{"id":19552,"date":"2017-05-09T06:49:44","date_gmt":"2017-05-08T22:49:44","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/05\/09\/squid-proxy-server-ssl\/"},"modified":"2021-03-18T17:25:01","modified_gmt":"2021-03-18T09:25:01","slug":"squid-proxy-server-ssl","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/05\/09\/squid-proxy-server-ssl\/","title":{"rendered":"Squid Proxy Server SSL"},"content":{"rendered":"

\u53c3\u8003\u7db2\u7ad9\uff1a
SQUID Transparent Proxy (HTTP+HTTPs)<\/a>
\u8a2d\u5b9aSQUID \u6210\u70ba HTTP\/HTTPS \u4ee3\u7406\u4f3a\u670d\u5668\u53ca\u555f\u52d5 ICAP client\u529f\u80fd<\/a>
Jedi Linuxer: \u5229\u7528 Squid \u4ee3\u7406\u4f3a\u670d\u5668(Proxy)\u5206\u6790 HTTPS \u9023\u7dda\u5167\u5bb9<\/a>
Configure Squid as HTTP and HTTPS Transparent Proxy<\/a>
Configure squid-3.3 in transparent mode on CentOS 7 with SSL bum – Notes Wiki<\/a><\/p>\n

CentOS 7.x x64<\/span>
NAT Client\uff1a192.168.1.0\/24<\/span>
NAT Server\uff1a192.168.1.254<\/span>
1. \u5b89\u88dd perl-Crypt-OpenSSL-X509 \u5957\u4ef6
# yum install perl-Crypt-OpenSSL-X509 –enablerepo=epel<\/span><\/p>\n

2. \u521d\u59cb\u5316 Squid SSL DB
# \/usr\/lib64\/squid\/ssl_crtd -c -s \/var\/lib\/ssl_db<\/span>
Initialization SSL db…<\/span>
Done[@more@]<\/span>
3. \u6539\u8b8a\u64c1\u6709\u8005\u53ca\u7fa4\u7d44
# chown -R squid.squid \/var\/lib\/ssl_db<\/span><\/p>\n

4. \u5982\u679c\u6709\u958b\u555f SELinux
# chcon -R -u system_u -t squid_conf_t \/var\/lib\/ssl_db<\/span><\/p>\n

5. \u4fee\u6539 \/etc\/squid\/squid.conf<\/span>
\u00a0\u00a0\u00a0 \u50c5\u5217\u51fa\u7279\u5225\u4fee\u6539\u7684\u5730\u65b9
# vim \/etc\/squid\/squid.conf<\/span>
http_port 3130<\/span>
http_port 3128 intercept<\/span>
http_port 3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=\/etc\/squid\/ssl_cert\/myca.pem key=\/etc\/squid\/ssl_cert\/myca.pem<\/span><\/p>\n

#always_direct allow all<\/span>
ssl_bump server-first all<\/span>
#sslproxy_cert_error deny all<\/span>
#sslproxy_flags DONT_VERIFY_PEER<\/span><\/p>\n

sslcrtd_program \/usr\/lib64\/squid\/ssl_crtd -s \/var\/lib\/ssl_db -M 4MB<\/span>
sslcrtd_children 8 startup=1 idle=1<\/span><\/p>\n

coredump_dir \/var\/spool\/squid<\/span>
shutdown_lifetime 1 second<\/span><\/p>\n

6. \u4f7f\u7528 OpenSSL \u4f86\u5efa\u7acb Squid \u6191\u8b49
# cp \/etc\/pki\/tls\/openssl.cnf \/etc\/pki\/tls\/openssl.cnf.$(date +%F)<\/span>
# vim \/etc\/pki\/tls\/openssl.cnf<\/span>
default_days\u00a0\u00a0\u00a0 = 1365\u00a0\u00a0\u00a0\u00a0<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # how long to certify for<\/span><\/p>\n

[ req_distinguished_name ]<\/span>
countryName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = Country Name (2 letter code)<\/span>
countryName_default\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = TW<\/span><\/span>
countryName_min\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = 2<\/span>
countryName_max\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = 2<\/span><\/p>\n

stateOrProvinceName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = State or Province Name (full name)<\/span>
stateOrProvinceName_default\u00a0\u00a0\u00a0\u00a0 = Yilan<\/span><\/p>\n

localityName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = Locality Name (eg, city)<\/span>
localityName_default\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = TouCheng<\/span><\/span><\/p>\n

