<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
-----BEGIN PGP SIGNED MESSAGE----- <br>
Hash: SHA256 <br>
<br>
Jok,<br>
<br>
it can be DNS leak. Does you tested it? 8.8.8.8 can be poisoned
(probably) or intercepted by ISP.<br>
<br>
<br>
27.10.2016 0:01, Jok Thuau пишет:<br>
<span style="white-space: pre;">> After being side-tracked with a
few different project, I ended up with the config below. It
appears to do the right things, though the ACL organization could
use some cleanup... <br>
> (Browsing to authorized sites works, browsing to something
else, i get a denied page from squid)<br>
><br>
> However, even though msdn.microsoft.com
<a class="moz-txt-link-rfc2396E" href="http://msdn.microsoft.com"><http://msdn.microsoft.com></a> is on my whitelist, it appears
to "timeout". Looking at the logs, I see entries like this:<br>
><br>
> 2016/09/20 15:10:19.640 kid1| SECURITY ALERT: Host header
forgery detected on local=65.54.226.150:443
<a class="moz-txt-link-rfc2396E" href="http://65.54.226.150:443"><http://65.54.226.150:443></a> remote=10.11.12.13:51984
<a class="moz-txt-link-rfc2396E" href="http://10.0.32.177:51984"><http://10.0.32.177:51984></a> FD 18 flags=33 (local IP does not
match any domain IP)<br>
> 2016/09/20 15:10:19.640 kid1| SECURITY ALERT: By user agent:<br>
> 2016/09/20 15:10:19.640 kid1| SECURITY ALERT: on URL:
msdn.microsoft.com:443 <a class="moz-txt-link-rfc2396E" href="http://msdn.microsoft.com:443"><http://msdn.microsoft.com:443></a><br>
> 2016/09/20 15:10:19.640 kid1| 4,2| errorpage.cc(1262)
BuildContent: No existing error page language negotiated for
ERR_CONFLICT_HOST. Using default error file.<br>
> 2016/09/20 15:10:19.641 kid1| 20,2| store.cc(954)
checkCachable: StoreEntry::checkCachable: NO: not cachable<br>
> 2016/09/20 15:10:19.641 kid1| 20,2| store.cc(954)
checkCachable: StoreEntry::checkCachable: NO: not cachable<br>
> 2016/09/20 15:10:19.641 kid1| 88,2|
client_side_reply.cc(2001) processReplyAccessResult: The reply for
CONNECT msdn.microsoft.com:443
<a class="moz-txt-link-rfc2396E" href="http://msdn.microsoft.com:443"><http://msdn.microsoft.com:443></a> is ALLOWED, because it
matched SniBypass<br>
> 2016/09/20 15:10:19.641 kid1| 33,2| client_side.cc(925)
deferRecipientForLater: clientSocketRecipient: Deferring request
msdn.microsoft.com:443 <a class="moz-txt-link-rfc2396E" href="http://msdn.microsoft.com:443"><http://msdn.microsoft.com:443></a><br>
><br>
> What is interesting is that we changed from using 8.8.8.8 as
our DNS server to a locally installed bind instance, and we no
longer see any issues.<br>
> that is NOT what I expected... I can't explain why the client
browser was hanging. Any suggestions?<br>
><br>
> It's all happy now, with the following config, with a
firewall doing policy based routing, a local iptables rule to
redirect from port 443 to 8443, and from 80 to 3129, as well as
the certificate deployed as trusted on each endpoint:<br>
><br>
> squid.conf:<br>
> # setup standard ports<br>
> acl SSL_ports port 443<br>
> acl Safe_ports port 80<br>
> acl Safe_ports port 21<br>
> acl Safe_ports port 443<br>
> acl Safe_ports port 70<br>
> acl Safe_ports port 210<br>
> acl Safe_ports port 1025-65535<br>
> acl Safe_ports port 280<br>
> acl Safe_ports port 488<br>
