<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Arial Rounded MT Bold";
panose-1:2 15 7 4 3 5 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
.MsoPapDefault
{mso-style-type:export-only;
text-align:right;
direction:rtl;
unicode-bidi:embed;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Hey,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I have seen that you are using squid in intercept mode either on Linux or some BSD.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>If there is a site\server that you don't want to enter squid at all you will need to bypass it in the FW\IPTABLES level.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>In linux you would be able to use some ipset list that will be bypassed from being intercepted.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>If you are interested reply and I will try to give you an example how to use it.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Eliezer<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Arial Rounded MT Bold","sans-serif";color:#1F497D'>----<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Arial Rounded MT Bold","sans-serif";color:#1F497D'><a href="http://ngtech.co.il/lmgtfy/"><span style='color:#0563C1'>Eliezer Croitoru</span></a><br>Linux System Administrator<br>Mobile: +972-5-28704261<br>Email: eliezer@ngtech.co.il<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><img border=0 width=183 height=69 id="Picture_x0020_1" src="cid:image001.png@01D1D1F4.FC131730"><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'> squid-users [mailto:squid-users-bounces@lists.squid-cache.org] <b>On Behalf Of </b>Stanford Prescott<br><b>Sent:</b> Wednesday, June 29, 2016 2:56 AM<br><b>To:</b> Amos Jeffries<br><b>Cc:</b> squid-users<br><b>Subject:</b> Re: [squid-users] Squid 3.5.19 how to find banking server name for no bump<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>I forgot to mention, I am using squid 3.5.19<o:p></o:p></p></div><div><p class=MsoNormal dir=RTL style='text-align:right;direction:rtl;unicode-bidi:embed'><span dir=LTR><o:p> </o:p></span></p><div><p class=MsoNormal dir=RTL style='text-align:right;direction:rtl;unicode-bidi:embed'><span dir=LTR>On Tue, Jun 28, 2016 at 6:47 PM, Stanford Prescott <<a href="mailto:stan.prescott@gmail.com" target="_blank">stan.prescott@gmail.com</a>> wrote:<o:p></o:p></span></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><div><p class=MsoNormal>When I enter .<a href="http://wellsfargo.com" target="_blank">wellsfargo.com</a> in<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><blockquote style='margin-left:30.0pt;margin-right:0cm'><div><div><p class=MsoNormal><i>acl tls_s1_connect at_step SslBump1</i><o:p></o:p></p></div><div><p class=MsoNormal><i>acl tls_s2_client_hello at_step SslBump2</i><o:p></o:p></p></div><div><p class=MsoNormal><i>acl tls_s3_server_hello at_step SslBump3</i><o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><i>acl tls_server_name_is_ip ssl::server_name_regex ^[0-9]+.[0-9]+.[0-9]+.[0-9]+n</i><o:p></o:p></p></div><div><p class=MsoNormal><i>acl tls_allowed_hsts ssl::server_name .<a href="http://akamaihd.net" target="_blank">akamaihd.net</a></i><o:p></o:p></p></div><div><p class=MsoNormal><i>acl tls_server_is_bank ssl::server_name .<a href="http://wellsfargo.com" target="_blank">wellsfargo.com</a></i><o:p></o:p></p></div><div><p class=MsoNormal><i>acl tls_to_splice any-of tls_allowed_hsts tls_server_is_bank</i><o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><i>ssl_bump peek tls_s1_connect all</i><o:p></o:p></p></div><div><p class=MsoNormal><i>ssl_bump splice tls_s2_client_hello tls_to_splice</i><o:p></o:p></p></div><div><p class=MsoNormal><i>ssl_bump stare tls_s2_client_hello all</i><o:p></o:p></p></div><div><p class=MsoNormal><i>ssl_bump bump tls_s3_server_hello all</i><o:p></o:p></p></div></div></blockquote><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>it appears that the banking site is still getting bumped i.e.like in this access.log snippet<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><blockquote style='margin-left:30.0pt;margin-right:0cm'><div><div><div><p class=MsoNormal><i>1467156887.817 257 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://54.149.224.177:443" target="_blank">54.149.224.177:443</a> - ORIGINAL_DST/<a href="http://54.149.224.177" target="_blank">54.149.224.177</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156888.008 94 10.40.40.100 TCP_MISS/200 213 POST <a href="https://tiles.services.mozilla.com/v2/links/view" target="_blank">https://tiles.services.mozilla.com/v2/links/view</a> - ORIGINAL_DST/<a href="http://54.149.224.177" target="_blank">54.149.224.177</a> application/json</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156893.774 75 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://172.230.102.185:443" target="_blank">172.230.102.185:443</a> - ORIGINAL_DST/<a