0.organizationName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = Organization Name (eg, company)<\/span>
0.organizationName_default\u00a0\u00a0\u00a0\u00a0\u00a0 = Elementary School<\/span><\/span><\/p>\n

# we can do this but it is not needed normally \ud83d\ude42<\/span>
#1.organizationName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = Second Organization Name (eg, company)<\/span>
#1.organizationName_default\u00a0\u00a0\u00a0\u00a0 = World Wide Web Pty Ltd<\/span><\/p>\n

organizationalUnitName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = Organizational Unit Name (eg, section)<\/span>
organizationalUnitName_default\u00a0 = Proxy Server<\/span><\/span><\/p>\n

commonName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = Common Name (eg, your name or your server’s hostname)<\/span>
commonName_default\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = proxy.test.ilc.edu.tw<\/span><\/span>
commonName_max\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = 64<\/span><\/p>\n

emailAddress\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = test@gmail.com<\/span><\/span>
emailAddress_max\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = 64<\/span><\/p>\n

7. \u5efa\u7acb\u76ee\u9304
# mkdir \/etc\/squid\/ssl_cert<\/span><\/p>\n

8. \u6539\u8b8a\u76ee\u9304\u64c1\u6709\u8005\u53ca\u7fa4\u7d44
# chown -R squid.squid \/etc\/squid\/ssl_cert<\/span><\/p>\n

9. \u5207\u63db\u76ee\u9304
# cd \/etc\/squid\/ssl_cert<\/span><\/p>\n

10. \u5efa\u7acb Server Key\uff0c\u6309 Enter \u9375\u5373\u53ef
# openssl req -new -newkey rsa:1024 -days 1365 -nodes -x509 -keyout myca.pem -out myca.pem<\/span>
Generating a 1024 bit RSA private key<\/span>
………………………………………..++++++<\/span>
………++++++<\/span>
writing new private key to ‘myca.pem’<\/span>
—–<\/span>
You are about to be asked to enter information that will be incorporated<\/span>
into your certificate request.<\/span>
What you are about to enter is what is called a Distinguished Name or a DN.<\/span>
There are quite a few fields but you can leave some blank<\/span>
For some fields there will be a default value,<\/span>
If you enter ‘.’, the field will be left blank.<\/span>
—–<\/span>
Country Name (2 letter code) [TW]:<\/span>
State or Province Name (full name) [Yilan]:<\/span>
Locality Name (eg, city) [TouCheng]:<\/span>
Organization Name (eg, company) [Elementary School]:<\/span>
Organizational Unit Name (eg, section) [Proxy Server]:<\/span>
Common Name (eg, your name or your server’s hostname) [proxy.test.ilc.edu.tw]:<\/span>
test@gmail.com []:<\/span><\/p>\n

11. \u5efa\u7acb Windows Client Key
# openssl x509 -in myca.pem -outform DER -out myca.der<\/span><\/p>\n

12. \u4fee\u6539\u9632\u706b\u7246\u8a2d\u5b9a
# iptables -t nat -A PREROUTING -p tcp -s 192.168.1.0\/24 –dport 80 -j DNAT –to 192.168.1.254:3128<\/span>
# iptables -t nat -A PREROUTING -p tcp -s 192.168.1.0\/24 –dport 443 -j DNAT –to 192.168.1.254:3129<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

\u53c3\u8003\u7db2\u7ad9\uff1aSQUID Transparent Proxy (HTTP+HTTPs)\u8a2d\u5b9aSQUID \u6210\u70ba HTT … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008Squid Proxy Server SSL\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[117,135,136],"tags":[],"class_list":["post-19552","post","type-post","status-publish","format-standard","hentry","category-c-78462","category-c-78480","category-c-78481"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["687970"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19552"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=19552"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19552\/revisions"}],"predecessor-version":[{"id":21064,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19552\/revisions\/21064"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=19552"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=19552"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=19552"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}