Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    HTTPS + Squidguard/Squid + Proxy Não Transparente

    Scheduled Pinned Locked Moved Portuguese
    21 Posts 3 Posters 6.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R Offline
      rbernardes
      last edited by

      Engraçado é que no log de acesso não mostra as requisições https feitas usando proxy:

      1343939556.543    28 192.168.1.248 TCP_MISS/403 708 GET http://weather.service.msn.com/data.aspx? - DIRECT/192.168.1.47 text/html
      1343939557.506    31 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
      1343939557.545    32 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
      1343939558.961    27 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
      1343939558.997    28 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
      1343939559.029    28 192.168.1.111 TCP_MISS/403 699 GET http://evsecure-crl.verisign.com/pca3-g5.crl - DIRECT/192.168.1.47 text/html
      1343939559.576    29 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
      1343939559.611    28 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
      1343939559.645    30 192.168.1.111 TCP_MISS/403 699 GET http://evsecure-crl.verisign.com/pca3-g5.crl - DIRECT/192.168.1.47 text/html
      1343939560.358    29 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
      1343939560.395    29 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
      1343939560.429    31 192.168.1.111 TCP_MISS/403 699 GET http://evsecure-crl.verisign.com/pca3-g5.crl - DIRECT/192.168.1.47 text/html
      1343939561.004    32 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
      1343939561.040    29 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
      1343939561.076    31 192.168.1.111 TCP_MISS/403 699 GET http://evsecure-crl.verisign.com/pca3-g5.crl - DIRECT/192.168.1.47 text/html
      1343939562.405    28 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
      1343939562.443    31 192.168.1.111 TCP_MISS/403 689 POST http://evsecure-ocsp.verisign.com/ - DIRECT/192.168.1.47 text/html
      1343939562.474    27 192.168.1.111 TCP_MISS/403 699 GET http://evsecure-crl.verisign.com/pca3-g5.crl - DIRECT/192.168.1.47 text/html

      1 Reply Last reply Reply Quote 0
      • C Offline
        cristianonix
        last edited by

        O browser tá orientado para o ip do proxy e porta ?

        1 Reply Last reply Reply Quote 0
        • R Offline
          rbernardes
          last edited by

          Tá sim!

          1 Reply Last reply Reply Quote 0
          • C Offline
            cristianonix
            last edited by

            Qual versão do squid voce tá usando ?

            1 Reply Last reply Reply Quote 0
            • R Offline
              rbernardes
              last edited by

              2.7.9 pkg v.4.3.1

              1 Reply Last reply Reply Quote 0
              • C Offline
                cristianonix
                last edited by

                Cola a conf do squid?

                1 Reply Last reply Reply Quote 0
                • R Offline
                  rbernardes
                  last edited by

                  Do not edit manually !

                  http_port 192.168.1.47:3128
                  icp_port 0

                  pid_filename /var/run/squid.pid
                  cache_effective_user proxy
                  cache_effective_group proxy
                  error_directory /usr/local/etc/squid/errors/Portuguese
                  icon_directory /usr/local/etc/squid/icons
                  visible_hostname fwbnu.jm.com.br
                  cache_mgr ti@mainhardt.com.br
                  access_log /dev/null
                  cache_log /var/squid/logs/cache.log
                  cache_store_log none
                  logfile_rotate 0
                  shutdown_lifetime 3 seconds
                  uri_whitespace strip

                  cache_mem 8 MB
                  maximum_object_size_in_memory 32 KB
                  memory_replacement_policy heap GDSF
                  cache_replacement_policy heap LFUDA
                  cache_dir ufs /var/squid/cache 100 16 256
                  minimum_object_size 0 KB
                  maximum_object_size 10 KB
                  offline_mode off

                  No redirector configured

                  Setup some default acls

                  acl all src 0.0.0.0/0.0.0.0
                  acl localhost src 127.0.0.1/255.255.255.255
                  acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901  3128 1025-65535
                  acl sslports port 443 563 
                  acl manager proto cache_object
                  acl purge method PURGE
                  acl connect method CONNECT
                  acl dynamic urlpath_regex cgi-bin ?
                  acl allowed_subnets src 192.168.1.0/24 192.168.0.0/24 192.168.3.0/24
                  cache deny dynamic
                  http_access allow manager localhost

                  http_access deny manager
                  http_access allow purge localhost
                  http_access deny purge
                  http_access deny !safeports
                  http_access deny CONNECT !sslports

