[squid-users] Unable to access internal resources via hostname

Sat Sep 7 14:50:42 UTC 2024

On 6/09/24 03:56, Piana, Josh wrote:
> Hello Amos,
> 
> While the comments did say that it was just the 10.46.11.0 range, I don't think there's any other ACL forcing that. I tried adding the the two internal sites that are being blocked by their IP, restarted Squid, and tested. Still being blocked. You are right though, both of those web addresses are on a different IP scheme. Ideally we want anything on 172.0.0.0 to be allowed, and 10.96.0.0. The other question I have is, even if we specify those sites IP as "allowed", shouldn't we be able to brwose to them by their hostname as well?

That depends no your configuration policy. The default squid.conf only 
checks that clients are from the LAN and not doing any nasty protocol 
trick attacks.

> 
> Currently, those internal sites ARE reachable. But only if we use IP. While this doesn't bother me, personally, the rest of our users would like to keep browsing via hostname as that's what they're used to and what many have shortcuts for.
> 

Currently I see the ACL "local_dst_dom" is commented out (disabled).

I guess you also have not listed the hostname or domain in the file 
loaded by "authless_dst" ACL.

> In regards to the results of /etc/resolv.conf, see below:
> search ad.arc-tech.com
> nameserver 10.46.11.67
> 

Okay. Then the "NDOT" default of 1 will be applied. So for these HTTP 
messages:

   CONNECT hexp:443 HTTP/1.1
   Host: hexp
   ...

Will be interpreted by Squid as URL:

  https://hexp/

The "dstdomain" ACL will try to match "hexp" exactly.

The "dst" ACL will try to match IPs of "hexp.ad.arc-tech.com"

> There must be a better way to just allow internal to internal traffic without needing to authenticate through the web proxy. The old config had it, but that was part of the issue. We have no idea how that was working, it didn't make sense at all and it was a bit outdated, Version 2.5 as opposed to our current 5.5.
> 
> I'm happy to post out config again here, as it's changed a bit and I have cleaned it up.
> 
> # squid.conf - Squid web cache configuration
> 
> ##############################################################################
> # General
> ##############################################################################
> 
> # 2020MAR23 running out with just 1024 as we switch to Hexcel.com OMA
> max_filedesc 4096
> 

Unrelated to your problem, but FYI this should probably be much larger 
(ie 64K minimum, up to 100x expected user count) for a production proxy.

> 
> ##############################################################################
> # Logging
> ##############################################################################
> 
> # this makes the logs readable to humans
> logformat custom %tl.%03tu %>a %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<a %mt
> access_log daemon:/var/log/squid/access.log custom
> 
> # this gives better error reporting
> logformat custom %err_code/%err_detail
> access_log daemon:/var/log/squid/access.log custom
> 

This repeat of "custom" will cause issues.

IIRC this was added misunderstanding of Alex instructions.
What he meant was to **add** "%err_code/%err_detail" to your existing 
"custom" format.

Like this:

logformat custom %tl.%03tu %>a %Ss/%03>Hs %<st %rm %ru %[un \
     %Sh/%<a %mt %err_code/%err_detail

> # Red Hat-ish log names
> cache_log /var/log/squid/cache.log
> cache_access_log /var/log/squid/access.log

This setting opens a third logger writing to access.log, causing more 
issues.

Remove this "cache_access_log" line.

> 
> # store_log is only useful for debugging
> cache_store_log none

FYI, off by default on current Squid. You can probably erase this 
setting entirely now.

> ##############################################################################
> # Network - General/misc
> ##############################################################################
> 
> # our HTTP proxy port
> http_port 10.46.11.69:8080
> # loopback management
> http_port 127.0.0.1:3128

FWIW, you have denied access to "dst 127.0.0.0/8". So traffic to this 
port will be rejected.

> 
> # disable ICP, port is typically 3130
> icp_port 0

FYI; disabled by default in modern Squid. You can remove "icp_port".

> 
> # if set to "on", Squid will append your client's IP address in the HTTP requests it forwards
> forwarded_for off

"off" will send the text "unknown".

It is better to use "transparent" (pass-thru unchanged) or "delete" 
(erase if existing).