> acl Safe_ports port 591<br>
> acl Safe_ports port 777<br>
> acl CONNECT method CONNECT<br>
> # for security<br>
> http_access deny !Safe_ports<br>
> http_access deny CONNECT !SSL_ports<br>
><br>
> # not actually used and blocked by local firewall on host,
but squid complains if it's not there...<br>
> http_port 3128<br>
><br>
> # http intercept, and ACL that matches that inbound port<br>
> http_port 3129 intercept<br>
> acl http_proxy myportname 3129<br>
><br>
> # same for https<br>
> https_port 8443 intercept ssl-bump \<br>
> generate-host-certificates=on \<br>
> dynamic_cert_mem_cache_size=64MB \<br>
> cert=/etc/squid/ssl/proxy.pem \<br>
> key=/etc/squid/ssl/proxy.key \<br>
> cafile=/etc/squid/ssl/proxy.pe <a class="moz-txt-link-rfc2396E" href="http://proxy.pe"><http://proxy.pe></a>m<br>
> acl https_proxy myportname 8443<br>
><br>
> always_direct allow all<br>
><br>
> # define the steps needed for bumping...<br>
> acl step1 at_step SslBump1<br>
> acl step2 at_step SslBump2<br>
> acl step3 at_step SslBump3<br>
><br>
> # and the list of domains that are allowed<br>
> acl SniBypass ssl::server_name_regex -i
"/etc/squid/snibypass.acl"<br>
> acl http_bypass dstdom_regex -n -i "/etc/squid/snibypass.acl"<br>
><br>
> # ensure we have target SSL port when checking data<br>
> acl https_ok all-of SniBypass SSL_ports<br>
> # and the destination domain when not SSL...<br>
> acl http_ok all-of http_bypass Safe_ports<br>
><br>
> # splice when we know the target matches<br>
> ssl_bump splice SniBypass<br>
> # peek and bump otherwise<br>
> ssl_bump peek step1<br>
> ssl_bump stare step2<br>
> ssl_bump bump all<br>
><br>
> # some options for the certificate generation..<br>
> sslproxy_options NO_SSLv2,NO_SSLv3,SINGLE_ECDH_USE<br>
> sslproxy_cert_sign_hash sha256<br>
> sslcrtd_program /usr/lib/squid/ssl_crtd -s /var/lib/ssl_db -M
64MB<br>
> sslcrtd_children 8 startup=1 idle=1<br>
><br>
> # for http, let's block if we're not on the whitelist<br>
> http_access deny !http_ok http_proxy<br>
> # for https, let's wait until step3 of the bumping, so we can
replace the SSL content post-bumping)<br>
> http_access deny !https_ok step3 https_proxy<br>
><br>
> # never cache anything<br>
> cache deny all<br>
><br>
> #for windows updates<br>
> quick_abort_min -1<br>
> range_offset_limit 0 all<br>
><br>
> shutdown_lifetime 2 seconds<br>
> connect_timeout 20 seconds<br>
> #debug_options ALL,2<br>
><br>
><br>
><br>
> _______________________________________________<br>
> squid-users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
> <a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a></span><br>
<br>
- -- <br>
Cats - delicious. You just do not know how to cook them.<br>
-----BEGIN PGP SIGNATURE-----
<br>
Version: GnuPG v2
<br>
<br>
iQEcBAEBCAAGBQJYEPm+AAoJENNXIZxhPexGnewH/0e2rK5ZU87NSgskaJsZ5orA
<br>
3E7kwxXa9pt8M1LJLlcSD73HM3ASfO3xKqY+ajhKp0hvcApH+SwJFUVyuQktAoVS
<br>
P96WCIwobasSH7rGuBvvsuny0pwDrJfjvdkJjD7e2l/qFkHE9Fv1HBwMD1Kidp51
<br>
mJ8hqhh/xghUDOQgcGN1+Ae519+jOBwE/R8/fgtQ/i5TJeljEVgEaLFcw7eZ2/E1
<br>
qk/H1kV3YCrVeslUWIxqxAPPhcS6WQLSaqKxlxYgVk1n0Ya2SC7u75MtK2n/68z2
<br>
ejQwEguAn+uMx/IuX1nxVx47jK7DGsAyMeASLqIjofMst1ct0WuhQxyeAh7O4MA=
<br>
=H5/c
<br>
-----END PGP SIGNATURE-----
<br>
<br>
</body>
</html>