                  Always allow localhost connections

                  http_access allow localhost

                  request_body_max_size 0 KB
                  reply_body_max_size 0 deny all
                  delay_pools 1
                  delay_class 1 2
                  delay_parameters 1 -1/-1 -1/-1
                  delay_initial_bucket_level 100
                  delay_access 1 allow all

                  Custom options

                  redirect_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf
                  redirector_bypass on
                  redirect_children 3

                  Setup allowed acls

                  http_access allow allowed_subnets

                  Default block all to be sure

                  http_access deny all

                  1 Reply Last reply Reply Quote 0
                  • C Offline
                    cristianonix
                    last edited by

                    Senão me engano não precisa dessas duas linhas para o squidGuard funcionar:

                    redirector_bypass on
                    redirect_children 3

                    Testa e poste os resultados

                    1 Reply Last reply Reply Quote 0
                    • C Offline
                      cristianonix
                      last edited by

                      Só em setar o ip e a porta do proxy no navegação, o squid captura as conexões  HTTP/HTTPS.
                      No caso do proxy transparente ele não faz isso, apenas HTTP.

                      1 Reply Last reply Reply Quote 0
                      • R Offline
                        rbernardes
                        last edited by

                        Se eu vou no firewall e bloqueio todas as portas, menos a 3128, e saiu pelo squid, funciona beleza, mas não está bloqueando os sites https, como relatado acima.
                        Estas linhas que passasse foi o próprio squidguard que inseriu na conf, mas mesmo removendo o problema persiste.

                        1 Reply Last reply Reply Quote 0
                        • C Offline
                          cristianonix
                          last edited by

                          Te aconselho como amigo, usa o dansguardian ele bloqueia  https.

                          1 Reply Last reply Reply Quote 0
                          • R Offline
                            rbernardes
                            last edited by

                            Po, o squidguard ta rodando redondo.

                            1 Reply Last reply Reply Quote 0
                            • C Offline
                              cristianonix
                              last edited by

                              Faça um teste no squid então, vê se consegue bloquear.

                              acl httpsfail dst www.facebook.com
                              acl httpsfail dst www.orkut.com

                              http_access deny httpsfail CONNECT

                              1 Reply Last reply Reply Quote 0
                              • C Offline
                                cristianonix
                                last edited by

                                Olha esse post.

                                http://servercomputing.blogspot.com.br/2012/01/block-facebook-in-squid-proxy-server.html

                                1 Reply Last reply Reply Quote 0
                                • R Offline
                                  rbernardes
                                  last edited by

                                  Fui equivocado, não funcionou tambem…
                                  Nem com as dicas do site acima...

                                  1 Reply Last reply Reply Quote 0
                                  • C Offline
                                    cristianonix
                                    last edited by

                                    Tente bloquear a saida das portas pra fora.

                                    1 Reply Last reply Reply Quote 0
                                    • R Offline
                                      rbernardes
                                      last edited by

                                      Já estão, hoje todos saem pelo proxy.
                                      Senão não navegam.

                                      1 Reply Last reply Reply Quote 0
                                      • R Offline
                                        rbernardes
                                        last edited by

                                        up

                                        1 Reply Last reply Reply Quote 0
                                        • marcellocM Offline
                                          marcelloc
                                          last edited by

                                          Posso ter lido rápido demais mas não encontrei requisições https no seu log.

                                          Pode conferir como você definiu a GPO? na configuração do browser, normalmente selecionamos usar proxy para todos os protocolos.
                                          Pode ser que você tenha deixado proxy apenas para http.

                                          De qualquer forma, suas regras na lan devem bloquear acesso http e https a partir das estações. Se ja fez isso, verifique se não existe nenhuma regra antes da sua liberando tudo.

                                          att,
                                          Marcello Coutinho

                                          Treinamentos de Elite: http://sys-squad.com

                                          Help a community developer! ;D

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.