no way to compare when less than two revisions
Differences
This shows you the differences between two versions of the page.
| — | linux_faq:transparent_squid_proxy_with_ssl_bumping [2020/11/19 20:29] (current) – created admin | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| + | ===== Рабочий вариант Squid transparent proxy с поддержкой SSL без подмены сертификатов ===== | ||
| + | По мотивам https:// | ||
| + | Собираю на **Ubuntu 19.04**. \\ | ||
| + | Вот пакеты, | ||
| + | Для начала - включаем **deb-src** репозитории в **/ | ||
| + | Ставим запчасти для сборки и исходники squid: | ||
| + | < | ||
| + | sudo apt-get install git fakeroot build-essential devscripts checkinstall | ||
| + | sudo apt-get build-dep squid | ||
| + | sudo apt-get build-dep libecap | ||
| + | sudo apt-get install libssl-dev libgnutls28-dev | ||
| + | </ | ||
| + | ==== Сборка LibreSSL - не обязательно ==== | ||
| + | Скачиваем, | ||
| + | < | ||
| + | wget http:// | ||
| + | tar -xvf ./ | ||
| + | cd libressl-2.9.2/ | ||
| + | |||
| + | ./ | ||
| + | make | ||
| + | sudo checkinstall --pkgname libressl --pkgversion 2.9.2 | ||
| + | sudo dpkg -i ./ | ||
| + | |||
| + | sudo ldconfig | ||
| + | |||
| + | sudo mv / | ||
| + | sudo update-alternatives --install / | ||
| + | sudo update-alternatives --install / | ||
| + | sudo update-alternatives --config openssl | ||
| + | </ | ||
| + | |||
| + | Проверяем, | ||
| + | $ openssl version | ||
| + | LibreSSL 2.9.2 | ||
| + | |||
| + | ==== Сборка libecap ==== | ||
| + | cd .. | ||
| + | apt-get source libecap | ||
| + | | ||
| + | cd libecap-1.0.1/ | ||
| + | dpkg-buildpackage -us -uc -nc -d | ||
| + | cd .. | ||
| + | sudo apt-get purge libecap3 | ||
| + | sudo dpkg -i ./ | ||
| + | sudo dpkg -i ./ | ||
| + | |||
| + | ==== Сборка Squid с поддержкой ssl_bump ==== | ||
| + | apt-get source squid | ||
| + | cd squid-4.4/ | ||
| + | внесем в **debian/ | ||
| + | < | ||
| + | --enable-ssl-crtd | ||
| + | --with-openssl | ||
| + | </ | ||
| + | Отключаем проверку зависимостей: | ||
| + | export DEB_DH_SHLIBDEPS_ARGS_ALL=--dpkg-shlibdeps-params=--ignore-missing-info | ||
| + | Собираем: | ||
| + | dpkg-buildpackage -us -uc -nc | ||
| + | ==== Установка собранного squid ==== | ||
| + | Удаляем старый **squid** и **squid-common**: | ||
| + | sudo apt-get -y purge squid squid-common squid3 squidclient | ||
| + | Устанавливаем свежесобранные пакеты: | ||
| + | sudo apt-get install squid-langpack libdbi-perl | ||
| + | sudo dpkg -i ../ | ||
| + | sudo dpkg -i ../ | ||
| + | Запрещаем обновление из репозиториев: | ||
| + | echo "squid hold" | sudo dpkg --set-selections | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | |||
| + | ==== Настройка squid ==== | ||
| + | Инициализируем базу сертификатов: | ||
| + | sudo / | ||
| + | Прописываем в конфигурационный файл **squid**' | ||
| + | < | ||
| + | acl pvenet src 192.168.122.0/ | ||
| + | acl dockernet src 172.0.0.0/ | ||
| + | |||
| + | acl SSL_ports port 443 | ||
| + | acl CONNECT method CONNECT | ||
| + | |||
| + | dns_nameservers 127.0.0.53 | ||
| + | |||
| + | http_access deny CONNECT !SSL_ports | ||
| + | |||
| + | # | ||
| + | # | ||
| + | |||
| + | http_access allow localnet | ||
| + | http_access allow dockernet | ||
| + | http_access allow pvenet | ||
| + | http_access allow localhost | ||
| + | # | ||
| + | |||
| + | # | ||
| + | http_port 3128 intercept | ||
| + | |||
| + | visible_hostname 127.0.0.1: | ||
| + | |||
| + | # | ||
| + | https_port 3129 intercept ssl-bump options=ALL: | ||
| + | |||
| + | sslproxy_cert_error allow all | ||
| + | sslproxy_flags DONT_VERIFY_PEER | ||
| + | |||
| + | # ssl_bump option splice just tunneling connection | ||
| + | ssl_bump splice all | ||
| + | |||
| + | sslcrtd_program / | ||
| + | |||
| + | coredump_dir / | ||
| + | refresh_pattern ^ftp: | ||
| + | refresh_pattern ^gopher: | ||
| + | refresh_pattern -i (/ | ||
| + | refresh_pattern . | ||
| + | cache_dir aufs / | ||
| + | maximum_object_size 61440 KB | ||
| + | minimum_object_size 3 KB | ||
| + | |||
| + | cache_swap_low 90 | ||
| + | cache_swap_high 95 | ||
| + | maximum_object_size_in_memory 512 KB | ||
| + | memory_replacement_policy lru | ||
| + | logfile_rotate 4 | ||
| + | |||
| + | cache_peer 10.77.70.7 parent 3128 0 no-query default login=login: | ||
| + | # | ||
| + | # | ||
| + | never_direct allow all | ||
| + | </ | ||
| + | перезапускаем squid: | ||
| + | sudo service squid restart | ||
| + | |||
| + | ==== настройка iptables ==== | ||
| + | Перенаправляем все локальные исходящие подключения к портам 80 и 443 на локальный **squid**, за исключением локальных подключений и подключений к локальным сетям: | ||
| + | sudo iptables -t nat -A PREROUTING -d 10.77.0.0/ | ||
| + | sudo iptables -t nat -A PREROUTING -d 0.0.0.0/8 -j RETURN | ||
| + | sudo iptables -t nat -A PREROUTING -d 127.0.0.0/8 -j RETURN | ||
| + | |||
| + | sudo iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128 | ||
| + | sudo iptables -t nat -A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3129 | ||
| + | |||
| + | Устанавливаем **iptables-persistent** для автоматического применения правил после рестара: | ||
| + | sudo apt-get install iptables-persistent | ||
| + | на вопрос о сохранении текущих правил отвечаем положительно. Правила лежат в файлике **/ | ||
| + | В дальнейшем сохраняем правила так: | ||
| + | sudo iptables-save | sudo tee / | ||