View source for Configure squid-3.3 in transparent mode on CentOS 7 with SSL bump

[[Main Page|Home]] > [[CentOS]] > [[CentOS 6.x]] > [[Squid proxy server configuration]] > [[Configure squid-3.3 in transparent mode on CentOS 7 with SSL bump]]
  
'''On CentOS 6.5 installing via source requires compiling gcc too.   Without using sources ssl_crtd program is not provided with binaries.  Thus, best is to avoid using CentOS 6 and consider CentOS 7 for hosting squid with SSL bump features.'''

'''This setup assumes two interfaces - One external connected to ISP and one internal for LAN users.  For any deviation please change steps appropriately.'''

On CentOS7 use following steps:
# yum -y install squid
# Create CA certificate and key for SSL bump
#:<pre>
#::     cd /etc/squid
#::     mkdir ssl_cert
#::     chown squid:squid ssl_cert
#::     chmod 700 ssl_cert
#::     cd ssl_cert
#::     openssl req -new -newkey rsa:2048 -sha256 -days 365 -nodes -x509 -keyout myCA.pem  -out myCA.pem
#:</pre>
# Then extract certificate for importing in browsers
#:<pre>
#::     openssl x509 -in myCA.pem -outform DER -out myCA.der
#:</pre>
# Disable SELinux
#:<pre>
#::     setenforce 0
#:</pre>
#:: Also edit '<tt>/etc/sysconfig/selinux</tt>' appropriately.
# Generate DH parameters in '<tt>/etc/squid</tt>' folder
#:<pre>
#::    openssl dhparam -outform PEM -out dhparam.pem 2048
#:</pre>
# Edit '<tt>/etc/squid/squid.conf</tt>' and use following before '<tt>http_access deny all</tt>' rule:
#:<pre>
#::     #Enable quick shutdown
#::     shutdown_lifetime 0 seconds
#::     
#::     #Enable transparent proxy with SSL bump
#::     http_port  3126 intercept
#::     https_port 3127 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=16MB cert=/etc/squid/ssl_cert/myCA.pem
#::     http_port  3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=16MB cert=/etc/squid/ssl_cert/myCA.pem
#::     
#::     #Configure SSL Bump for all sites
#::     acl broken_sites dstdom_regex icicibank.com hdfcbank.com
#::     acl monitor_domains dstdom_regex youtube.com facebook.com ytimg.com googlevideo.com ggpht.com 
#::     acl monitor_domains2 dst 216.58.196.110 216.58.199.174  #youtube connect works over IP
#::     ssl_bump none localhost
#::     ssl_bump none broken_sites   #Avoid bumping financial sites such as banks
#::     ssl_bump server-first monitor_domains  #Bump facebook and youtube
#::     ssl_bump server-first monitor_domains2  #Since youtube bump fails with just domain also add youtube serverIP
#::
#::     #Configure hostname
#::     visible_hostname tproxy.purpletalk.com
#::     
#::     #Configure logging of query terms
#::     strip_query_terms off    #This will allow checking which youtube URLs were visited by user
#:</pre>
# Initialize SSL certificate directory
#:<pre>
#::     /usr/lib64/squid/ssl_crtd -c -s /var/lib/ssl_db
#::     chown -R squid:squid /var/lib/ssl_db/
#:</pre>
# After this try starting squid
#:<pre>
#::     systemctl start squid
#::     systemctl status squid
#::     systemctl enable squid
#:</pre>
#:: Ignore SELinux warnings related to certificate access to /var/lib/ssl_db
# Enable IP forwarding
#:<pre>
#::     sysctl net.ipv4.ip_forward=1
#:</pre>
# Create file '<tt>/etc/sysctl.d/ipv4_forward.conf</tt>' with following contents:
#:<pre>
#::     net.ipv4.ip_forward = 1
#:</pre>
# Labels interface internal and external appropriately by appending '<tt>ZONE=internal</tt>' or '<tt>ZONE=external</tt>' in '<tt>/etc/sysconfig/network-scripts/ifcfg-<interface></tt>' files.
# Set zones and verify settings:
#:<pre>
#::     systemctl restart network
#::     firewall-cmd --get-active-zones
#:</pre>
# Configure firewall rules for allowing access to incoming ports
#:<pre>
#::     firewall-cmd --zone=internal --add-port=3126/tcp --permanent
#::     firewall-cmd --zone=internal --add-port=3127/tcp --permanent
#::     firewall-cmd --zone=internal --add-port=3128/tcp --permanent
#:</pre>
# Use direct interface of firewalld to configure port redirection.    Edit file /etc/firewalld/direct.xml and put
#:<pre>
#::  <?xml version="1.0" encoding="utf-8"?>
#::  <direct>
#::      <rule ipv="ipv4" table="nat" chain="PREROUTING" priority="0">-i ens192 -p tcp --dport 80 -j REDIRECT --to-ports 3126</rule>
#::      <rule ipv="ipv4" table="nat" chain="PREROUTING" priority="0">-i ens192 -p tcp --dport 443 -j REDIRECT --to-ports 3127</rule>
#::  </direct>
#:</pre>
#::Replace internal interface name after "-i" in above XML file
# Enable and verify direct rules using:
#:<pre>
#::     firewall-cmd --reload
#::     firewall-cmd --direct --get-all-rules
#:</pre>
# Enable masquerade
#:<pre>
#::     firewall-cmd --permanent --zone=external --add-masquerade
#::     firewall-cmd --reload
#::     firewall-cmd --zone=external --list-all
#:</pre>
# Configure a browser with proxy:3128 and http browsing should work.  For https browsing certificate error should be shown.  Now import certificate exported earlier into browser and https should also work.  
# Configure browser for direct Internet access and everything should work.  Verify that logs in /var/log/squid/access.log are getting updated.

  
Suggestions
* Configure [[Squid log analysis using sarg]]
* Disable log deletion by editing /etc/logrotate.conf and setting rotate to 400.  Optionally uncomment "compress"
* Configure cache using "cache_dir aufs <cache-directory> <cache-size-in-MB> 16 256"
* Perform reboot by rebooting proxy and verifying that things continue to work properly after reboot.


Refer
* http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit for certificate creation
* http://www.codero.com/knowledge-base/questions/377/How+to+manage+firewall+rules+in+CentOS+7 for firewall rules in CentOS-7
* http://www.squid-cache.org/Versions/v3/3.3/cfgman/ssl_bump.html for Squid 3.3 SSL bump information
* CentOS 7 transparent squid complete guide http://docs.diladele.com/tutorials/transparently_filtering_https_centos/network.html




[[Main Page|Home]] > [[CentOS]] > [[CentOS 6.x]] > [[Squid proxy server configuration]] > [[Configure squid-3.3 in transparent mode on CentOS 7 with SSL bump]]