[squid-users] Filering HTTPS URLs - A complete configuration

Paul Doignon paul at doignon.fr
Mon Feb 11 10:55:05 UTC 2019


> No need to compile and build it for AWS:
> I already built it for both AWS 1 and 2:
> http://ngtech.co.il/repo/amzn/
> 
> Can be downloaded and is tested to work very well on both OS. 
> 
> Eliezer

Thanks, looks really good !
I guess those Amazon Linux 1 packages come from there : http://gogs.ngtech.co.il/NgTech-LTD/squid-amzn1-squid4-rpms ?


> The closest you are going to get to the above is with:
> * bump everything[1], and
> * use http_access to check the https:// URLs for your policy
> * use "deny_info TCP_RESET" [2] on the blocked requests.
> 
> [1] some things literally cannot be bumped. So a decision needs to be
> made about what to do then.

All right, good point. I guess adding this second line will terminate those un-bumpable requests ?

# --
ssl_bump bump all
ssl_bump terminate all
# --

> [2] a regular deny error page will work fine. This TCP_RESET is just
> closest to the "ssl_bump terminate" behaviour.
> 
> Amos

This is perfect, thanks a lot.

I leave my complete config for other users :

# --
# General
cache_effective_user squid
cache_effective_group squid
shutdown_lifetime 1 seconds 
visible_hostname squid-something.unique

# Hide some reavealing stuffs
forwarded_for delete
httpd_suppress_version_string off
reply_header_access X-Cache deny all
reply_header_access X-Cache-Lookup deny all
via off
global_internal_static off
cache deny all

# Tuning
max_filedesc 10000

# Security
http_access deny manager
host_verify_strict on
ignore_unknown_nameservers on
snmp_port 0
snmp_access deny all
icp_port 0
icp_access deny all
htcp_port 0
htcp_access deny all

http_port localhost:3128 # Squid default port

# Handling HTTPS requests
# Ciphers from https://wiki.mozilla.org/Security/Server_Side_TLS
https_port 8080 act-as-origin ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl/squid.pem cipher=ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 options=NO_SSLv3,NO_TLSv1,NO_TLSv1_1,SINGLE_DH_USE,SINGLE_ECDH_USE intercept
sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/cache/squid/ssl_db -M 4MB
sslcrtd_children 8 startup=1 idle=1
#
tls_outgoing_options cipher=ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 min-version=1.2 options=NO_SSLv3,SINGLE_DH_USE

acl TO_SSL port 443
acl LAN src 172.16.0.0/24
acl whitelist-regex url_regex -i ^https://thirdparty\.com/upload/stuff/$
acl CONNECT method CONNECT
deny_info TCP_RESET all
http_access allow LAN TO_SSL CONNECT
http_access allow LAN TO_SSL whitelist-regex
http_access deny all

# SSL bump
ssl_bump bump all
ssl_bump terminate all
# --


 ---- On Thu, 07 Feb 2019 01:46:23 +0100 Amos Jeffries <squid3 at treenet.co.nz> wrote ---- 
 > On 7/02/19 3:52 am, Paul Doignon wrote:
 > > Thanks, I appreciate your detailed answer.
 > > 
 > >  > > I'm struggling a lot to configure Squid. To improve the security of my app in my AWS private subnet,
 > >  > 
 > >  > If it is indeed *your* app; then please alter it not to require the
 > >  > interception we see below. Ability to connect to a TLS explicit proxy or
 > >  > just sending regular proxy CONNECT tunnel is a leap up in security.
 > > 
 > > I wish I could too ! Unfortunately, we use some third party libraries that do not support proxies (or not well). What a shame : (
 > >  
 > >  > > # Hide some reavealing or useless headers
 > >  > > forwarded_for delete
 > >  > > httpd_suppress_version_string off
 > >  > > reply_header_access X-Cache deny all
 > >  > > reply_header_access X-Cache-Lookup deny all
 > >  > > via off
 > >  > > 
 > >  > > # Tuning
 > >  > > max_filedesc 10000
 > >  > > 
 > >  > > # Disable access to manager
 > >  > > http_access deny manager
 > >  > 
 > >  > 2) you are missing the security protections from the default squid.conf...
 > >  
 > > I have not hardened Squid yet, but you mean default `acl localnet src [...]` rules ? I'm not sure about this.
 > > 
 > 
 > The defaults that come with a new build or installation:
 > 
 > "
 >   http_access deny !Safe_ports
 >   http_access deny CONNECT !SSL_ports
 >   http_access allow localhost manager
 >   http_access deny manager
 > 
 >   ... your rules go here ...
 > 
 >   http_access deny all
 > "
 > 
 > 
 > >  > Please see <https://wiki.squid-cache.org/Features/SslPeekAndSplice> for
 > >  > details on the TLS handshake process and what SSL-Bump does during that.
 > > 
 > > Another read was indeed interesting, I think I corrected ssl_bump directives. However I still can't make it work.
 > > Just for the record, I would like to block everything but some HTTPS websites for particular URLs. The ssl::server_name acl is not enough for me, I would like to use url_regex or similar.
 > > Ant that's where it gets wrong, I can't make Squid make the link between `ssl_bump bump` and url_regex.
 > 
 > 
 > That is because ssl_bump is the access control governing the TLS
 > handshake process. TLS message/frames do not contain URLs. Even when a
 > client CONNECT request is being processed it only has an authority-URI
 > (not a full URL).
 > 
 > The http_access rules are the first point you get access to URL. The
 > https:// URLs start *after* the ssl_bump finishes with a successful
 > 'bump' action.
 > 
 > 
 > The closest you are going to get to the above is with:
 >  * bump everything[1], and
 >  * use http_access to check the https:// URLs for your policy
 >  * use "deny_info TCP_RESET" [2] on the blocked requests.
 > 
 > [1] some things literally cannot be bumped. So a decision needs to be
 > made about what to do then.
 > 
 > [2] a regular deny error page will work fine. This TCP_RESET is just
 > closest to the "ssl_bump terminate" behaviour.
 > 
 > 
 > Amos
 > _______________________________________________
 > squid-users mailing list
 > squid-users at lists.squid-cache.org
 > http://lists.squid-cache.org/listinfo/squid-users
 > 




More information about the squid-users mailing list