<div style="font-family: Arial, sans-serif; font-size: 14px;"><span>Hello,</span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span><br></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span>I am a Squid beginner and we would like to use Squid inside our organization only as a HTTPS traffic inspection/logging tool for some 3rd party apps that we bought, </span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span>something close to what a "MITM proxy" is called but we will not do that, instead we use a self signed certificate and the 3rd party app owners know this. Everything is</span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span>100% completely legal. (Ps: I am the IT lead).<br></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span><br></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span>We will be using Squid only internally, no outside access. Here is my issue with the current knowledge of Squid: POC running well on 3 servers but on the 4th I get no IPv6</span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span>sockets:<br></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span><span><span>ubuntu@A2-3:/$ sudo netstat -patun | grep squid | grep tcp</span><br><span>tcp 0 0 10.10.0.16:3128 0.0.0.0:* LISTEN 2891391/(squid-1)</span><br></span></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span><span><br></span></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span><span>and on the other 3 I have IPv6:<br></span></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span><span>ubuntu@A2-2:/$ sudo netstat -patun | grep squid | grep tcp</span><div><span>tcp 0 0 x.x.x.x:52386 x.x.x.x:443 ESTABLISHED 997651/(squid-1)</span></div><div><span>tcp6 0 0 :::3128 :::* LISTEN 997651/(squid-1)</span></div><div><span>tcp6 0 0 10.10.0.12:3128 10.20.0.1:39428 ESTABLISHED 997651/(squid-1)</span></div><span></span><br></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span>This creates a problem for us since the apps I monitor are not starting since their start routine is IPV6 only and then they switch to IPv4/IPV6, but the start is IPV6 alone.<br></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span><br></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span>Therefore my questions are as follows:<br></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><ol data-editing-info="{"orderedStyleType":1,"unorderedStyleType":1}" data-listchain="__List_Chain_98"><li style="list-style-type: "1. ";"><span>How can I make it listen on both IPV6/IPV4 like on the other servers?</span></li><li style="list-style-type: "2. ";"><span>Any configuration improvement suggestions?<br></span></li></ol></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span><br></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span>Please find all details here:<br></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span>So far I did a POC on 4 servers, here is the full config, nothing sophisticated since this is where my Squid knowledge took me so far. Running Squid 6.7 with some basic options</span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span>on Ubuntu 22.04 <span>kernel <span>5.15.0-89-generic</span></span> x86_64<br></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span><span>squid -v</span><div><span>Squid Cache: Version 6.7</span></div><div><span>Service Name: squid</span></div><span>This binary uses OpenSSL 3.0.2 15 Mar 2022. configure options: '--prefix=/usr' '--localstatedir=/var' '--libexecdir=/lib/squid' '--datadir=/share/squid' '--sysconfdir=/etc/squid' '--with-default-user=proxy' '--with-logdir=/var/log/squid' '--enable-ssl-crtd' '--with-openssl'</span><br></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span><br></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span>and here is the syslog of Squid start:</span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span><span>Mar 4 16:09:28 A2-3 systemd[1]: Starting Squid Web Proxy Server...</span><div><span>Mar 4 16:09:28 A2-3 squid[3094662]: 2024/03/04 16:09:28| Processing Configuration File: /etc/squid/squid.conf (depth 0)</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094662]: 2024/03/04 16:09:28| WARNING: empty ACL: acl broken_sites ssl::server_name "/etc/squid/ssl_broken_sites.txt"</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094662]: 2024/03/04 16:09:28| WARNING: The "Hs" formatting code is deprecated. Use the ">Hs" instead.</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094662]: 2024/03/04 16:09:28| Created PID file (/var/run/squid.pid)</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094662]: Squid Parent: will start 1 kids</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094662]: Squid Parent: (squid-1) process 3094665 started</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094665]: 2024/03/04 16:09:28 kid1| Processing Configuration File: /etc/squid/squid.conf (depth 0)</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094665]: 2024/03/04 16:09:28 kid1| WARNING: empty ACL: acl broken_sites ssl::server_name "/etc/squid/ssl_broken_sites.txt"</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094665]: 2024/03/04 16:09:28 kid1| WARNING: The "Hs" formatting code is deprecated. Use the ">Hs" instead.</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094665]: 2024/03/04 16:09:28 kid1| Set Current Directory to /var/cache/squid</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094665]: 2024/03/04 16:09:28 kid1| Creating missing swap directories</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094665]: 2024/03/04 16:09:28 kid1| No cache_dir stores are configured.</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094662]: Squid Parent: squid-1 process 3094665 exited with status 0</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094662]: 2024/03/04 16:09:28| Removing PID file (/var/run/squid.pid)</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094666]: Processing Configuration File: /etc/squid/squid.conf (depth 0)</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094666]: WARNING: empty ACL: acl broken_sites ssl::server_name "/etc/squid/ssl_broken_sites.txt"</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094666]: WARNING: The "Hs" formatting code is deprecated. Use the ">Hs" instead.