RE: [squid-users] Allow untrusted ssl connections from Chad Naugle on 2010-12-29 (squid-users)

From: Chad Naugle <Chad.Naugle_at_travimp.com>
Date: Wed, 29 Dec 2010 17:20:32 -0500

Well, if it's not a public / private corp's network, it's probably just
safe to comment that back out for the SSL_ports ACL, I suppose.

---------------------------------------------
Chad E. Naugle
Tech Support II, x. 7981
Travel Impressions, Ltd.

>>> "Charles Roper" <charlzroper_at_gmail.com> 12/29/2010 4:26 PM >>>
The start-up issue is fixed! Thanks. I found "squid" in
"/etc/rc.d/init.d"
and updated all references to the new location of the PID file. Worked
like
a charm.

Still having trouble accessing sites over untrusted ssl connections
though
(https, ports 2087, 2083, 2096, etc.)

I uncommented "http_access deny to_localhost" as you requested. Yes,
the
squid box's ip is 10.10.10.10.

I read the acl link you provided.

I use this box to SSH in and use the proxy server via tunnel. (i.e. I
use
putty to connect, and I have a tunnel configured to redirect port 80
traffic
to "localhost:8080")

-----Original Message-----
From: Chad Naugle [mailto:Chad.Naugle_at_travimp.com]
Sent: Wednesday, December 29, 2010 12:16 PM
To: Charles Roper
Cc: squid-users_at_squid-cache.org
Subject: RE: [squid-users] Allow untrusted ssl connections

You've stated as the below was how you were starting Squid.

[root_at_maya ~]# /etc/init.d/squid start
Starting squid: .................... [FAILED]

......

Try to see if there is a "/etc/rc.d/init.d" instead, and then edit
"squid"
to find where it's looking for the PID file.

Also, please uncomment "http_access deny to_localhost", and I am
assuming
that your local network in question is 10.10.10.0-255?

Recommended Reading about ACL's and http_access controls --
http://www.visolve.com/squid/squid27/accesscontrols.php#top

---------------------------------------------
Chad E. Naugle
Tech Support II, x. 7981
Travel Impressions, Ltd.

>>> "Charles Roper" <charlzroper_at_gmail.com> 12/29/2010 2:57 PM >>>
There is no "init.d" folder within the "etc" directory.

Here are my http_access lines:

############################################################
# http_access deny all
#############################################################
#Recommended minimum configuration:
#############################################################
# Only allow cachemgr access from localhost
############################################################
http_access allow manager localhost
############################################################
http_access deny manager
############################################################
# Deny requests to unknown ports
############################################################
http_access deny !Safe_ports
############################################################
# Deny CONNECT to other than SSL ports
############################################################
http_access deny CONNECT !SSL_ports
############################################################
# We strongly recommend the following be uncommented to protect
innocent #
web applications running on the proxy server who think the only # one
who
can access services on "localhost" is a local user #http_access deny
to_localhost # # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM
YOUR
CLIENTS # Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
#
from where browsing should be allowed
############################################################
http_access allow localnet
############################################################
# And finally deny all other access to this proxy
############################################################
http_access allow localhost
############################################################
http_access deny all
############################################################

-----Original Message-----
From: Chad Naugle [mailto:Chad.Naugle_at_travimp.com]
Sent: Wednesday, December 29, 2010 7:14 AM
To: Charles Roper
Cc: squid-users_at_squid-cache.org
Subject: RE: [squid-users] Allow untrusted ssl connections

For the startup issue, edit the /etc/init.d/squid - script and check
the PID
file path. It may not be pointing to the Squid path of
/var/log/squid/run,
which I also believe is configurable by /etc/squid/squid.conf.

For the access issue, paste your http_access lines, and please use '#'
comments above each set of lines to be sure.

---------------------------------------------
Chad E. Naugle
Tech Support II, x. 7981
Travel Impressions, Ltd.

>>> "Charles Roper" <charlzroper_at_gmail.com> 12/28/2010 5:01 PM >>>
Chad - I really appreciate your help.

