 KB
quick_abort_max 0 KB
quick_abort_pct 100
vary_ignore_expire on
reload_into_ims on
pipeline_prefetch on
read_timeout 30 minute
client_lifetime 6 hour
positive_dns_ttl 6 hour
pconn_timeout 15 second
request_timeout 1 minute
log_icp_queries off
ipcache_size 16384
ipcache_low 98
ipcache_high 99
log_fqdn off
fqdncache_size 16384
memory_pools off
forwarded_for on
client_db off
max_filedescriptors 8192
# ZAIB
# ZPH for Squid 3.3.19
qos_flows local-hit=0x30
# ACCESS CONTROLS OPTIONS
# ====================
acl all src
acl localnet src 101.0.0.0/8 # Your network here
acl localnet src 192.168.1.0/24 # Your network here
acl localhost src 127.0.0.1/32
acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 81 3128 1025-65535
acl sslports port 443 563 81 2087 8081 10000
acl manager proto cache_object
acl purge method PURGE
acl connect method CONNECT
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !safeports
http_access deny CONNECT !sslports
http_access allow localhost
http_access allow localnet
http_access deny all
# OPTIONS WHICH AFFECT THE CACHE SIZE
# ==============================
cache_mem 512 MB
maximum_object_size_in_memory 4096 KB
memory_replacement_policy heap GDSF
cache_replacement_policy heap LFUDA
minimum_object_size 0 bytes
# 10GB CACHE SIZE [JZ]
# =====================
cache_dir aufs /cache-1 10000 14 256
maximum_object_size 1000 MB
cache_swap_low 95
cache_swap_high 99
# LOGFILE LOCATIONS AND CACHE_DIR [JZ]
# ====================================
access_log /var/log/squid3/access.log
cache_log /var/log/squid3/cache.log
#cache_log /dev/null
cache_store_log none
logfile_rotate 5
log_icp_queries off
# REFRESH PATTERNS AND OTHER TUNING OPTIONS [JZ]
# ==============================================
refresh_pattern ^ftp: 1440 20% 10080 reload-into-ims
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i .(gif|png|jp?g|ico|bmp|tiff?)$ 10080 95% 43200 override-expire override-lastmod reload-into-ims ignore-no-cache ignore-private
refresh_pattern -i .(rpm|cab|deb|exe|msi|msu|zip|tar|xz|bz|bz2|lzma|gz|tgz|rar|bin|7z|doc?|xls?|ppt?|pdf|nth|psd|sis)$ 10080 90% 43200 override-expire override-lastmod reload-into-ims ignore-no-cache ignore-private
refresh_pattern -i .(avi|iso|wav|mid|mp?|mpeg|mov|3gp|wm?|swf|flv|x-flv|axd)$ 43200 95% 432000 override-expire override-lastmod reload-into-ims ignore-no-cache ignore-private
refresh_pattern -i .(html|htm|css|js)$ 1440 75% 40320
refresh_pattern -i .index.(html|htm)$ 0 75% 10080
#refresh_pattern -i (/cgi-bin/|?) 0 0% 0
refresh_pattern . 1440 90% 10080
quick_abort_min 0 KB
quick_abort_max 0 KB
quick_abort_pct 100
store_avg_object_size 13 KB
vary_ignore_expire on
# ANONIMITY OPTIONS
# ===============
request_header_access From deny all
request_header_access Server deny all
request_header_access Link deny all
request_header_access Via deny all
request_header_access X-Forwarded-For deny all
# ADMINISTRATIVE PARAMETERS [JZ]
# ==============================
cache_mgr Syed_jahanzaib
visible_hostname aacable@hotmail.com
cache_effective_user proxy
cache_effective_group proxy
httpd_suppress_version_string on
ftp_list_width 32
ftp_passive on
ftp_sanitycheck on
# DNS SERVER [JZ]
# ===============
dns_nameservers 8.8.8.8
# MISCELLANEOUS [JZ]
# ==================
memory_pools off
client_db off
reload_into_ims on
coredump_dir /cache-1
pipeline_prefetch on
offline_mode off
### END OF SQUID SAMPLE CONFIGURATION ###
### IT WAS MADE ROUGHLY ###
Now Generate SSL certificate which SQUID will present to the end client. For test purposes in a test environment, you can create a self-signed
certificate using OpenSSL by using the following:
cd /etc/squid3 openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout squid.pem -out squid.pem
It will ask few simple questions like country code, use PK if you are in Pakistan, and some other questions, just answer and proceed further
#####
Create cache folder and assign necnessary permissions.
mkdir /cache-1 chown proxy:proxy /cache-1
Now initialize CACHE folders by SQUID
squid -z
Now start SQUID in no daemon mode to verify you dont have any errors in the config file.
squid -d1N
↓
↓
To redirect TRANSPARENTLY port 80 and 443 to local proxy.
change the eth0 to match your local LAN interface.
iptables -t nat -A PREROUTING -i eth0 -p tcp –dport 80 -j DNAT –to-destination 10.0.0.1:8080 iptables -t nat -A PREROUTING -i eth0 -p tcp –dport 443 -j DNAT –to-destination 10.0.0.1:8081
To check SQUID port
netstat -nap | grep 8080 netstat -nap | grep 8081
↓
↓
↓
↓
↓↓
↓
↓
With Decryption ↓
↓
↓
With Encryption ↓
↓
Filed under: Linux Related
