Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    HTTPS + Squidguard/Squid + Proxy Não Transparente

    Scheduled Pinned Locked Moved Portuguese
    21 Posts 3 Posters 6.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C Offline
      cristianonix
      last edited by

      Cola o log do squid pra mim ver.

      1 Reply Last reply Reply Quote 0
      • R Offline
        rbernardes
        last edited by

        Engraçado é que no log de acesso não mostra as requisições https feitas usando proxy:

        1343939556.543    28 192.168.1.248 TCP_MISS/403 708 GET http://weather.service.msn.com/data.aspx? - DIRECT/192.168.1.47 text/html
        1343939557.506    31 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
        1343939557.545    32 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
        1343939558.961    27 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
        1343939558.997    28 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
        1343939559.029    28 192.168.1.111 TCP_MISS/403 699 GET http://evsecure-crl.verisign.com/pca3-g5.crl - DIRECT/192.168.1.47 text/html
        1343939559.576    29 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
        1343939559.611    28 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
        1343939559.645    30 192.168.1.111 TCP_MISS/403 699 GET http://evsecure-crl.verisign.com/pca3-g5.crl - DIRECT/192.168.1.47 text/html
        1343939560.358    29 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
        1343939560.395    29 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
        1343939560.429    31 192.168.1.111 TCP_MISS/403 699 GET http://evsecure-crl.verisign.com/pca3-g5.crl - DIRECT/192.168.1.47 text/html
        1343939561.004    32 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
        1343939561.040    29 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
        1343939561.076    31 192.168.1.111 TCP_MISS/403 699 GET http://evsecure-crl.verisign.com/pca3-g5.crl - DIRECT/192.168.1.47 text/html
        1343939562.405    28 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
        1343939562.443    31 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
        1343939562.474    27 192.168.1.111 TCP_MISS/403 699 GET http://evsecure-crl.verisign.com/pca3-g5.crl - DIRECT/192.168.1.47 text/html

        1 Reply Last reply Reply Quote 0
        • C Offline
          cristianonix
          last edited by

          O browser tá orientado para o ip do proxy e porta ?

          1 Reply Last reply Reply Quote 0
          • R Offline
            rbernardes
            last edited by

            Tá sim!

            1 Reply Last reply Reply Quote 0
            • C Offline
              cristianonix
              last edited by

              Qual versão do squid voce tá usando ?

              1 Reply Last reply Reply Quote 0
              • R Offline
                rbernardes
                last edited by

                2.7.9 pkg v.4.3.1

                1 Reply Last reply Reply Quote 0
                • C Offline
                  cristianonix
                  last edited by

                  Cola a conf do squid?

                  1 Reply Last reply Reply Quote 0
                  • R Offline
                    rbernardes
                    last edited by

                    Do not edit manually !

                    http_port 192.168.1.47:3128
                    icp_port 0

                    pid_filename /var/run/squid.pid
                    cache_effective_user proxy
                    cache_effective_group proxy
                    error_directory /usr/local/etc/squid/errors/Portuguese
                    icon_directory /usr/local/etc/squid/icons
                    visible_hostname fwbnu.jm.com.br
                    cache_mgr ti@mainhardt.com.br
                    access_log /dev/null
                    cache_log /var/squid/logs/cache.log
                    cache_store_log none
                    logfile_rotate 0
                    shutdown_lifetime 3 seconds
                    uri_whitespace strip

                    cache_mem 8 MB
                    maximum_object_size_in_memory 32 KB
                    memory_replacement_policy heap GDSF
                    cache_replacement_policy heap LFUDA
                    cache_dir ufs /var/squid/cache 100 16 256
                    minimum_object_size 0 KB
                    maximum_object_size 10 KB
                    offline_mode off

                    No redirector configured

                    Setup some default acls

                    acl all src 0.0.0.0/0.0.0.0
                    acl localhost src 127.0.0.1/255.255.255.255
                    acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901  3128 1025-65535
                    acl sslports port 443 563 
                    acl manager proto cache_object
                    acl purge method PURGE
                    acl connect method CONNECT
                    acl dynamic urlpath_regex cgi-bin ?
                    acl allowed_subnets src 192.168.1.0/24 192.168.0.0/24 192.168.3.0/24
                    cache deny dynamic
                    http_access allow manager localhost

                    http_access deny manager
                    http_access allow purge localhost
                    http_access deny purge
                    http_access deny !safeports
                    http_access deny CONNECT !sslports