href="http://172.230.102.185" target="_blank">172.230.102.185</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156893.847 117 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://172.230.102.185:443" target="_blank">172.230.102.185:443</a> - ORIGINAL_DST/<a href="http://172.230.102.185" target="_blank">172.230.102.185</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156893.875 120 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://172.230.221.75:443" target="_blank">172.230.221.75:443</a> - ORIGINAL_DST/<a href="http://172.230.221.75" target="_blank">172.230.221.75</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156893.875 111 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://172.230.102.185:443" target="_blank">172.230.102.185:443</a> - ORIGINAL_DST/<a href="http://172.230.102.185" target="_blank">172.230.102.185</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156893.875 117 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://172.230.221.75:443" target="_blank">172.230.221.75:443</a> - ORIGINAL_DST/<a href="http://172.230.221.75" target="_blank">172.230.221.75</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156893.875 117 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://172.230.221.75:443" target="_blank">172.230.221.75:443</a> - ORIGINAL_DST/<a href="http://172.230.221.75" target="_blank">172.230.221.75</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156893.875 112 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://172.230.102.185:443" target="_blank">172.230.102.185:443</a> - ORIGINAL_DST/<a href="http://172.230.102.185" target="_blank">172.230.102.185</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156893.875 111 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://172.230.102.185:443" target="_blank">172.230.102.185:443</a> - ORIGINAL_DST/<a href="http://172.230.102.185" target="_blank">172.230.102.185</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156894.109 307 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://172.230.102.185:443" target="_blank">172.230.102.185:443</a> - ORIGINAL_DST/<a href="http://172.230.102.185" target="_blank">172.230.102.185</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156894.109 306 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://172.230.102.185:443" target="_blank">172.230.102.185:443</a> - ORIGINAL_DST/<a href="http://172.230.102.185" target="_blank">172.230.102.185</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156894.109 307 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://172.230.102.185:443" target="_blank">172.230.102.185:443</a> - ORIGINAL_DST/<a href="http://172.230.102.185" target="_blank">172.230.102.185</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156894.109 308 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://172.230.102.185:443" target="_blank">172.230.102.185:443</a> - ORIGINAL_DST/<a href="http://172.230.102.185" target="_blank">172.230.102.185</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156895.488 72 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://216.58.194.98:443" target="_blank">216.58.194.98:443</a> - ORIGINAL_DST/<a href="http://216.58.194.98" target="_blank">216.58.194.98</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156895.513 98 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://216.58.194.70:443" target="_blank">216.58.194.70:443</a> - ORIGINAL_DST/<a href="http://216.58.194.70" target="_blank">216.58.194.70</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156895.648 66 10.40.40.100 TCP_MISS/302 739 GET <a href="https://googleads.g.doubleclick.net/pagead/viewthroughconversion/974108101/?value=0&guid=ON&script=0&data.prod=&data.subprod=&data.pageid=" target="_blank">https://googleads.g.doubleclick.net/pagead/viewthroughconversion/974108101/?value=0&guid=ON&script=0&data.prod=&data.subprod=&data.pageid=</a> - ORIGINAL_DST/<a href="http://216.58.194.98" target="_blank">216.58.194.98</a> image/gif</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156895.664 82 10.40.40.100 TCP_MISS/200 649 GET <a href="https://ad.doubleclick.net/activity;src=2549153;type=allv40;cat=all_a00;u1=11201507281102291611922021;ord=6472043235332.808" target="_blank">https://ad.doubleclick.net/activity;src=2549153;type=allv40;cat=all_a00;u1=11201507281102291611922021;ord=6472043235332.808</a>? - ORIGINAL_DST/<a href="http://216.58.194.70" target="_blank">216.58.194.70</a> image/gif</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156895.920 250 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://24.155.92.60:443" target="_blank">24.155.92.60:443</a> - ORIGINAL_DST/<a href="http://24.155.92.60" target="_blank">24.155.92.60</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156896.061 79 10.40.40.100 TCP_MISS/200 503 GET <a