<div dir="ltr"><div>Hello,</div><div><br></div><div>I'm contacting you for some help.</div><div>I need to deploy a secure proxy based on Squid. <br></div><div><br></div><div>I try to use https_port combined with sslbump. I get an error message about a bungled line.<br></div><div><br></div><div>The reasons I want to do this :<br></div><div>- secure connection between the client browser and the proxy server, so using https_port to do it. encrypted traffic
in TLS between the client and the server.<br></div><div>- secure login connection. So I need to use https_port to do this. Otherwise If I use http_port, the login/password can be read on the network.</div><div>- Do ssl inspection of the traffic goeing through the proxy</div><div><br></div><div><br></div><div>What I have done with success : <br></div><div>- https_port without sslbump (traffic between the brownser and the client is encrypted. The login/password can't be read on the network)</div><div>- ssl-bump on http_port. The ssl inspection is working ... but the connexion between the browser and the proxy service is not encrypted</div><div><br></div><div>But can't get 'https_port 3129 ssl-bump' working.</div><div>FATAL: ssl-bump on https_port requires tproxy/intercept which is missing.</div><div>FATAL: Bungled squid.conf line 49: https_port 3129 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB tls-cert=/etc/squid/squid-cert.pem options=SINGLE_DH_USE,SINGLE_ECDH_USE tls-dh=/etc/squid/dhparam.pem</div><div><br></div><div>Is there something I have misunderstood ? Or doing wrong ?</div><div> </div><div>I have generated the certificate and CA with openssl : <br></div><div>* openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout squid-cert.pem -out squid-cert.pem</div><div>* openssl x509 -in squid-cert.pem -outform DER -out squid-CA-browser.der</div><div>* openssl dhparam -outform PEM -out dhparam.pem 2048<br></div><div><br></div><div>Squid version : 4.4 from EPEL on centos 8 with '--enable-ssl' '--enable-ssl-crtd' '--with-openssl' <br></div><div><br></div><div>Squid configuration as follow : <br></div><div>
===============================================================
</div><div>auth_param basic program /usr/lib64/squid/basic_ncsa_auth /etc/squid/htpasswd<br>auth_param basic children 10<br>auth_param basic realm Squid proxy-caching web server<br>auth_param basic credentialsttl 2 hours</div><div><br></div><div>acl localnet src 0.0.0.1-0.255.255.255<br>acl localnet src <a href="http://192.168.0.0/24">192.168.0.0/24</a><br><br>acl SSL_ports port 443<br>acl Safe_ports port 80<br>acl Safe_ports port 443<br>acl CONNECT method CONNECT<br><br>http_access deny !Safe_ports<br>http_access deny CONNECT !SSL_ports<br><br>#squid mgmt interface access<br>http_access allow localhost manager<br>http_access deny manager<br><br>acl auth_users proxy_auth REQUIRED<br>http_access allow auth_users<br><br>http_access allow localnet<br>http_access allow localhost<br><br>#squid mgmt interface access<br>http_access allow localhost manager<br>http_access deny manager<br><br>#http_access deny to_localhost<br>http_access deny all<br></div><div><br></div><div>##Many Tests here : <br></div><div>#http_port 3128 ssl-bump cert=/etc/squid/squid-cert.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB</div><div>
#http_port 3128 ssl-bump tls-cert=/etc/squid/squid-cert.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB <br></div><div><br></div><div>#http_port 3128 ssl-bump cert=/etc/squid/squid-cert.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cipher=HIGH:MEDIUM:!LOW:!RC4:!SEED:!IDEA:!3DES:!MD5:!EXP:!PSK:!DSS options=NO_TLSv1,NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE</div><div></div><div><br></div><div>#https_port 3129 cert=/etc/squid/squid-cert.pem</div><div>
#https_port 3129 tls-cert=/etc/squid/squid-cert.pem <br></div><div><br></div><div>https_port 3129 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB tls-cert=/etc/squid/squid-cert.pem options=SINGLE_DH_USE,SINGLE_ECDH_USE tls-dh=/etc/squid/dhparam.pem<br></div><div><br></div><div></div><div>sslcrtd_program /usr/lib64/squid/security_file_certgen<br><br>acl step1 at_step SslBump1<br>ssl_bump peek step1<br>ssl_bump bump all<br><br></div><div><br></div><div><br></div><div>tls_outgoing_options min-version=1.0 cipher=HIGH:MEDIUM:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS<br><br>#LOGS : deux options. Envoie des logs directe<br>access_log daemon:/var/log/squid/access.log squid<br>#access_log tcp://[ip]:[port] squid<br>access_log syslog:<a href="http://local0.info">local0.info</a> squid<br>cache_log /var/log/squid/cache.log rotate=10<br><br>#Cache<br>cache_mem 512 MB<br>cache_dir ufs /var/spool/squid 10000 16 256<br>coredump_dir /var/spool/squid</div><div>===============================================================<br></div><div><br></div><div>Thank you in advance !</div><div><br></div><div>Regards,</div><div><br></div></div>