I configured ACL as you suggested, uncommented the line you requested,
and
Firefox is throwing errors again.

acl Safe_ports port 2087# whm
acl SSL_ports port 2087# whm
acl Safe_ports port 2083# cpanel
acl SSL_ports port 2083# cpanel
acl Safe_ports port 2096# webmail
acl SSL_ports port 2096# webmail

Firefox error:
------------------------------------------------------
The connection has timed out
The server at x.x.x.x is taking too long to respond.
    * The site could be temporarily unavailable or too busy. Try
again in
a few
          moments.
    * If you are unable to load any pages, check your computer's
network
          connection.
    * If your computer or network is protected by a firewall or
proxy,
make sure
          that Firefox is permitted to access the Web.
---------------------------------------------------------
*That was trying to connect via https over port 2083.

(regarding the commenting out of the !SSL line, is that insecure even
though
I'm the only one who will ever be accessing this proxy server?)

Regarding the starting/stopping... I issued the commands you suggested
and
deleted PID file.

Although Squid does start, it still reports as "Failed" for some
reason.

[root_at_maya ~]# ps -aux | grep squid
Warning: bad syntax, perhaps a bogus '-'? See
/usr/share/doc/procps-3.2.7/FAQ
root 3671 0.0 0.0 3920 692 pts/0 S+ 13:52 0:00 grep
squid
[root_at_maya ~]# /etc/init.d/squid start
Starting squid: .................... [FAILED]
[root_at_maya ~]# ps -aux | grep squid
Warning: bad syntax, perhaps a bogus '-'? See
/usr/share/doc/procps-3.2.7/FAQ
root 3681 0.0 0.1 7952 1128 ? Ss 13:53 0:00 squid
-D
squid 3683 0.0 0.6 10668 6444 ? S 13:53 0:00
(squid) -D
squid 3685 0.0 0.0 1520 216 ? S 13:53 0:00
(unlinkd)
root 3713 0.0 0.0 3920 692 pts/0 S+ 13:58 0:00 grep
squid

-----Original Message-----
From: Chad Naugle [mailto:Chad.Naugle_at_travimp.com]
Sent: Tuesday, December 28, 2010 1:42 PM
To: Charles Roper
Cc: squid-users_at_squid-cache.org
Subject: RE: [squid-users] Allow untrusted ssl connections

Make sure squid is not running, by doing a: "ps -aux | grep squid", and
then
delete the PID file.

ALSO, do NOT comment that line out. Simply add the port(s) that you
are
using to the ACL, as opposed to just port 443, by simply adding lines.

Example for Novell's Remote Manager, etc. By default Squid only
allows
selected ports in the same manner.

acl Safe_ports port 8008
acl Safe_ports port 8009
acl SSL_ports port 8009

In your case, I am assuming you should use:

acl SSL_ports port 2096

---------------------------------------------
Chad E. Naugle
Tech Support II, x. 7981
Travel Impressions, Ltd.

>>> "Charles Roper" <charlzroper_at_gmail.com> 12/28/2010 4:34 PM >>>
Ok, I've upgraded to 2.7 STABLE9, created that directory you mentioned,
and
I can get it to start via "# squid start"

For some reason, "# /etc/init.d/squid start" and "# /etc/init.d/squid
restart" just time out with "FAILED" ... but at least it's starting
now.

I'm also having problems stopping:

[root_at_maya ~]# squid stop
2010/12/28 13:24:44| Squid is already running! Process ID 3333

I think I fixed the "untrusted connection" issue by commenting out the
following line:

http_access deny CONNECT !SSL_ports

**note, I tried that in v2.6 and it didn't make a difference**

Any ideas on how I can resolve the starting/stopping problems I'm now
experiencing? Thanks!

-----Original Message-----
From: Chad Naugle [mailto:Chad.Naugle_at_travimp.com]
Sent: Tuesday, December 28, 2010 12:16 PM
To: Charles Roper
Cc: squid-users_at_squid-cache.org
Subject: RE: [squid-users] Allow untrusted ssl connections

Looks like the default settings. Perhaps someone can also chip in
some
configuration suggestions, but I do notice that the PID file directory
might
not exist, or squid doesn't have access to it.

---------------------------------------------
Chad E. Naugle
Tech Support II, x. 7981
Travel Impressions, Ltd.