</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094666]: Created PID file (/var/run/squid.pid)</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094666]: Squid Parent: will start 1 kids</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094666]: Squid Parent: (squid-1) process 3094668 started</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Processing Configuration File: /etc/squid/squid.conf (depth 0)</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: WARNING: empty ACL: acl broken_sites ssl::server_name "/etc/squid/ssl_broken_sites.txt"</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: WARNING: The "Hs" formatting code is deprecated. Use the ">Hs" instead.</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Set Current Directory to /var/cache/squid</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Starting Squid Cache version 6.7 for x86_64-pc-linux-gnu...</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Service Name: squid</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Process ID 3094668</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Process Roles: worker</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: With 1000000 file descriptors available</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Initializing IP Cache...</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: DNS IPv6 socket created at [::], FD 9</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: DNS IPv4 socket created at 0.0.0.0, FD 10</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Adding nameserver 127.0.0.53 from /etc/resolv.conf</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Adding domain . from /etc/resolv.conf</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: helperOpenServers: Starting 5/5 'security_file_certgen' processes</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Logfile: opening log stdio:/var/log/squid/success.log</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Logfile: opening log stdio:/var/log/squid/failure.log</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Logfile: opening log daemon:/var/log/squid/access.log</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Logfile Daemon: opening log /var/log/squid/access.log</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Store logging disabled</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Swap maxSize 0 + 262144 KB, estimated 20164 objects</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Target number of buckets: 1008</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Using 8192 Store buckets</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Max Mem size: 262144 KB</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Max Swap size: 0 KB</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Using Least Load store dir selection</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Set Current Directory to /var/cache/squid</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Finished loading MIME types and icons.</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: HTCP Disabled.</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Squid plugin modules loaded: 0</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Adaptation support is off.</span></div><div><span>Mar 4 16:09:28 A2-3 squid[3094668]: Accepting SSL bumped HTTP Socket connections at conn13 local=10.10.0.16:3128 remote=[::] FD 25 flags=9#012 listening port: 10.10.0.16:3128</span></div><div><span>Mar 4 16:09:28 A2-3 systemd[1]: Started Squid Web Proxy Server.</span></div><div><span>Mar 4 16:09:29 A2-3 squid[3094668]: storeLateRelease: released 0 objects</span></div><span></span></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><div><span><br></span></div><div><span>-- full config --<br></span></div></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span>acl SSL_ports port 443</span><div><span>acl SSL_ports port 443</span></div><div><span>http_access allow localhost</span></div><div><span>http_access allow localnet</span></div><div><span>http_access allow all</span></div><div><br></div><div><span>acl step1 at_step SslBump1</span></div><div><span>acl step2 at_step SslBump2</span></div><div><span>acl step3 at_step SslBump3</span></div><div><br></div><div><span>acl broken_sites ssl::server_name "/etc/squid/ssl_broken_sites.txt"</span></div><div><span>http_upgrade_request_protocols websocket allow all</span></div><div><br></div><div><span>ssl_bump peek step1 all</span></div><div><span>ssl_bump splice broken_sites</span></div><div><span>ssl_bump stare step2 all</span></div><div><span>ssl_bump bump step3 all</span></div><div><span><br></span></div><div><span>acl CONNECT method CONNECT</span></div><div><span>acl success_hier hier_code HIER_DIRECT</span></div><div><span>acl failure_hier hier_code HIER_NONE</span></div><div><span>acl failure all-of CONNECT failure_hier</span></div><div><span>acl failure all-of !CONNECT failure_codes</span></div><div><span>acl success all-of CONNECT success_hier</span></div><div><span>acl success all-of !CONNECT success_codes</span></div><div><br></div><div><span>access_log stdio:/var/log/squid/success.log logformat=squid success</span></div><div><span>access_log stdio:/var/log/squid/failure.log logformat=squid failure</span></div><div><br></div><div><span>cache deny all</span></div><div><span><span><br></span></span></div><div><span><span>http_port [::]:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=8MB tls-cert=/etc/squid/myCA.pem tls-key=/etc/squid/myCA1.pem</span><br></span></div><div><span>strip_query_terms off</span></div><div><br></div><div><span>logformat timereadable %tl %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt</span></div><div><span>access_log daemon:/var/log/squid/access.log timereadable</span></div><div><br></div><div><span>coredump_dir /var/cache/squid</span></div><div><span>refresh_pattern ^ftp: 1440 20% 10080</span></div><div><span>refresh_pattern -i (/cgi-bin/|\?) 0 0% 0</span></div><div><span>refresh_pattern . 0 20% 4320</span></div><div><span>sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/lib/squid/ssl_db -M 16MB</span></div><div><span>sslcrtd_children 5</span></div><div><span>ssl_bump server-first all</span></div><div><span>sslproxy_cert_error allow all</span></div><span></span></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><div><span>-- end of config<br></span></div></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;">Thank you,</div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;">Dragos<br></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div>
<div class="protonmail_signature_block" style="font-family: Arial, sans-serif; font-size: 14px;">
<div class="protonmail_signature_block-user protonmail_signature_block-empty">
</div>
<div class="protonmail_signature_block-proton">
Sent with <a target="_blank" href="https://proton.me/" rel="noopener noreferrer">Proton Mail</a> secure email.
</div>
</div>