> ##############################################################################
> # Authentication
> ##############################################################################
> 
> auth_param negotiate program /usr/lib64/squid/negotiate_kerberos_auth -k /etc/squid/HTTP.keytab -s HTTP/ARCGATE2.ad.arc-tech.com at AD.ARC-TECH.COM
> auth_param negotiate children 10
> auth_param negotiate keep_alive on
> acl kerb-auth proxy_auth REQUIRED
> 
> ##############################################################################
> # Access control - shared/common ACL definitions
> ##############################################################################
> 
> # ----------------------------------------------------------------------------
> # networks and hosts (by name or IP address)
> 
> # acl all src all
> 
> acl src_self src 127.0.0.0/8
> acl src_self src 10.46.11.69
> 
> acl dst_self dst 127.0.0.0/8
> acl dst_self dst 10.46.11.69

FYI, there are more IPs than just 127.0.0.0/8 which can be problematic 
as loopback sources.

Replace "dst_self" with:

  acl to_localhost dst 10.46.11.69

> 
> acl from_arc src 10.46.0.0/15
> 
> acl local_dst_addr dst 10.0.0.0/8
> acl local_dst_addr dst 172.0.0.0/8
> 
> # ----------------------------------------------------------------------------
> # protocols (URL schemes)
> 
> acl proto_FTP proto FTP
> acl proto_HTTP proto HTTP
> 
> # ----------------------------------------------------------------------------
> # TCP port numbers
> 
> # TCP ports for ordinary HTTP
> acl http_ports port 80		# standard HTTP
> acl http_ports port 81		# common alternative
> acl http_ports port 8001	# epson.com support sub-site
> acl http_ports port 8080	# common alternative

Other ports that are common:

  acl http_ports port 88 8000 8888 # ad-hoc services
  acl http_ports port 1080  # SOCK frontend to HTTP service
  acl http_ports port 21-22 # http:// frontend to FTP service
  acl http_ports port 443   # https:// URLs

Or really, **any** port can be valid now that Alt-Svc is widely used.

> 
> # TCP ports for HTTP-over-SSL
> acl Ssl_ports port 443
> acl Ssl_ports port 9571	        # lexmark.com
> 
> # TCP ports for plain FTP command channel
> acl ftp_ports port 21
> 
> # TCP ports for SSH/SFTP (secure shell)
> acl ssh_ports port 22

FTR, "ssh_ports" is unused. SSH and SFTP can only use Squid via CONNECT 
tunnel anyway. So you should list this port as part of "Ssl_ports".

> 
> # ----------------------------------------------------------------------------
> # HTTP methods (and pseudo-methods)
> 
> acl method_CONNECT method CONNECT

FYI: we have a built-in for modern Squid:

   acl CONNECT method CONNECT

You can replace all "method_CONNECT" with just "CONNECT".

> 
> # list of standard HTTP methods
> acl methods_std method GET HEAD POST PUT DELETE
> acl methods_std method TRACE OPTIONS
> 

Consider removing these ACLs and the extra complexity they create.
Modern HTTP considers many other method names "standard" and current 
Squid follows the standard-required handling for all of them, and 
special ones.

> #############################################################################
> # Access control - general proxy
> ##############################################################################
> 
> # This major section is about which HTTP proxy clients can use Squid
> # as an HTTP proxy server.  As opposed to the maintenance/admin-type
> # stuff in the previous section.
> 
> # ----------------------------------------------------------------------------
> # basic deny rules
> # these block stuff that's never good
> # we put most denies after user-auth so we know *who* is trying
> 

Missing basic security to prevent DoS and protocol hijacking attacks:

  http_access deny !Safe_ports
  http_access deny CONNECT !Ssl_ports

You can define Safe_ports like this:

   acl Safe_Ports any-of http_ports Ssl_ports ftp_ports

> # block attempts to connect to proxy server via proxy
> http_access deny dst_self
> 

Use:
   http_access deny to_localhost

> # block clients which are the proxy server machine itself
> http_access deny src_self
> 

FYI, there should be nothing wrong with other software running on the 
proxy machine (eg software updaters) using Squid. They have to obey the 
same rules an any other client.

> # deny anything not from the LAN
> http_access deny !from_arc

FYI, we use "localnet" ACL to define the LAN. Makes it a bit easier for 
others to assist if you use the same. Up to you though.

> 
> # ----------------------------------------------------------------------------
> # allow without authentication
> # these rules allow certain connects without user authentication
> # these allow any protocol/method/etc
> 
> #                 ***** IMPORTANT *****
> # Adding to these lists also exempts from all content filtering.
> # In particular, executables will be allowed to download!
> #                 ***** IMPORTANT *****
> 
> # allow connects to local destinations without authentication
> # by domain name from URL
> # acl local_dst_dom dstdomain ad.arc-tech.com
> # http_access       allow local_dst_dom
> # http_reply_access allow local_dst_dom

You have a domain name whitelist ACL two sections below.
You can remove the above, and list and use the later one for both 
"local" and other domains.