                    Always allow localhost connections

                    http_access allow localhost

                    request_body_max_size 0 KB
                    reply_body_max_size 0 deny all
                    delay_pools 1
                    delay_class 1 2
                    delay_parameters 1 -1/-1 -1/-1
                    delay_initial_bucket_level 100
                    delay_access 1 allow all

                    Custom options

                    redirect_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf
                    redirector_bypass on
                    redirect_children 3

                    Setup allowed acls

                    http_access allow allowed_subnets

                    Default block all to be sure

                    http_access deny all

                    1 Reply Last reply Reply Quote 0
                    • C Offline
                      cristianonix
                      last edited by

                      Senão me engano não precisa dessas duas linhas para o squidGuard funcionar:

                      redirector_bypass on
                      redirect_children 3

                      Testa e poste os resultados

                      1 Reply Last reply Reply Quote 0
                      • C Offline
                        cristianonix
                        last edited by

                        Só em setar o ip e a porta do proxy no navegação, o squid captura as conexões  HTTP/HTTPS.
                        No caso do proxy transparente ele não faz isso, apenas HTTP.

                        1 Reply Last reply Reply Quote 0
                        • R Offline
                          rbernardes
                          last edited by

                          Se eu vou no firewall e bloqueio todas as portas, menos a 3128, e saiu pelo squid, funciona beleza, mas não está bloqueando os sites https, como relatado acima.
                          Estas linhas que passasse foi o próprio squidguard que inseriu na conf, mas mesmo removendo o problema persiste.

                          1 Reply Last reply Reply Quote 0
                          • C Offline
                            cristianonix
                            last edited by

                            Te aconselho como amigo, usa o dansguardian ele bloqueia  https.

                            1 Reply Last reply Reply Quote 0
                            • R Offline
                              rbernardes
                              last edited by

                              Po, o squidguard ta rodando redondo.

                              1 Reply Last reply Reply Quote 0
                              • C Offline
                                cristianonix
                                last edited by

                                Faça um teste no squid então, vê se consegue bloquear.

                                acl httpsfail dst www.facebook.com
                                acl httpsfail dst www.orkut.com

                                http_access deny httpsfail CONNECT

                                1 Reply Last reply Reply Quote 0
                                • C Offline
                                  cristianonix
                                  last edited by

                                  Olha esse post.

                                  http://servercomputing.blogspot.com.br/2012/01/block-facebook-in-squid-proxy-server.html

                                  1 Reply Last reply Reply Quote 0
                                  • R Offline
                                    rbernardes
                                    last edited by

                                    Fui equivocado, não funcionou tambem…
                                    Nem com as dicas do site acima...

                                    1 Reply Last reply Reply Quote 0
                                    • C Offline
                                      cristianonix
                                      last edited by

                                      Tente bloquear a saida das portas pra fora.

                                      1 Reply Last reply Reply Quote 0
                                      • R Offline
                                        rbernardes
                                        last edited by

                                        Já estão, hoje todos saem pelo proxy.
                                        Senão não navegam.

                                        1 Reply Last reply Reply Quote 0
                                        • R Offline
                                          rbernardes
                                          last edited by

                                          up

                                          1 Reply Last reply Reply Quote 0
                                          • marcellocM Offline
                                            marcelloc
                                            last edited by

                                            Posso ter lido rápido demais mas não encontrei requisições https no seu log.

                                            Pode conferir como você definiu a GPO? na configuração do browser, normalmente selecionamos usar proxy para todos os protocolos.
                                            Pode ser que você tenha deixado proxy apenas para http.

                                            De qualquer forma, suas regras na lan devem bloquear acesso http e https a partir das estações. Se ja fez isso, verifique se não existe nenhuma regra antes da sua liberando tudo.

                                            att,
                                            Marcello Coutinho

                                            Treinamentos de Elite: http://sys-squad.com

                                            Help a community developer! ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.