aapa_05
(usa CentOS)
Enviado em 30/08/2016 - 11:25h
Bom dia
Pelo que tinha pesquisado, uma das deficiências do Squid seria justamente o não bloqueio dos https, que permitiria ao usuário acessar outros proxies e burlar o squid.
Pensei então em fazer o bloqueio pelo IPTbables, que não consigo instalar no Debian, que tem o Firewalld, mas que não conheço muito bem.
Pelos problemas apresentados na instalação do IPtables no Debian, parti então para a avaliação do CentOS, que trouxe o IPtables instalado.
Acredito que as liberações do https sejam na acl “acl Safe_ports port 443 # https”, que não está comentada, e na sequência tem uma restrição “http_access deny !Safe_ports”.
Está configurado assim nos dois Squids.
Fui eu que fiz a instalação do Debian assim como do CentOS, assim como os Squids
Os squid.conf são os que vieram com a instalação, não foi feita nenhuma remoção, ou criação de um novo .conf.
Se eu listo as regras do IPtables, nenhuma regra é exibida.
Abaixo as 50 primeiras linhas:
*************** Debian **************
# WELCOME TO SQUID 3.4.8
# ----------------------------
#
# This is the documentation for the Squid configuration file.
# This documentation can also be found online at:
#
http://www.squid-cache.org/Doc/config/">
http://www.squid-cache.org/Doc/config/
#
# You may wish to look at the Squid home page and wiki for the
# FAQ and other documentation:
#
http://www.squid-cache.org/
#
http://wiki.squid-cache.org/SquidFaq
#
http://wiki.squid-cache.org/ConfigExamples
#
# This documentation shows what the defaults for various directives
# happen to be. If you don't need to change the default, you should
# leave the line out of your squid.conf in most cases.
#
# In some cases "none" refers to no default setting at all,
# while in other cases it refers to the value of the option
# - the comments for that keyword indicate if this is the case.
#
# Configuration options can be included using the "include" directive.
# Include takes a list of files to include. Quoting and wildcards are
# supported.
#
# For example,
#
# include /path/to/included/file/squid.acl.config
#
# Includes can be nested up to a hard-coded depth of 16 levels.
# This arbitrary restriction is to prevent recursive include references
# from causing Squid entering an infinite loop whilst trying to load
# configuration files.
#
# Values with byte units
#
# Squid accepts size units on some size related directives. All
# such directives are documented with a default value displaying
# a unit.
#
# Units accepted by Squid are:
# bytes - byte
# KB - Kilobyte (1024 bytes)
# MB - Megabyte
# GB - Gigabyte
#
# Values with spaces, quotes, and other special characters
#
# Squid supports directive parameters with spaces, quotes, and other
**************** Centos ****************
# Recommended minimum configuration:
#
# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
#acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
#acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
#acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
#acl localnet src fc00::/7 # RFC 4193 local private network range
#acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
acl acesso_total src "/etc/squid/acesso_total"
acl acesso_restrito src "/etc/squid/acesso_restrito"
#acl liberado src "/etc/squid/liberado"
acl bloqueado url_regex -i "/etc/squid/bloqueado"
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
#
# Recommended minimum Access Permission configuration:
#
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost
#