href="https://www.google.com/ads/user-lists/974108101/?script=0&random=2433874630" target="_blank">https://www.google.com/ads/user-lists/974108101/?script=0&random=2433874630</a> - ORIGINAL_DST/<a href="http://24.155.92.60" target="_blank">24.155.92.60</a> image/gif</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156899.837 5727 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://159.45.66.156:443" target="_blank">159.45.66.156:443</a> - HIER_NONE/- -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156899.837 5587 10.40.40.100 TCP_TUNNEL/200 165 CONNECT <a href="http://connect.secure.wellsfargo.com:443" target="_blank">connect.secure.wellsfargo.com:443</a> - ORIGINAL_DST/<a href="http://159.45.66.156" target="_blank">159.45.66.156</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156899.837 5679 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://159.45.66.156:443" target="_blank">159.45.66.156:443</a> - HIER_NONE/- -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156899.837 5587 10.40.40.100 TCP_TUNNEL/200 165 CONNECT <a href="http://connect.secure.wellsfargo.com:443" target="_blank">connect.secure.wellsfargo.com:443</a> - ORIGINAL_DST/<a href="http://159.45.66.156" target="_blank">159.45.66.156</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156899.838 5680 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://159.45.66.156:443" target="_blank">159.45.66.156:443</a> - HIER_NONE/- -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156899.838 5588 10.40.40.100 TCP_TUNNEL/200 165 CONNECT <a href="http://connect.secure.wellsfargo.com:443" target="_blank">connect.secure.wellsfargo.com:443</a> - ORIGINAL_DST/<a href="http://159.45.66.156" target="_blank">159.45.66.156</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156900.836 5421 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://159.45.170.145:443" target="_blank">159.45.170.145:443</a> - HIER_NONE/- -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156900.836 5042 10.40.40.100 TCP_TUNNEL/200 4631 CONNECT <a href="http://www.wellsfargo.com:443" target="_blank">www.wellsfargo.com:443</a> - ORIGINAL_DST/<a href="http://159.45.170.145" target="_blank">159.45.170.145</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156900.837 5423 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://159.45.2.142:443" target="_blank">159.45.2.142:443</a> - HIER_NONE/- -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156900.837 5139 10.40.40.100 TCP_TUNNEL/200 4043 CONNECT <a href="http://static.wellsfargo.com:443" target="_blank">static.wellsfargo.com:443</a> - ORIGINAL_DST/<a href="http://159.45.2.142" target="_blank">159.45.2.142</a> -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156900.838 5423 10.40.40.100 TAG_NONE/200 0 CONNECT <a href="http://159.45.170.145:443" target="_blank">159.45.170.145:443</a> - HIER_NONE/- -</i><o:p></o:p></p></div><div><p class=MsoNormal><i>1467156900.838 5088 10.40.40.100 TCP_TUNNEL/200 4631 CONNECT <a href="http://www.wellsfargo.com:443" target="_blank">www.wellsfargo.com:443</a> - ORIGINAL_DST/<a href="http://159.45.170.145" target="_blank">159.45.170.145</a> -</i><o:p></o:p></p></div></div></div><div><p class=MsoNormal><o:p> </o:p></p></div></blockquote></div><div><p class=MsoNormal>If I disable sslbumping then the bank site does not get bumped, of course.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><blockquote style='margin-left:30.0pt;margin-right:0cm'><div><div><p class=MsoNormal>1467157349.321 230 10.40.40.100 TCP_MISS/301 243 GET <a href="http://wellsfargo.com/" target="_blank">http://wellsfargo.com/</a> - ORIGINAL_DST/<a href="http://159.45.66.143" target="_blank">159.45.66.143</a> -<o:p></o:p></p></div></div><div><p class=MsoNormal><o:p> </o:p></p></div></blockquote><p class=MsoNormal>Here is my squid.conf with bumping enabled.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><blockquote style='margin-left:30.0pt;margin-right:0cm'><div><div><p class=MsoNormal>visible_hostname smoothwall<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal># Uncomment the following to send debug info to /var/log/squid/cache.log<o:p></o:p></p></div><div><p class=MsoNormal>#debug_options ALL,1 33,2 28,9<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal># ACCESS CONTROLS<o:p></o:p></p></div><div><p class=MsoNormal># ----------------------------------------------------------------<o:p></o:p></p></div><div><p class=MsoNormal>acl localhostgreen src 10.40.40.1<o:p></o:p></p></div><div><p class=MsoNormal>acl localnetgreen src <a href="http://10.40.40.0/24" target="_blank">10.40.40.0/24</a><o:p></o:p></p></div><div><p class=MsoNormal>acl SWE_subnets src "/var/smoothwall/mods/proxy/acls/src_subnets.acl"<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>acl SSL_ports port 445 443 441 563<o:p></o:p></p></div><div><p class=MsoNormal>acl Safe_ports port 80 # http<o:p></o:p></p></div><div><p class=MsoNormal>acl Safe_ports port 81 # smoothwall http<o:p></o:p></p></div><div><p class=MsoNormal>acl Safe_ports port 21 # ftp <o:p></o:p></p></div><div><p class=MsoNormal>acl Safe_ports port 445 443 441 563 # https, snews<o:p></o:p></p></div><div><p class=MsoNormal>acl Safe_ports port 70 # gopher<o:p></o:p></p></div><div><p class=MsoNormal>acl Safe_ports port 210 # wais <o:p></o:p></p></div><div><p class=MsoNormal>acl Safe_ports port 1025-65535 # unregistered ports<o:p></o:p></p></div><div><p class=MsoNormal>acl Safe_ports port 280 # http-mgmt<o:p></o:p></p></div><div><p class=MsoNormal>acl Safe_ports port 488 # gss-http <o:p></o:p></p></div><div><p class=MsoNormal>acl Safe_ports port 591 # filemaker<o:p></o:p></p></div><div><p class=MsoNormal>acl Safe_ports port 777 # multiling http<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>acl CONNECT method CONNECT<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal># TAG: http_access<o:p></o:p></p></div><div><p class=MsoNormal># ----------------------------------------------------------------<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>http_access allow SWE_subnets<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>http_access allow localhost<o:p></o:p></p></div><div><p class=MsoNormal>http_access deny !Safe_ports<o:p></o:p></p></div><div><p class=MsoNormal>http_access deny CONNECT !SSL_ports<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>http_access allow localnetgreen<o:p></o:p></p></div><div><p class=MsoNormal>http_access allow CONNECT localnetgreen<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>http_access allow localhostgreen<o:p></o:p></p></div><div><p class=MsoNormal>http_access allow CONNECT localhostgreen<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal># http_port and https_port<o:p></o:p></p></div><div><p class=MsoNormal>#----------------------------------------------------------------------------<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal># For forward-proxy port. Squid uses this port to serve error pages, ftp icons and communication with other proxies.<o:p></o:p></p></div><div><p class=MsoNormal>#----------------------------------------------------------------------------<o:p></o:p></p></div><div><p class=MsoNormal>http_port 3127<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>http_port <a href="http://10.40.40.1:800" target="_blank">10.40.40.1:800</a> intercept<o:p></o:p></p></div><div><p class=MsoNormal>https_port <a href="http://10.40.40.1:808" target="_blank">10.40.40.1:808</a> intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/var/smoothwall/mods/proxy/ssl_cert/squidCA.pem sslflags=VERIFY_CRL_ALL options=NO_SSLv2,NO_SSLv3,No_Compression dhparams=/var/smoothwall/mods/proxy/ssl_cert/dhparam.pem<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>http_port <a href="http://127.0.0.1:800" target="_blank">127.0.0.1:800</a> intercept<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>sslproxy_session_cache_size 4 MB<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>ssl_bump none localhostgreen<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>sslproxy_options NO_SSLv2,NO_SSLv3,No_Compression<o:p></o:p></p></div><div><p class=MsoNormal>sslproxy_cipher ALL:!SSLv2:!SSLv3:!ADH:!DSS:!MD5:!EXP:!DES:!PSK:!SRP:!RC4:!IDEA:!SEED:!aNULL:!eNULL<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>acl tls_s1_connect at_step SslBump1<o:p></o:p></p></div><div><p class=MsoNormal>acl tls_s2_client_hello at_step SslBump2<o:p></o:p></p></div><div><p class=MsoNormal>acl tls_s3_server_hello at_step SslBump3<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>acl tls_allowed_hsts ssl::server_name .<a href="http://akamaihd.net" target="_blank">akamaihd.net</a><o:p></o:p></p></div><div><p class=MsoNormal>acl tls_server_is_bank ssl::server_name .<a href="http://wellsfargo.com" target="_blank">wellsfargo.com</a><o:p></o:p></p></div><div><p class=MsoNormal>acl tls_to_splice any-of tls_allowed_hsts tls_server_is_bank<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>ssl_bump peek tls_s1_connect all<o:p></o:p></p></div><div><p class=MsoNormal>ssl_bump splice tls_s2_client_hello tls_to_splice<o:p></o:p></p></div><div><p class=MsoNormal>ssl_bump stare tls_s2_client_hello all<o:p></o:p></p></div><div><p class=MsoNormal>ssl_bump bump tls_s3_server_hello all<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>sslproxy_cert_error deny all<o:p></o:p></p></div><div><p class=MsoNormal>sslproxy_flags DONT_VERIFY_PEER<o:p></o:p></p></div><div><p class=MsoNormal>sslcrtd_program /var/smoothwall/mods/proxy/libexec/ssl_crtd -s /var/smoothwall/mods/proxy/lib/ssl_db -M 4MB<o:p></o:p></p></div><div><p class=MsoNormal>sslcrtd_children 5<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>http_access deny all<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>cache_replacement_policy heap GDSF<o:p></o:p></p></div><div><p class=MsoNormal>memory_replacement_policy