Problema com o HTTPS
1. Problema com o HTTPS
mthiagom
(usa CentOS)
Enviado em 31/03/2015 - 10:34h
Bom dia Amigos, gostaria da ajuda de vocês para o seguinte problema:Instalei o CentOS 6.6 em uma máquina para ser o proxy de uma rede pequena.
Configuração estilo Modem > Proxy > Switch > Computadores Interno
############Versão Squid############
[root@Linux squid]# squid -v
Squid Cache: Version 3.1.10
configure options: '--build=i386-redhat-linux-gnu' '--host=i386-redhat-linux-gnu' '--target=i686-redhat-linux-gnu' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib' '--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--enable-internal-dns' '--disable-strict-error-checking' '--exec_prefix=/usr' '--libexecdir=/usr/lib/squid' '--localstatedir=/var' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--with-logdir=$(localstatedir)/log/squid' '--with-pidfile=$(localstatedir)/run/squid.pid' '--disable-dependency-tracking' '--enable-arp-acl' '--enable-follow-x-forwarded-for' '--enable-auth=basic,digest,ntlm,negotiate' '--enable-basic-auth-helpers=LDAP,MSNT,NCSA,PAM,SMB,YP,getpwnam,multi-domain-NTLM,SASL,DB,POP3,squid_radius_auth' '--enable-ntlm-auth-helpers=smb_lm,no_check,fakeauth' '--enable-digest-auth-helpers=password,ldap,eDirectory' '--enable-negotiate-auth-helpers=squid_kerb_auth' '--enable-external-acl-helpers=ip_user,ldap_group,session,unix_group,wbinfo_group' '--enable-cache-digests' '--enable-cachemgr-hostname=localhost' '--enable-delay-pools' '--enable-epoll' '--enable-icap-client' '--enable-ident-lookups' '--with-large-files' '--enable-linux-netfilter' '--enable-referer-log' '--enable-removal-policies=heap,lru' '--enable-snmp' '--enable-ssl' '--enable-storeio=aufs,diskd,ufs' '--enable-useragent-log' '--enable-wccpv2' '--enable-esi' '--with-aio' '--with-default-user=squid' '--with-filedescriptors=16384' '--with-dl' '--with-openssl' '--with-pthreads' 'build_alias=i386-redhat-linux-gnu' 'host_alias=i386-redhat-linux-gnu' 'target_alias=i686-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m32 -march=i686 -mtune=atom -fasynchronous-unwind-tables -fpie' 'LDFLAGS=-pie' 'CXXFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m32 -march=i686 -mtune=atom -fasynchronous-unwind-tables -fpie' --with-squid=/builddir/build/BUILD/squid-3.1.10
############IpTables############
[root@Linux squid]# iptables-save
# Generated by iptables-save v1.4.7 on Tue Mar 31 10:09:07 2015
*filter
:INPUT ACCEPT [973228:510097183]
:FORWARD ACCEPT [5156489:3941376106]
:OUTPUT ACCEPT [1090823:571286165]
COMMIT
# Completed on Tue Mar 31 10:09:07 2015
# Generated by iptables-save v1.4.7 on Tue Mar 31 10:09:07 2015
*nat
:PREROUTING ACCEPT [1812954:152357505]
:POSTROUTING ACCEPT [42:6730]
:OUTPUT ACCEPT [1337615:80329422]
-A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Tue Mar 31 10:09:07 2015
############Squid.Conf############
[root@Linux squid]# vim squid.conf
http_port 3128 transparent
#https_port 3130 transparent cert=/etc/squid/openssl.crt key=/etc/squid/openssl.key
cache_mem 32 MB
logformat squid %tl %>a %Ss/%03>Hs %<st %rm %ru %un %Sh/%<A %mt
access_log /var/log/squid/access.log squid
#cache_access_log /var/log/squid/access.log
visible_hostname squid.server
#
# Recommended minimum configuration:
#
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.1.0/24 # RFC1918 internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
acl liberatudo arp "/etc/squid/regras/liberatudo.txt"
acl listabranca url_regex -i "/etc/squid/regras/listabranca.txt"
acl listanegra url_regex -i "/etc/squid/regras/listanegra.txt"
acl almoco time 12:00-13:00
#
# Recommended minimum Access Permission configuration:
#
# Only allow cachemgr access from localhost
http_access allow liberatudo
http_access allow listabranca
http_access allow almoco
http_access deny listanegra
http_access deny manager localhost
http_access deny manager
http_access deny all
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost
# And finally deny all other access to this proxy
http_access allow all
# Squid normally listens to port 3128
#http_port 3128
# We recommend you to use at least the following line.
hierarchy_stoplist cgi-bin ?
# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /var/spool/squid 100 16 256
# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid
# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
# Travando micros locais para usaram o proxy
#****Importante essas duas Linhas estarem no final do arquivo***
#http_access allow localnet
#http_access allow localhost
############Configuração IP############
[root@Linux squid]# ifconfig
eth0 Link encap:Ethernet Endereço de HW 00:1A:4D:99:0E:6A
inet end.: 192.168.10.64 Bcast:192.168.10.255 Masc:255.255.255.0
endereço inet6: fe80::21a:4dff:fe99:e6a/64 Escopo:Link
UP BROADCASTRUNNING MULTICAST MTU:1500 Métrica:1
RX packets:98485685 errors:0 dropped:0 overruns:0 frame:0
TX packets:75337336 errors:0 dropped:0 overruns:0 carrier:0
colisões:0 txqueuelen:1000
RX bytes:93866838827 (87.4 GiB) TX bytes:16169541846 (15.0 GiB)
IRQ:23
eth1 Link encap:Ethernet Endereço de HW 00:E0:7D:B4:97:2F
inet end.: 192.168.1.1 Bcast:192.168.1.255 Masc:255.255.255.0
endereço inet6: fd0b:d9d8:9e3d:0:2e0:7dff:feb4:972f/64 Escopo:Global
endereço inet6: fe80::2e0:7dff:feb4:972f/64 Escopo:Link
UP BROADCASTRUNNING MULTICAST MTU:1500 Métrica:1
RX packets:74521184 errors:0 dropped:0 overruns:0 frame:0
TX packets:102313136 errors:0 dropped:0 overruns:0 carrier:0
colisões:0 txqueuelen:1000
RX bytes:16175339659 (15.0 GiB) TX bytes:95895998394 (89.3 GiB)
IRQ:17 Endereço de E/S:0xc000
lo Link encap:Loopback Local
inet end.: 127.0.0.1 Masc:255.0.0.0
endereço inet6: ::1/128 Escopo:Máquina
UP LOOPBACKRUNNING MTU:65536 Métrica:1
RX packets:12173 errors:0 dropped:0 overruns:0 frame:0
TX packets:12173 errors:0 dropped:0 overruns:0 carrier:0
colisões:0 txqueuelen:0
RX bytes:1028366 (1004.2 KiB) TX bytes:1028366 (1004.2 KiB)
############Tentativas############
Com algumas variações todos os tutoriais que achei ensinam a fazer algum dos dois passos abaixo:
1) # Fiz o bloqueio de HTTPS no Squid Transparente usando:
openssl genrsa -des3 -out openssl.key 1024
openssl req -new -key openssl.key -out openssl.csr
cp openssl.key openssl.key.old
openssl rsa -in openssl.key.old -out openssl.key
openssl x509 -req -days 365 -in openssl.csr -signkey openssl.key -out openssl.crt
# Squid.conf:
https_port 3130 transparent cert=/etc/squid/openssl.crt key=/etc/squid/openssl.key
# iptables:
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 443 -j REDIRECT --to-port 3130
2) Colocar a seguinte regra no Iptables
iptables -t filter -A OUTPUT -p tcp -m multiport --dport http,https -m owner ! --uid-owner squid -j REJECT --reject-with tcp-reset
############Meu Problema############
Consigo fazer filtro e bloquear tudo que passa pela porta 80, porém não estou conseguindo fazer a mesma coisa com a porta 443, obviamente devido ao protocolo seguro.
Desejo bloquear facebook, youtube. Porém preciso deixar aberto Google Apps e Bancos.
Na tentativa 1 consigo bloquear tudo porém banco não está aceitando o direcionamento de porta mesmo importando o certificado criado no proxy nas máquinas clientes.
Na tentativa 2 acontece nada.
Se eu colocar as configurações de proxy nas máquinas clientes já resolve o meu problema para tudo, porém qualquer usuário pode ir lá retirar ela e fica de boa com os https.
Apesar de as saída ser a autenticação com usuário e senha no squid ou via GPO, não gostaria de usar esta solução.
Com os meus arquivos de configuração postados alguém poderia dar algumas sugestões?
Principalmente uma forma de bloquear o acesso a internet se a configuração do proxy não estiver explicita nas máquinas clientes.