>>> "Charles Roper" <charlzroper_at_gmail.com> 12/28/2010 2:28 PM >>>
Well, with a little help, I was able to update to 2.7, but now I can't
start
it. Here is cache.log:
----------------------------------------------
2010/12/28 04:20:12| Starting Squid Cache version 2.7.STABLE9 for
i386-redhat-linux-gnu...
2010/12/28 04:20:12| Process ID 3202
2010/12/28 04:20:12| With 1024 file descriptors available
2010/12/28 04:20:12| Using epoll for the IO loop
2010/12/28 04:20:12| DNS Socket created at 0.0.0.0, port 53333, FD 6
2010/12/28 04:20:12| Adding nameserver 10.10.10.1 from
/etc/resolv.conf
2010/12/28 04:20:12| User-Agent logging is disabled.
2010/12/28 04:20:12| Referer logging is disabled.
2010/12/28 04:20:12| logfileOpen: opening log
/var/log/squid/access.log
2010/12/28 04:20:12| Unlinkd pipe opened on FD 11
2010/12/28 04:20:12| Swap maxSize 2048000 + 262144 KB, estimated
177703
objects
2010/12/28 04:20:12| Target number of buckets: 8885
2010/12/28 04:20:12| Using 16384 Store buckets
2010/12/28 04:20:12| Max Mem size: 262144 KB
2010/12/28 04:20:12| Max Swap size: 2048000 KB
2010/12/28 04:20:12| Local cache digest enabled; rebuild/rewrite every
3600/3600 sec
2010/12/28 04:20:12| logfileOpen: opening log /var/log/squid/store.log
2010/12/28 04:20:12| Rebuilding storage in /var/spool/squid (DIRTY)
2010/12/28 04:20:12| Using Least Load store dir selection
2010/12/28 04:20:12| Set Current Directory to /var/spool/squid
2010/12/28 04:20:12| Loaded Icons.
2010/12/28 04:20:12| Accepting proxy HTTP connections at 0.0.0.0, port
8080,
FD 13.
2010/12/28 04:20:12| Accepting ICP messages at 0.0.0.0, port 3130, FD
14.
2010/12/28 04:20:12| WCCP Disabled.
2010/12/28 04:20:12| /var/log/squid/run/squid.pid: (2) No such file or
directory
2010/12/28 04:20:12| WARNING: Could not write pid file
2010/12/28 04:20:12| Ready to serve requests.
2010/12/28 04:20:12| Done reading /var/spool/squid swaplog (747
entries)
2010/12/28 04:20:12| Finished rebuilding storage from disk.
2010/12/28 04:20:12| 747 Entries scanned
2010/12/28 04:20:12| 0 Invalid entries.
2010/12/28 04:20:12| 0 With invalid flags.
2010/12/28 04:20:12| 747 Objects loaded.
2010/12/28 04:20:12| 0 Objects expired.
2010/12/28 04:20:12| 0 Objects cancelled.
2010/12/28 04:20:12| 0 Duplicate URLs purged.
2010/12/28 04:20:12| 0 Swapfile clashes avoided.
2010/12/28 04:20:12| Took 0.3 seconds (2547.6 objects/sec).
2010/12/28 04:20:12| Beginning Validation Procedure
2010/12/28 04:20:12| Completed Validation Procedure
2010/12/28 04:20:12| Validated 747 Entries
2010/12/28 04:20:12| store_swap_size = 7200k
2010/12/28 04:20:13| storeLateRelease: released 0 objects
----------------------------------------------------------

You just want me to copy/paste squid.conf?

-----Original Message-----
From: Chad Naugle [mailto:Chad.Naugle_at_travimp.com]
Sent: Tuesday, December 28, 2010 10:47 AM
To: Charles Roper
Cc: squid-users_at_squid-cache.org
Subject: RE: [squid-users] Allow untrusted ssl connections

Okay, then please simply post the current squid.conf first -- chances
are,
it sounds like its not configured correctly, between that, and your
browser
configuration.

---------------------------------------------
Chad E. Naugle
Tech Support II, x. 7981
Travel Impressions, Ltd.

>>> "Charles Roper" <charlzroper_at_gmail.com> 12/28/2010 1:23 PM >>>
Any advice on how best to do that? This is my first linux box and I
created
it precisely to use it as a Squid Proxy. This steep learning curve is
kind
of intimidating :/

-----Original Message-----
From: Chad Naugle [mailto:Chad.Naugle_at_travimp.com]
Sent: Tuesday, December 28, 2010 10:05 AM
To: Charles Roper
Cc: squid-users_at_squid-cache.org
Subject: RE: [squid-users] Allow untrusted ssl connections

Okay ... Firstly, you should probably compile an updated version of
Squid,
using either the 2.7 or 3.1 branch from http://www.squid-cache.org, and
then
install it. That version of Squid is probably only current for your
install
of CentOS.

Then post your configuration, it should be under /etc/squid, called
squid.conf.

---------------------------------------------
Chad E. Naugle
Tech Support II, x. 7981
Travel Impressions, Ltd.

>>> "Charles Roper" <charlzroper_at_gmail.com> 12/28/2010 12:52 PM >>>
Of course, sorry.

squid-2.6.STABLE21-6.el5.i386
CentOS release 5.5 (Final)

When I try to install the latest stable version using "yum install
squid", I
get this:
------------------------------------------
# yum install squid
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* addons: mirror.stanford.edu
* base: mirrors.usc.edu
* extras: mirror.its.uidaho.edu
* updates: mirror.its.uidaho.edu
Setting up Install Process
Package 7:squid-2.6.STABLE21-6.el5.i386 already installed and latest
version
Nothing to do
--------------------------------------------

Is there another way I should be updating?

Thanks for the reply!

-----Original Message-----
From: Chad Naugle [mailto:Chad.Naugle_at_travimp.com]
Sent: Tuesday, December 28, 2010 9:48 AM
To: Charles Roper; squid-users_at_squid-cache.org
Subject: Re: [squid-users] Allow untrusted ssl connections

Can you report back with your version of Squid, and configuration?

---------------------------------------------
Chad E. Naugle
Tech Support II, x. 7981
Travel Impressions, Ltd.

>>> Charles Roper <charlzroper_at_gmail.com> 12/28/2010 12:33 PM >>>
Hello,

I'm using Squid Proxy to access my home network while I'm away from
the
house ... I'm running into a bit of trouble with SSL connections.
Using just a plain 'ol connection to the internet, occasionally ,
Firefox
will warn me of "Untrusted Connection" on certain websites that I
visit. I
believe this is due to either invalid SSL certs or self-signed SSL
certs.
Either way, I do trust these sites ... some of them are my own! I tell
Firefox that it's ok and it will let me view the sites as normal.

The problem arises when I try to access those same sites through my
home
Squid Proxy instead of directly connecting to the internet. When I do
that,
Firefox throws a "Problem loading page error" :
------------------------------
Unable to connect
Firefox can't establish a connection to the server at 8.8.8.8:2096.
* The site could be temporarily unavailable or too busy. Try
again in a few
moments.

* If you are unable to load any pages, check your computer's
network
connection.

* If your computer or network is protected by a firewall or
proxy, make sure
that Firefox is permitted to access the Web.
-----------------------------

I'm assuming this is a security configuration, but I really need to be
able
to access those sites through Squid Proxy. For years, I've been using
OpenSSH with SpoonProxy (Windows-based) and it worked flawlessly, but
this
week I thought I'd make the switch to Squid Proxy to see if I noticed
any
improvements. I did notice many speed improvements, and this is the
only
problem that I've run into, so I'm hoping you can help me resolve it.

Thanks - look forward to your reply!

- Charles

Travel Impressions made the following annotations
-------------------------------------------------------------
"This message and any attachments are solely for the intended recipient
and
may contain confidential or privileged information. If you are not
the
intended recipient, any disclosure, copying, use, or distribution of
the
information included in this message and any attachments is
prohibited.
If
you have received this communication in error, please notify us by
reply
e-mail and immediately and permanently delete this message and any
attachments.
Thank you."

Travel Impressions made the following annotations
-------------------------------------------------------------
"This message and any attachments are solely for the intended recipient
and
may contain confidential or privileged information. If you are not
the
intended recipient, any disclosure, copying, use, or distribution of
the
information included in this message and any attachments is prohibited.
If
you have received this communication in error, please notify us by
reply
e-mail and immediately and permanently delete this message and any
attachments.
Thank you."

Travel Impressions made the following annotations
-------------------------------------------------------------
"This message and any attachments are solely for the intended recipient
and may contain confidential or privileged information. If you are not
the intended recipient, any disclosure, copying, use, or distribution of
the information included in this message and any attachments is
prohibited. If you have received this communication in error, please
notify us by reply e-mail and immediately and permanently delete this
message and any attachments.
Thank you."
Received on Wed Dec 29 2010 - 22:20:50 MST

This archive was generated by hypermail 2.2.0 : Thu Dec 30 2010 - 12:00:04 MST