Results 1 to 6 of 6

Thread: Squid3 Won't start Deny cache and Allow SSL

  1. #1
    Join Date
    Mar 2014
    Beans
    50

    Squid3 Won't start Deny cache and Allow SSL

    Ok I had the Squid3 proxy running on the LAN and at least visible to the outside WAN

    It was refusing connections though (verified in log file)

    Problem I'm having now is the service won't start at all. Did a lot of reading and can't work it out.

    DO I NEED TO ADD ANYTHING?

    Here's my config:
    Code:
    #    STOP ALL CACHING
    cache deny all
    
    acl SSL_ports port 443
    acl Safe_ports port 80 # http
    acl Safe_ports port 21 # ftp
    acl Safe_ports port 443 # https
    acl Safe_ports port 70 # gopher
    acl Safe_ports port 210 # wais
    acl Safe_ports port 1025-65535 # unregistered ports
    acl Safe_ports port 280 # http-mgmt
    acl Safe_ports port 488 # gss-http
    acl Safe_ports port 591 # filemaker
    acl Safe_ports port 777 # multiling http
    acl CONNECT method CONNECT
    acl localnet src 10.1.1.1/32
    
    https_access allow SSL_ports
    #follow_x_forwarded_for deny all
    
    http_access allow localnet
    
    http_access allow manager localhost
    http_access deny manager
    
    http_access deny !Safe_ports
    
    http_access deny CONNECT !SSL_ports
    #http_access deny to_localhost
    
    http_access allow localhost
    
    # And finally deny all other access to this proxy
    http_access deny all
    
    icp_access deny localhost
    
    
    # Squid normally listens to port 3128
    http_port 3128
    
    
    access_log /var/log/squid3/access.log squid
    
    #cache_effective_group proxy

  2. #2
    Join Date
    Mar 2014
    Beans
    50

    Re: Squid3 Won't start Deny cache and Allow SSL

    Follow up: Commented out a lot of that to get it to start. Still not accepting connections though.
    Anyone know if the TCP_DENIED in the log means the config file needs to be change or is it a routing issue (I've set up inbound and outband LAN-to-WAN) I can see my remote client IP so I'm guessing I need to somehow "allow" connections properly.

  3. #3
    Join Date
    Mar 2006
    Location
    Williams Lake
    Beans
    Hidden!
    Distro
    Ubuntu Development Release

    Re: Squid3 Won't start Deny cache and Allow SSL

    this may be a better place for your thread.

  4. #4
    Join Date
    Nov 2008
    Location
    Metro Boston
    Beans
    9,041
    Distro
    Kubuntu 14.04 Trusty Tahr

    Re: Squid3 Won't start Deny cache and Allow SSL

    Quote Originally Posted by andrew102 View Post
    Ok I had the Squid3 proxy running on the LAN and at least visible to the outside WAN

    It was refusing connections though (verified in log file)
    Let's take a step back here. What do you mean by "visible to the outside WAN?" Do you want to able to use the proxy from outside your local network? That would create a major security problem unless you restrict access to known external IP addresses. What exactly do you want squid to do?

    I'm also unclear what you mean when you say the service "won't start at all?" When you start it with "sudo service squid start" what errors do you see? Does it not appear if you run "ps ax | grep squid"?

    SSL is another story entirely. Because of the way SSL uses certificates and encryption, there is little or nothing squid can do with an HTTPS request. The most recent releases of SSLBump provide some clever solutions to this problem, but they require complex configurations using an SSL certificate on the proxy and installation of compatible certificates on any browser using the proxy for HTTPS.
    Last edited by SeijiSensei; March 18th, 2014 at 02:19 PM.
    If you ask for help, please have the courtesy to check for responses and thank the people who helped you.

    Blog · Linode System Administration Guides · Android Apps for Ubuntu Users

  5. #5
    Join Date
    Mar 2007
    Beans
    781

    Re: Squid3 Won't start Deny cache and Allow SSL

    Pretty sure squid has a log file. Or can be grepped out of the log files.
    Registered Linux User: 450747 Registered Ubuntu User: 16269

  6. #6
    Join Date
    Mar 2014
    Beans
    50

    Re: Squid3 Won't start Deny cache and Allow SSL

    Quote Originally Posted by SeijiSensei View Post
    Let's take a step back here. What do you mean by "visible to the outside WAN?" Do you want to able to use the proxy from outside your local network? That would create a major security problem unless you restrict access to known external IP addresses. What exactly do you want squid to do?

    I'm also unclear what you mean when you say the service "won't start at all?" When you start it with "sudo service squid start" what errors do you see? Does it not appear if you run "ps ax | grep squid"?

    SSL is another story entirely. Because of the way SSL uses certificates and encryption, there is little or nothing squid can do with an HTTPS request. The most recent releases of SSLBump provide some clever solutions to this problem, but they require complex configurations using an SSL certificate on the proxy and installation of compatible certificates on any browser using the proxy for HTTPS.
    Basically we have a web-server that we block access to everyone except the work/office IP. (i.e. we don't want it visible to the public) We would have liked to allow people to work from home. The issue is people at home have dynamic IP's, so it's not simple enough to add them to the "allow" list.

    Our first solution was a VPN (for login authentication) unfortunately it wasn't returning pages properly (some content not viewable, etc.)

    So my other option was to use a proxy (with an authentication_helper)

    I'll have another look at the log tomorrow. I know there were no errors from the terminal after "sudo service squid3 start" just a "sudo service squid3 status" returned 'stopped/not running'.

    So you're saying squid won't simply parse SSL connections. The certificates are no problem seeing as we use a self-signed one anyway.

    Is there possibly another proxy solution that natively works with https requests?

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •