<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-GB">Hello list,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">I´m setting up a Squid proxy specifically to scan the incoming traffic from a cloud platform.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">ClamAV should scan the incoming traffic.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">So far so good.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">The cloud uses WebDAV over HTTPS, so I have to SSL-Bump the incoming traffic via Peek and Splice Feature.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">That works indeed with the CA signed internal Certificate.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">But as soon as I add a cache_peer as a “parent proxy” it does not work. (This request could not be forwarded to the origin server or to any parent caches.)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">I just get “FwdState.cc(813) connectStart: fwdConnectStart: Ssl bumped connections through parent proxy are not allowed” in the cache.log<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">And yes I know ssl-bump through a parent proxy is an security issue and might be unsecure, but the connection to the parent is internal, save and secure.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">I don’t know how, but could there be a way to “comment out” the section in fwdConnectStart source file?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Squid Cache: Version 3.5.27<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Service Name: squid<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">configure options: '--with-openssl' '--enable-ssl-crtd'<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Here´s my “minimal” SSL-Bump config:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">### Start config<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">debug_options ALL,6<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">shutdown_lifetime 1 seconds<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">http_port 8080 ssl-bump cert=/usr/local/squid/etc/ssl_cert/Squidtest.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">sslcrtd_program /usr/local/squid/libexec/ssl_crtd -s /var/lib/ssl_db -M 4MB<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">sslcrtd_children 25 startup=5 idle=10<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">cache_peer 10.106.3.66 parent 8080 0 no-query no-digest name=parent<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">never_direct allow all<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">sslproxy_cert_error allow all<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">sslproxy_flags DONT_VERIFY_PEER<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">ssl_bump bump all<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">http_access allow all<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">### End config<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Thanks for any help!<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Niklas<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
</div>
<br>
<font size="2" face="Arial">Azubi Niklas Hess </font><br>
<font size="2" face="Arial"><strong>Team Applikation-Management</strong><br>
</font>
<p><font size="2" face="Arial"><strong>Eigenbetrieb Informationstechnologie des Wetteraukreises</strong><br>
61169 Friedberg<br>
Europaplatz<br>
Gebäude B<br>
Tel.: 06031 83-6526<br>
Mobil: </font><font size="2" face="Arial"><br>
Fax.: 06031 83-916526<br>
<a href="http://www.wetteraukreis.de">www.wetteraukreis.de</a></font></p>
<font color="#000000" size="1" face="Arial"><font size="1">
<p>Informationen zum Datenschutz erhalten sie über unsere Datenschutzseite <a href="http://www.datenschutz.wetterau.de/">
www.datenschutz.wetterau.de</a><br>
Diese E-Mail enth</font><font size="1" face="Arial">ält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Adressat sind, informieren Sie bitte sofort den Absender und vernichten Sie diese E-Mail. Das unerlaubte Kopieren sowie
die unbefugte Weitergabe dieser E-Mail ist nicht gestattet.</p>
</font><font size="2" face="Arial"></font></font><br>
</body>
</html>