heap GDSF<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal># CACHE OPTIONS<o:p></o:p></p></div><div><p class=MsoNormal># ----------------------------------------------------------------------------<o:p></o:p></p></div><div><p class=MsoNormal>cache_effective_user squid<o:p></o:p></p></div><div><p class=MsoNormal>cache_effective_group squid<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>cache_swap_high 100<o:p></o:p></p></div><div><p class=MsoNormal>cache_swap_low 80<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>cache_access_log stdio:/var/log/squid/access.log<o:p></o:p></p></div><div><p class=MsoNormal>cache_log /var/log/squid/cache.log<o:p></o:p></p></div><div><p class=MsoNormal>cache_mem 64 MB<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>cache_dir aufs /var/spool/squid/cache 1024 16 256<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>maximum_object_size 33 MB<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>minimum_object_size 0 KB<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>request_body_max_size 0 KB<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal># OTHER OPTIONS<o:p></o:p></p></div><div><p class=MsoNormal># ----------------------------------------------------------------------------<o:p></o:p></p></div><div><p class=MsoNormal>#via off<o:p></o:p></p></div><div><p class=MsoNormal>forwarded_for off<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>pid_filename /var/run/squid.pid<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>shutdown_lifetime 10 seconds<o:p></o:p></p></div><div><p class=MsoNormal>#icp_port 3130<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>half_closed_clients off<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>umask 022<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>logfile_rotate 0<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>strip_query_terms off<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div></div></blockquote></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><blockquote style='margin-left:30.0pt;margin-right:0cm'><div><p class=MsoNormal><o:p> </o:p></p></div></blockquote></div><div><blockquote style='margin-left:30.0pt;margin-right:0cm'><div><p class=MsoNormal><o:p> </o:p></p></div></blockquote></div></div><div><div><div><p class=MsoNormal dir=RTL style='text-align:right;direction:rtl;unicode-bidi:embed'><span dir=LTR><o:p> </o:p></span></p><div><p class=MsoNormal dir=RTL style='text-align:right;direction:rtl;unicode-bidi:embed'><span dir=LTR>On Tue, Jun 28, 2016 at 9:56 AM, Amos Jeffries <<a href="mailto:squid3@treenet.co.nz" target="_blank">squid3@treenet.co.nz</a>> wrote:<o:p></o:p></span></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><div><div><p class=MsoNormal dir=RTL style='margin-bottom:12.0pt;text-align:right;direction:rtl;unicode-bidi:embed'><span dir=LTR>On 29/06/2016 2:02 a.m., Stanford Prescott wrote:<br>> I have the proper peek and splice and bump configuration of acls setup in<br>> my squid.conf file for no-bump of some web sites. I need help how to enter<br>> the banking hosts and or server names in a way that the peek and splice<br>> configuration will determine it is a banking site that I don't want bumped.<br>><br>> For example, if a user enters <a href="http://www.wellsfargo.com" target="_blank">www.wellsfargo.com</a> for online banking my<br>> current config still bumps <a href="http://wellsfargo.com" target="_blank">wellsfargo.com</a>. What would I need to enter for<br>> <a href="http://wellsfargo.com" target="_blank">wellsfargo.com</a> so that banking server will not be bumped?<br>><o:p></o:p></span></p></div></div><p class=MsoNormal dir=RTL style='text-align:right;direction:rtl;unicode-bidi:embed'><span dir=LTR>Depends on what you mean by "enter".<br><br>Are you asking for the ACL value?<br> .<a href="http://wellfargo.com" target="_blank">wellfargo.com</a><br><br>Are you asking for the ACL definition?<br> acl banks ssl::server_name .<a href="http://wellsfargo.com" target="_blank">wellsfargo.com</a><br><br>Or are you asking for a whole SSL-Bump configuration example?<br> <<a href="http://wiki.squid-cache.org/Features/SslPeekAndSplice" target="_blank">http://wiki.squid-cache.org/Features/SslPeekAndSplice</a>> has a few.<br><br>Amos<br><br>_______________________________________________<br>squid-users mailing list<br><a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br><a href="http://lists.squid-cache.org/listinfo/squid-users" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><o:p></o:p></span></p></blockquote></div><p class=MsoNormal dir=RTL style='text-align:right;direction:rtl;unicode-bidi:embed'><span dir=LTR><o:p> </o:p></span></p></div></div></div></blockquote></div><p class=MsoNormal dir=RTL style='text-align:right;direction:rtl;unicode-bidi:embed'><span dir=LTR><o:p> </o:p></span></p></div></div></body></html>