> 
> # by IP address name resolves to
> http_access       allow local_dst_addr
> # http_reply_access allow local_dst_addr
> 

Maybe rename "local_dst_addr" to "whitelist_dst_ips" for clarity on what 
it is doing.

Which brings up a security issue: When you list the entire LAN range in 
this ACL, anyone accessing the proxy is allowed to do whatever they want 
to your LAN machines. That includes all LAN **and** WAN connections.

Additionally, the bypass of authentication leaves you no trace that this 
was actually a user, and not some infected LAN machine spreading malware 
across your LAN. Which is rather risky.

Prefer to keep by-IP whitelist's empty or minimal content.

> # allow trusted hosts without authentication
> # these are just ip's on the 10.46.11.x network
> acl authless_src src "/etc/squid/authless_src"
> http_access       allow authless_src
> # http_reply_access allow authless_src
> 
> # allow the following destinations without authentication
> # list of random approved websites
> # whats the advantage of not authenticating?
> acl authless_dst dstdomain "/etc/squid/authless_dst"
> http_access       allow authless_dst
> # http_reply_access allow authless_dst
> 

This should be combined with "local_dst_dom". Just use different lines 
like so:

  acl authless_dst dstdomain "/etc/squid/authless_dst"
  acl authless_dst dstdomain .ad.arc-tech.com
  acl authless_dst dstdomain .hexcelssp.com hexcelssp

  http_access allow whitelist

> # ----------------------------------------------------------------------------
> # block before authentication
> # these rules block certain connects without user authentication
> # done for software which handles proxy auth requests badly
> # for example, popping up many auth prompts
> # this does mean we cannot whitelist for users
> 
> # blocked destinations, by host or domain, before authentication
> # websites that are auto-deny
> acl bad_domains_preauth dstdomain "/etc/squid/bad_domains_preauth"
> http_access deny bad_domains_preauth
> 
> # ----------------------------------------------------------------------------
> # require proxy authentication
> 
> # ********************************************************************
> # * anything past this point requires users to authenticate to proxy *
> # ********************************************************************
> 
> # Uncomment these lines to disable authentication requirement for all
> # but a few test boxes.  Useful if NTLM gets broken.
> # acl from_test_boxes src 10.2.1.5
> # http_access allow !from_test_boxes from_arc
> 

FYI, you have "deny !from_arc" earlier above.

This is simpler and does the same thing as the above line:

   # http_access allow !from_test_boxes

> # block clients which are not authenticated
> # http_access deny !authenticated
> 

You named the ACL "kerb-auth", not "authenticated".

> # block certain user IDs from using proxy server
> # list of ad users and service accounts to automatically deny proxy
> acl block_user proxy_auth_regex -i "/etc/squid/block_user"
> http_access deny block_user

I suggest this to prevent re-login loop for these forbidden services:

  http_access deny !kerb-auth
  http_access deny block_user all

> 
> # ----------------------------------------------------------------------------
> # general whitelist
> 
> # whitelist for locations/sites (override blocking)
> # allows complex URLs
> # some bad_urls patterns are generic
> # they block suspicous URLs or generally unwanted sites
> # this whitelist can make specific exceptions within those
> acl bad_exception_urls url_regex -i "/etc/squid/bad_exception_urls"
> 
> # ----------------------------------------------------------------------------
> # executable blocking
> 
> # we do this separately from other content blocking
> # in order to allow ITLIB to still download
> # doing it with other blocking causes a flood of browser auth req's
> # for users visting sites with video
> 
> # file extensions to block
> # don't try to block .COM files here
> # it will get confused with .com domain and block too many things
> acl exec_files url_regex -i "/etc/squid/exec_files"

Consider using the "urlpath_regex" ACL type instead. It does not match 
against the scheme://domain:port part of URLs.

> 
> # usernames not to block
> acl exec_users proxy_auth_regex -i "/etc/squid/exec_users"
> 
> # activate
> http_access deny !bad_exception_urls !exec_users exec_files
> deny_info ERR_BLOCK_TYPE exec_files
> 
> # ----------------------------------------------------------------------------
> # selective whitelists
> 
> # these override the general blacklists by explictly allowing things
> # some multimedia services (I.E. YouTube) are permitted for certain users
> # exempts them from content blocking in this section
> 
> # list of users for this
> acl mmedia_users proxy_auth_regex -i "/etc/squid/mmedia_users"
> 
> # list of sites for this
> acl mmedia_sites dstdomain "/etc/squid/mmedia_sites"
> 
> # if a mmedia user attempts to access a mmedia site via appropriate protocols, allow it
> # done for both HTTP/TCP/80 and HTTP/SSL/443
> # done for both HTTP request as well as HTTP reply/response
> # otherwise the later bad_types Content-Type multimedia blocking rule kicks in
> 
> http_access       allow methods_std    proto_HTTP http_ports mmedia_sites mmedia_users
> # tp_reply_access allow methods_std    proto_HTTP http_ports mmedia_sites mmedia_users
> 
> http_access       allow method_CONNECT            ssl_ports  mmedia_sites mmedia_users
> # http_reply_access allow method_CONNECT            ssl_ports  mmedia_sites mmedia_users

FYI, Websites like YouTube can dynamically negotiate the media source 
ports to be non-standard values using Alt-Svc headers.

If you had the default security settings at the top of your http_access 
rules:

  http_access deny !Safe_ports
  http_access deny CONNECT !SSL_Ports

... you would not need to make (bad) assumptions about the protocols and 
ports used by media sites here.

Also, "mmedia_users" being last on the line risks a 407 re-auth 
challenge occuring. Best place it earlier.

Leaving these rules as:

    http_access allow mmedia_users mmedia_sites

> 
> # ----------------------------------------------------------------------------
> # general blacklists
> # porn, wastes of bandwidth, etc.
> 
> 
> # blocked destinations, by host or domain
> # sites we don't want people using
> acl bad_domains dstdomain "/etc/squid/bad_domains"
> http_access deny !bad_exception_urls bad_domains
> deny_info ERR_BLOCK_DST	bad_domains
> 
> # blocked destinations, by host or domain, regex pattern
> acl bad_domains_regex dstdom_regex -i "/etc/squid/bad_domains_regex"
> http_access deny !bad_exception_urls bad_domains_regex
> deny_info ERR_BLOCK_DST	bad_domains_regex
> 
> # blocked destinations, by complex URL
> # typical use: block just part of a site, by URL path
> # example use: block just the advertsing section of a site
> acl bad_urls url_regex -i "/etc/squid/bad_urls"
> http_access deny !bad_exception_urls bad_urls
> deny_info ERR_BLOCK_DST	bad_urls
> 
> # blocked content types, by apparent file name
> acl bad_files urlpath_regex -i "/etc/squid/bad_files"
> http_access deny !bad_exception_urls bad_files
> deny_info ERR_BLOCK_TYPE bad_files
> 
> # blocked content types, by MIME content type, in response
> acl bad_types rep_mime_type -i "/etc/squid/bad_types"
> # http_reply_access deny bad_types !bad_exception_urls
> deny_info ERR_BLOCK_TYPE bad_types

FYI, in order for the deny_info action to be taken the ACL it is 
attached to must be the final one on a line.

Previous config was fine, but this "bad_types" use will not work. You 
need to re-order the access checks like this:

  # http_reply_access deny !bad_exception_urls bad_types

> 

This part from here ...

> # ----------------------------------------------------------------------------
> # standard web (HTTP PUT/GET/etc) access
> 
> # We basically allow any auth'ed user to connect via HTTP to anywhere,
> # so long as it uses a standard port, and is not a direct CONNECT
> # attempt, or blocked, or any of the other stuff above.
> 
> http_access allow http_ports proto_HTTP methods_std
> 
> # ----------------------------------------------------------------------------
> # direct CONNECT for HTTP-over-SSL (HTTPS)
> 
> http_access allow method_CONNECT ssl_ports
> 
> # ----------------------------------------------------------------------------
> # deny any other CONNECT attempts
> 
> http_access deny method_CONNECT
> 
> # ----------------------------------------------------------------------------
> # FTP via HTTP proxy
> 
> http_access allow ftp_ports proto_FTP
> 

... to here.

Is better handled by the default squid.conf:

  http_access deny !Safe_ports
  http_access deny CONNECT !Ssl_ports

Placed at the top of your http_access lines.

> # ----------------------------------------------------------------------------
> # catch-all defaults
> http_access allow kerb-auth
> 
> # deny any request we missed in the above
> http_access deny all
> 
> # If we allowed the request, allow the reply (HTTP response) as well.
> # Rules above many allow or deny specific reply before now.
> # If nothing more specific matched, we allow.
> # This should be OK since we filter mainly on requests.
> # http_reply_access allow all
> 

FWIW, it is hard to tell what the exact last reply action could have 
been. So I would un-comment this allow line to be certain it is what 
happens.

> ##############################################################################
> # END OF FILE
> ##############################################################################
>   

HTH
Amos