Windows – Using squid to capture https – how to do non transparent proxy

httpssquidwindows

The root of the problem: I need to block access to https://somewebsite.com/folder/index.php; but allow access to the rest of the site. I thought the best way to accomplish it would be through a proxy like squid.

How can I accomplish my goal? Keep in mind I'm running squid 2.7 on a Windows 7 box and all the clients are also windows machines that I have full access to.

This is my first experience with squid, so any help is appreciated.

Best Answer

" Keep in mind I'm running squid 2.7 on a Windows 7 box and all the clients are also windows machines that I have full access to."

Yes you can,

here are the steps: => Install on the clients a certificate authority that you own ( for internet explorer you just have to install it at the system level in windows, for firefox and chrome you have to install it in every browser ) => At this point you can already use SslBump feature in squid to do what you want.

Alternatively you can also use an apache server with mod_proxy, IMHO it is easier to configure for doing what you want.

The key is to be able to generate a valid certificate for the target domain. So either you you own the domain and you can generate a perfectly valid certificate (via rapidssl or other ) and install it where you want, or if you can not have a "standard" certificate for the domain you need to have you own authority installed in the client software, and you just have to generate certificates with your own CA.

Then you just have to direct the traffic to a server ssl-enabled with your certificate - apache, squid, .. anything - and you can treat the traffic as plain http.

Update: squid 2.7 does not support SslBump. If you have to stick with squid 2.7 you have to configure an https_port as an accelerator and configure your client to use the different port for ssl connections to the https site you want to filter. For example alter their dns settings and put in place a proxy configuration telling them to not use the proxy for this site.

Correct way in new versions of nginx

Turn out my first answer to this question was correct at certain time, but it turned into another pitfall - to stay up to date please check Taxing rewrite pitfalls

I have been corrected by many SE users, so the credit goes to them, but more importantly, here is the correct code:

server {
       listen         80;
       server_name    my.domain.com;
       return         301 https://$server_name$request_uri;
}

server {
       listen         443 ssl;
       server_name    my.domain.com;
       # add Strict-Transport-Security to prevent man in the middle attacks
       add_header Strict-Transport-Security "max-age=31536000" always; 

       [....]
}

Squid proxy authentication – most painless way

I assume you are using an Active Directory server. We have done something similar and the easiest way was to use the ntlm_auth helper like this (part of my squid.conf):

auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 10
auth_param ntlm keep_alive on

You will have to install Samba and join your Windows domain. Your smb.conf will have to use these settings:

security = ADS
realm = your-dns-domain
password server = your-active-directory-server
winbind enum groups = yes
winbind enum users = yes
winbind uid = 10000-20000
winbind gid = 10000-20000
winbind use default domain = yes

I believe it was also necessary to alter the /etc/krb5.conf:

[libdefaults]
default_realm = your-dns-domain

[realms]
your-dns-domain = {
kdc = your-ad-server
}

Then you should be able to join your Windows domain:

net rpc join -S PDC -U Administrator

In the end you should have a setup that uses single-sign login from Windows. Both the Internet Explorer (in case you should seriously use it) as well as Firefox know how to send the authentication credentials.

For applications that don't know NTLM you may need to add a fallback to basic authentication, too. I haven't tested that, yet.

Links:

Best Answer

Related Solutions

NGINX Redirect – How to Rewrite All HTTP Requests to HTTPS While Maintaining Sub-Domain

Correct way in new versions of nginx

Squid proxy authentication – most painless way

Related Topic