Syed Jahanzaib Personal Blog to Share Knowledge !

October 22, 2013

SSL Inspection with Squid.3

Filed under: Linux Related — Tags: , , — Syed Jahanzaib / Pinochio~:) @ 4:21 PM

UNSTABLE / INCOMPLETE guide dueto time shortage.

probably it will be replaced with squid 3.2 with ssl support and dynamic cert geenration

The aim of writing this basic howto is to find methods in SQUID to inspect SSL / HTTPS traffic at very minimum level. In this method, The SQUID will act as a MITM (man in the middle). The aim behind doing this config is to decrypt HTTPS connections to apply content filtering which is usually not possible with traditional http methods.

Also note that https caching is not recommended , at the date of writing this (January 2014) still, I haven’t found any 100% working method to bypass certificate issues.
The only way is to IMPORT certificate to user browser. Importing is OK  for a small network, like cyber/net Cafe or Office, Where you have FULL/PARTIAL CONTROL over user PC, but its not suitable for large network or where you cannot convince ppl to trust the new cert.

Please be aware that RIPPING and decrypting HTTPS is fundamentally against the reasons for using HTTPS. HTTPS is designed for secure connectivity and privacy. Since secure HTTP connections are encrypted SSL sessions between your browser and the secure site, and are meant to be reliably secure. Your users will not trust you if you use it without proper implementation. Every SSL request to the HTTPS site will present an invalid certificate window. Users will get a certificate miss match with the SSL enabled sites they try to visit. They will have to add exceptions to trust the self-signed cert from above for each site (This bump can be covered by a workaround but I will NOT go in that detail for some reasons)

Also if you are ripping SSL traffic, You’re exposing yourself to potential lawsuits for doing ripping user private stuff and possible hacking purposes.

IMPO, This approach is OK for content filtering purposes or for government surveillance or only according to law . There are methods to bypass CERTIFICATE mismatching and via using iptables nat, you can do transparent redirection of 443 to your proxy.

Compiling SQUID by source code with –enable-ssl

Update apt and install few required packages by following


apt-get update
apt-get install -y build-essential libssl-dev fakeroot devscripts gawk gcc-multilib dpatch

Now create temporary directory where we will download squid source packages for compilation.


mkdir /temp
cd /temp
wget ftp://artfiles.org/squid-cache.org/pub/archive/3.1/squid-3.1.19.tar.gz
tar zxvf squid-3.1.19.tar.gz
cd squid-3.1.19/

Now compile squid with –enable-ssl option

#===========
#For 64bit =
#===========


./configure \
--prefix=/usr \
--exec_prefix=/usr \
--bindir=/usr/sbin \
--sbindir=/usr/sbin \
--libexecdir=/usr/lib/squid \
--sysconfdir=/etc/squid \
--localstatedir=/var/spool/squid \
--datadir=/usr/share/squid \
--enable-async-io=24 \
--with-aufs-threads=24 \
--with-pthreads \
--enable-storeio=aufs \
--enable-linux-netfilter \
--enable-arp-acl \
--enable-epoll \
--enable-removal-policies=heap,lru \
--with-aio --with-dl \
--enable-snmp \
--enable-delay-pools \
--enable-htcp \
--enable-cache-digests \
--disable-unlinkd \
--enable-large-cache-files \
--with-large-files \
--enable-err-languages=English \
--enable-default-err-language=English --with-maxfd=65536 \
--enable-carp \
--enable-ssl \
--enable-follow-x-forwarded-for \
--with-maxfd=65536  \
'amd64-debian-linux' 'build_alias=amd64-debian-linux' 'host_alias=amd64-debian-linux' 'target_alias=amd64-debian-linux' 'CFLAGS=-Wall -g -O2' 'LDFLAGS=-Wl,-Bsymbolic-functions' 'CPPFLAGS='

Now install it


make
make install

Now edit SQUID CONFIG file and paste the following (remove all old entries, make sure to backup original config file for alter retrieval for backup purposes)

nano /etc/squid/squid.conf

Paste Following SAMPLE config file.


# SQUID 3.1.19 CONFIG FILE FOR SSL FILTERING [ Zaib]
# Thsi file also contains many other JUNK ENTRIES FOR CACHING with some VIDEOCACHE entries,
# Remove them if not required
# By - Syed Jahanzaib
# Email: aacable@hotmail.com
# Web  : https://aacable.wordpress.com

# SSL BUMP
always_direct allow all
ssl_bump allow all

# PORT OPTIONS. for http and https
# Repalce the IP 10.0.0.1 as per your local squid box ip
http_port 8080
http_port 10.0.0.1:8081 ssl-bump cert=/etc/squid3/cert/squid.pem key=/etc/squid3/cert/squid.pem

# for videocache, not required for general setup
acl vc_deny_url url_regex -i \.blip\.tv\/(.*)filename \.hardsextube\.com\/videothumbs \.xtube\.com\/(.*)(Thumb|videowall)
acl vc_url url_regex -i \/youku\/[0-9A-Z]+\/[0-9A-Z\-]+\.(flv|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg)
acl vc_url url_regex -i \/(.*)key=[a-z0-9]+(.*)\.flv
acl vc_url url_regex -i \.(youtube|youtube-nocookie)\.com\/feeds\/api\/videos\/[0-9a-zA-Z_-]{11}\/
acl vc_url url_regex -i \.(youtube|youtube-nocookie)\.com\/(videoplayback|get_video|watch|watch_popup|user_watch)\?
acl vc_url url_regex -i \.(youtube|youtube-nocookie)\.com\/(v|e|embed)\/[0-9a-zA-Z_-]{11}

acl vc_dom_r dstdom_regex -i msn\..*\.(com|net)
acl vc_dom_r dstdom_regex -i msnbc\..*\.(com|net)
acl vc_dom_r dstdom_regex -i video\..*\.fbcdn\.net
acl vc_dom_r dstdom_regex -i myspacecdn\..*\.footprint\.net

acl vc_dom dstdomain .stream.aol.com .videos.5min.com msn.com .blip.tv .vid.ec.dmcdn.net .break.com .vimeocdn.com
acl vc_dom dstdomain .cdn.turner.com .dailymotion.com .c.wrzuta.pl .v.imwx.com .mccont.com .myspacecdn.com
acl vc_dom dstdomain .hardsextube.com .public.extremetube.phncdn.com .redtubefiles.com .video.pornhub.phncdn.com
acl vc_dom dstdomain .public.keezmovies.com .public.keezmovies.phncdn.com .slutload-media.com .public.spankwire.com .xtube.com
acl vc_dom dstdomain .public.youporn.phncdn.com .xvideos.com .tube8.com .public.spankwire.phncdn.com .pornhub.com

refresh_pattern \.youtube\.com\/videoplayback\? 120    80%    180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern stream\.aol\.com\/(.*)/[a-zA-Z0-9]+\/(.*)\.(flv|mp4) 120    80%    180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern videos\.5min\.com\/(.*)/[0-9_]+\.(mp4|flv) 120    80%    180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern proxy[a-z0-9\-]?[a-z0-9]?[a-z0-9]?[a-z0-9]?\.dailymotion\.com\/(.*)\.(flv|on2|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg) 120    80%    180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern vid\.akm\.dailymotion\.com\/(.*)\.(flv|on2|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg) 120    80%    180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern vid\.ec\.dmcdn\.net\/(.*)\.(flv|on2|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg) 120    80%    180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern video\.(.*)\.fbcdn\.net\/(.*)/[0-9_]+\.(mp4|flv|avi|mkv|m4v|mov|wmv|3gp|mpg|mpeg) 120    80%    180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern (.*)\.myspacecdn\.com\/(.*)\/[a-zA-Z0-9]+\/vid\.(flv|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg) 120    80%    180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern (.*)\.myspacecdn\.(.*)\.footprint\.net\/(.*)\/[a-zA-Z0-9]+\/vid\.(flv|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg) 120    80%    180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern c\.wrzuta\.pl\/wv[0-9]+\/[a-z0-9]+/[0-9]+/ 120    80%    180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern c\.wrzuta\.pl\/wa[0-9]+\/[a-z0-9]+ 120    80%    180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private
refresh_pattern vs[a-z0-9]?[a-z0-9]?[a-z0-9]?\.hardsextube\.com\/(.*)\/(.*)\.(flv|mp4|avi|mkv|mp3|rm|rmvb|m4v|mov|wmv|3gp|mpg|mpeg) 120    80%    180 ignore-no-cache ignore-no-store override-expire override-lastmod ignore-private

acl vc_deny_url url_regex -i crossdomain.xml
acl vc_method method GET
acl vc_header req_header X-Requested-With -i videocache
url_rewrite_access deny !vc_method
url_rewrite_access deny vc_header
url_rewrite_access deny vc_deny_url
url_rewrite_access allow vc_dom
url_rewrite_access allow vc_url
url_rewrite_access allow vc_dom_r
url_rewrite_bypass on
strip_query_terms off
maximum_object_size 1 GB

# If you want to enable DATE time n SQUID Logs,use following
emulate_httpd_log on
logformat squid %tl %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt
log_fqdn off

# 1 year = 525600 mins, 1 month = 43800 mins
refresh_pattern imeem.*\.flv  0 0% 0     override-lastmod override-expire
refresh_pattern \.rapidshare.*\/[0-9]*\/.*\/[^\/]*   161280    90%    161280 ignore-reload

refresh_pattern (get_video\?|videoplayback\?|videodownload\?|\.flv?)    10800 80% 10800 ignore-no-cache  ignore-private override-expire override-lastmod reload-into-ims
refresh_pattern (get_video\?|videoplayback\?id|videoplayback.*id|videodownload\?|\.flv?)    10800 80% 10800 ignore-no-cache  ignore-private override-expire override-lastmod reload-into-ims
#refresh_pattern -i (get_video\?|videoplayback\?id|videoplayback.*id||videodownload\?|\.flv?)       10800 80% 10800 ignore-no-cache  ignore-private override-expire override-lastmod reload-into-ims
refresh_pattern \.(ico|video-stats) 10800 80% 10800    override-expire ignore-reload ignore-no-cache  ignore-private ignore-auth override-lastmod
refresh_pattern \.etology\?                       10800 80% 10800    override-expire ignore-reload ignore-no-cache
refresh_pattern galleries\.video(\?|sz)               10800 80% 10800    override-expire ignore-reload ignore-no-cache
refresh_pattern brazzers\?                       10800 80% 10800    override-expire ignore-reload ignore-no-cache
refresh_pattern \.adtology\?                      10800 80% 10800    override-expire ignore-reload ignore-no-cache
#refresh_pattern ^.*(utm\.gif|ads\?|rmxads\.com|ad\.z5x\.net|bh\.contextweb\.com|bstats\.adbrite\.com|a1\.interclick\.com|ad\.trafficmp\.com|ads\.cubics\.com|ad\.xtendmedia\.com|\.googlesyndication\.com|advertising\.com|yieldmanager|game-advertising\.com|pixel\.quantserve\.com|adperium\.com|doubleclick\.net|adserving\.cpxinteractive\.com|syndication\.com|media.fastclick.net).* 10800 20% 10800 ignore-no-cache  ignore-private override-expire ignore-reload ignore-auth   negative-ttl=40320 max-stale=10
refresh_pattern ^.*safebrowsing.*google  10800 80% 10800 override-expire ignore-reload ignore-no-cache ignore-private ignore-auth
refresh_pattern ^http://((cbk|mt|khm|mlt)[0-9]?)\.google\.co(m|\.uk) 10800 80% 10800 override-expire ignore-reload   ignore-private
refresh_pattern ytimg\.com.*\.jpg                   10800 80% 10800    override-expire ignore-reload
refresh_pattern images\.friendster\.com.*\.(png|gif)           10800 80% 10800    override-expire ignore-reload
refresh_pattern garena\.com                                   10800 80% 10800     override-expire reload-into-ims
refresh_pattern photobucket.*\.(jp(e?g|e|2)|tiff?|bmp|gif|png)  10800 80% 10800     override-expire ignore-reload
refresh_pattern vid\.akm\.dailymotion\.com.*\.on2\?           10800 80% 10800 ignore-no-cache override-expire override-lastmod
refresh_pattern mediafire.com\/images.*\.(jp(e?g|e|2)|tiff?|bmp|gif|png)    10800 80% 10800 reload-into-ims override-expire ignore-private
refresh_pattern ^http:\/\/images|pics|thumbs[0-9]\.      10800 80% 10800 reload-into-ims ignore-no-cache  ignore-reload override-expire
refresh_pattern ^http:\/\/www.onemanga.com.*\/           10800 80% 10800 reload-into-ims ignore-no-cache  ignore-reload override-expire

# ANTI VIRUS
refresh_pattern guru.avg.com/.*\.(bin)                      10800 80% 10800 ignore-no-cache  ignore-reload  reload-into-ims
refresh_pattern (avgate|avira).*(idx|gz)$                           10800 80% 10800 ignore-no-cache  ignore-reload  reload-into-ims
refresh_pattern kaspersky.*\.avc$                                   10800 80% 10800 ignore-no-cache  ignore-reload  reload-into-ims
refresh_pattern kaspersky                                           10800 80% 10800 ignore-no-cache  ignore-reload  reload-into-ims
refresh_pattern update.nai.com/.*\.(gem|zip|mcs)                    10800 80% 10800 ignore-no-cache  ignore-reload  reload-into-ims
refresh_pattern ^http:\/\/liveupdate.symantecliveupdate.com.*\(zip)     10800 80% 10800 ignore-no-cache  ignore-reload  reload-into-ims

refresh_pattern windowsupdate.com/.*\.(cab|exe)             10800  80%  10800 ignore-no-cache  ignore-reload  reload-into-ims
refresh_pattern update.microsoft.com/.*\.(cab|exe)             10800  80%  10800 ignore-no-cache  ignore-reload  reload-into-ims
refresh_pattern download.microsoft.com/.*\.(cab|exe)             10800  80%  10800 ignore-no-cache  ignore-reload  reload-into-ims

#images facebook
refresh_pattern ((facebook.com)|(85.131.151.39)).*\.(jpg|png|gif|css)      10800 80% 10800 ignore-reload  override-expire ignore-no-cache
refresh_pattern -i \.fbcdn.net.*\.(jpg|gif|png|swf|mp3)                  10800 80% 10800 ignore-reload  override-expire ignore-no-cache
refresh_pattern  static\.ak\.fbcdn\.net*\.(jpg|gif|png)                  10800 80% 10800 ignore-reload  override-expire ignore-no-cache
refresh_pattern ^http:\/\/profile\.ak\.fbcdn.net*\.(jpg|gif|png)      10800 80% 10800 ignore-reload  override-expire ignore-no-cache

#banner IIX
refresh_pattern ^http:\/\/openx.*\.(jp(e?g|e|2)|gif|pn[pg]|swf|ico|css|tiff?) 10800 99999% 10800 reload-into-ims  ignore-reload override-expire ignore-no-cache
refresh_pattern ^http:\/\/ads(1|2|3).kompas.com.*\/           10800 99999% 10800 reload-into-ims  ignore-reload override-expire ignore-no-cache
refresh_pattern ^http:\/\/img.ads.kompas.com.*\/           10800 99999% 10800 reload-into-ims  ignore-reload override-expire ignore-no-cache
refresh_pattern .kompasimages.com.*\.(jpg|gif|png|swf)       10800 99999% 10800 reload-into-ims  ignore-reload override-expire ignore-no-cache
refresh_pattern ^http:\/\/openx.kompas.com.*\/           10800 99999% 10800 reload-into-ims  ignore-reload override-expire ignore-no-cache
refresh_pattern kaskus.\us.*\.(jp(e?g|e|2)|gif|png|swf)        10800 99999% 10800 reload-into-ims  ignore-reload override-expire ignore-no-cache
refresh_pattern ^http:\/\/img.kaskus.us.*\.(jpg|gif|png|swf)       10800 99999% 10800 reload-into-ims  ignore-reload override-expire ignore-no-cache

#IIX DOWNLOAD
refresh_pattern ^http:\/\/\.www[0-9][0-9]\.indowebster\.com\/(.*)(mp3|rar|zip|flv|wmv|3gp|mp(4|3)|exe|msi|zip) 10800 99999% 10800 reload-into-ims  ignore-reload override-expire ignore-no-cache    ignore-auth

#All File
refresh_pattern -i \.(3gp|7z|ace|asx|avi|bin|cab|dat|deb|divx|dvr-ms)      10800 80% 10800 ignore-no-cache  ignore-private override-expire override-lastmod reload-into-ims
refresh_pattern -i \.(rar|jar|gz|tgz|bz2|iso|m1v|m2(v|p)|mo(d|v))          10800 80% 10800 ignore-no-cache  ignore-private override-expire override-lastmod reload-into-ims
refresh_pattern -i \.(jp(e?g|e|2)|gif|pn[pg]|bm?|tiff?|ico|swf|css|js|jpg|png)     10800 80% 10800 ignore-no-cache  ignore-private override-expire override-lastmod reload-into-ims
refresh_pattern -i \.(mp(e?g|a|e|1|2|3|4)|mk(a|v)|ms(i|u|p)|og(x|v|a|g)|rar|rm|r(a|p)m|snd|vob|wav) 10800 80% 10800 ignore-no-cache ignore-private override-expire override-lastmod reload-into-ims
refresh_pattern -i \.(pp(s|t)|wax|wm(a|v)|wmx|wpl|zip|cb(r|z|t))     10800 80% 10800 ignore-no-cache ignore-private override-expire override-lastmod reload-into-ims

#########################################################################

refresh_pattern (cgi-bin|\?)       0      0%      0
refresh_pattern ^gopher:    1440    0%    1440
refresh_pattern ^ftp:         10080     95%     10800 override-lastmod reload-into-ims
refresh_pattern         .     180     95% 10800 override-lastmod reload-into-ims

global_internal_static off
retry_on_error on
buffered_logs on
read_ahead_gap 32 KB

#header_access Accept-Encoding deny  all
client_persistent_connections off
server_persistent_connections on
half_closed_clients off
strip_query_terms off
quick_abort_min 0 KB
quick_abort_max 0 KB
quick_abort_pct 100
vary_ignore_expire on
reload_into_ims on
pipeline_prefetch on
read_timeout 30 minute
client_lifetime 6 hour
positive_dns_ttl 6 hour
pconn_timeout 15 second
request_timeout 1 minute
log_icp_queries off
ipcache_size 16384
ipcache_low 98
ipcache_high 99
log_fqdn off
fqdncache_size 16384
memory_pools off
forwarded_for on
client_db off
max_filedescriptors 8192

# ZAIB
# ZPH for Squid 3.3.19
qos_flows local-hit=0x30

# ACCESS CONTROLS OPTIONS
# ====================
acl all src
acl localnet src 101.0.0.0/8 # Your network here
acl localnet src 192.168.1.0/24 # Your network here
acl localhost src 127.0.0.1/32
acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 81 3128 1025-65535
acl sslports port 443 563 81 2087 8081 10000
acl manager proto cache_object
acl purge method PURGE
acl connect method CONNECT
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !safeports
http_access deny CONNECT !sslports
http_access allow localhost
http_access allow localnet
http_access deny all

# OPTIONS WHICH AFFECT THE CACHE SIZE
# ==============================

cache_mem 512 MB
maximum_object_size_in_memory 4096 KB
memory_replacement_policy heap GDSF
cache_replacement_policy heap LFUDA
minimum_object_size 0 bytes

# 10GB CACHE SIZE [JZ]
# =====================
cache_dir aufs /cache-1 10000 14 256
maximum_object_size 1000 MB
cache_swap_low 95
cache_swap_high 99

# LOGFILE LOCATIONS AND CACHE_DIR [JZ]
# ====================================

access_log /var/log/squid3/access.log
cache_log /var/log/squid3/cache.log
#cache_log /dev/null
cache_store_log none
logfile_rotate 5
log_icp_queries off

# REFRESH PATTERNS AND OTHER TUNING OPTIONS [JZ]
# ==============================================
refresh_pattern ^ftp: 1440 20% 10080 reload-into-ims
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i .(gif|png|jp?g|ico|bmp|tiff?)$ 10080 95% 43200 override-expire override-lastmod reload-into-ims ignore-no-cache ignore-private
refresh_pattern -i .(rpm|cab|deb|exe|msi|msu|zip|tar|xz|bz|bz2|lzma|gz|tgz|rar|bin|7z|doc?|xls?|ppt?|pdf|nth|psd|sis)$ 10080 90% 43200 override-expire override-lastmod reload-into-ims ignore-no-cache ignore-private
refresh_pattern -i .(avi|iso|wav|mid|mp?|mpeg|mov|3gp|wm?|swf|flv|x-flv|axd)$ 43200 95% 432000 override-expire override-lastmod reload-into-ims ignore-no-cache ignore-private
refresh_pattern -i .(html|htm|css|js)$ 1440 75% 40320
refresh_pattern -i .index.(html|htm)$ 0 75% 10080
#refresh_pattern -i (/cgi-bin/|?) 0 0% 0
refresh_pattern . 1440 90% 10080

quick_abort_min 0 KB
quick_abort_max 0 KB
quick_abort_pct 100
store_avg_object_size 13 KB
vary_ignore_expire on

# ANONIMITY OPTIONS
# ===============

request_header_access From deny all
request_header_access Server deny all
request_header_access Link deny all
request_header_access Via deny all
request_header_access X-Forwarded-For deny all

# ADMINISTRATIVE PARAMETERS [JZ]
# ==============================

cache_mgr Syed_jahanzaib
visible_hostname aacable@hotmail.com
cache_effective_user proxy
cache_effective_group proxy
httpd_suppress_version_string on

ftp_list_width 32
ftp_passive on
ftp_sanitycheck on

# DNS SERVER [JZ]
# ===============
dns_nameservers 8.8.8.8

# MISCELLANEOUS [JZ]
# ==================

memory_pools off
client_db off
reload_into_ims on
coredump_dir /cache-1
pipeline_prefetch on
offline_mode off

### END OF SQUID SAMPLE CONFIGURATION ###
### IT WAS MADE ROUGHLY ###

Now Generate SSL certificate which SQUID will present to the end client. For test purposes in a test environment, you can create a self-signed

certificate using OpenSSL by using the following:


cd /etc/squid3

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout squid.pem -out squid.pem

It will ask few simple questions like country code, use PK if you are in Pakistan, and some other questions, just answer and proceed further

#####

Create cache folder and assign necnessary permissions.


mkdir /cache-1
chown proxy:proxy /cache-1

Now initialize CACHE folders by SQUID


squid -z

Now start SQUID in no daemon mode to verify you dont have any errors in the config file.

squid -d1N

To redirect TRANSPARENTLY  port 80 and 443 to local proxy.

change the eth0 to match your local LAN interface.


iptables -t nat -A PREROUTING -i eth0 -p tcp –dport 80 -j DNAT –to-destination 10.0.0.1:8080
 iptables -t nat -A PREROUTING -i eth0 -p tcp –dport 443 -j DNAT –to-destination 10.0.0.1:8081

To check SQUID port


netstat -nap | grep 8080

netstat -nap | grep 8081



fb-cache

fb-cache-2

With Decryption ↓

with-decryption

With Encryption ↓

with-encryption

51 Comments »

  1. we are waiting …………………………………………………

    Comment by Ahmed Ramze — October 22, 2013 @ 4:37 PM

  2. Dear Sir,
    Please tell how to install squid3 ssl-bump, step by step

    Comment by Suprianto — October 22, 2013 @ 7:34 PM

  3. I’m desperately waiting for the configurations and settings. So i could compare with my settings & configuration.
    And i would like to Thank you for bringing something new & latest.

    Comment by Umer Sarwar — October 22, 2013 @ 9:31 PM

  4. ohhhhhhhhhhhhhhh .. good news
    i waiting

    Comment by mohamed — October 22, 2013 @ 10:28 PM

  5. wow i m waiting bhai.. aur kitne din lagenge.. ???

    Comment by Haji amad — October 22, 2013 @ 11:01 PM

  6. Sir, create rule for MT Hotspot to Redirect SSL links to login page. , It will be Great Discovery for all the networks which are still using MT Hotspot for their clients. Thanks

    Hammad Hassan
    Fast ISP

    Comment by hammad hassan — October 23, 2013 @ 9:19 AM

  7. sir… how to fix this
    FATAL: Bungled squid.conf line 7: http_port 10.0.0.1:8081 ssl-bump cert=/etc/squid3/cert/squid.pem key=/etc/squid3/cert/squid.pem
    Squid Cache (Version 3.1.19): Terminated abnormallyCPU Usage: 0.004 seconds = 0.000 user + 0.004 sys Maximum Resident Size: 17264 KB
    Page faults with physical i/o: 0

    Comment by Hizkya Net — October 24, 2013 @ 6:08 AM

  8. salam janzaib,
    this is rehmat ali i buy a router borad 750gl for WAN merging i m little confused that i need to merge my 4 wan’s into one but in background MT used a loadbalnce method in PCC method distance rule.
    means wan1 distance is 1
    wan2 distance is 2
    and go on is pcc method all wan’s at same time,
    i only need to do my 4 mb dsl connection into 16mb DSL connection with mikrotik is it possible with bridging or with PCC method.

    Comment by rehmat ali gulwating — October 24, 2013 @ 11:28 PM

  9. is PCC method use all wan’s at same time….?

    Comment by rehmat ali gulwating — October 24, 2013 @ 11:33 PM

  10. one another question is that is your PCC loadbalancing script work when wan connection on MT is on PPTP, if not then what modification is to be configure?

    Comment by rehmat ali gulwating — October 25, 2013 @ 12:04 AM

  11. dear janzaib:
    i do the all configuration of your PCC loadbalancing but it only use wan1 then i read comments under that topic and i reset my router configuration and start again but this time i set route distance same to 1 on all 4 routes, after that i check my route page on winbox wan1 is active and others are inactive,
    AS wan1
    S wan2
    S wan3
    S wan4
    i do all configuration as it is manually by winbox, not copying in terminal,
    plzzz resolve this ,thxzzzzzzzzz

    Comment by rehmat ali gulwating — October 25, 2013 @ 2:49 AM

  12. please reply as soon as possible

    Comment by rehmat ali gulwating — October 25, 2013 @ 7:46 PM

  13. dear janzaib:
    my problem is resolved i was just not checked on invert after that it was done but one question i have to ask from u is that
    what is
    4/0
    4/1
    4/2
    4/3
    in PCC , please describe fully
    thxzzzzzzzzz

    Comment by rehmat ali gulwating — October 25, 2013 @ 10:37 PM

  14. is video cache need for storeurl

    Comment by dh — October 27, 2013 @ 1:58 AM

    • videocache and storeurl.pl are separate methods to cache video files.
      storeurl.pl is a free method, wehreas videocache is a commercial software for squid.

      Comment by Syed Jahanzaib / Pinochio~:) — October 27, 2013 @ 9:50 AM

      • i have the latest videocache cracked if you want it syed ?

        Comment by Hussein — November 3, 2013 @ 4:11 AM

      • can i get it plz

        Comment by dh — December 14, 2013 @ 6:18 PM

  15. Waiting for full version with video support…..
    Thanks for the efforts you put, and thanks for the time you spare for us…
    Jazak ALLAH

    Comment by Quality DSL — October 27, 2013 @ 8:24 PM

  16. janziab bhai plz answere my question…?

    Comment by rehmat ali — October 28, 2013 @ 3:03 AM

  17. salam to all
    janzaib bhai i have a question
    is PCC loadbalancing method is able to work with when WAN connections is on VPN(pptp or l2tp) or in PPPoe directly connected with Mikrotik Wan ports………?
    if yes then what modification will change in config of PCC.
    please reply as soon as you read this.
    thanking you,

    Comment by rehmat ali gulwating — October 30, 2013 @ 7:51 PM

  18. salam alaikom,
    dear Syed Jahanzaib
    is this method work with lusca ??
    thank you 🙂

    Comment by Hussein — November 3, 2013 @ 4:11 AM

  19. dear sayed please check this

    so the images not work under https

    Comment by Hussein — November 6, 2013 @ 5:22 AM

    • ok now thats what iam gettin

      2013/11/05 19:38:21| clientNegotiateSSL: Error negotiating SSL connection on FD 11: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request (1/-1)

      Comment by Hussein — November 6, 2013 @ 6:17 AM

    • can i get videocache cracked plz and is it work ok

      Comment by dh — December 12, 2013 @ 6:01 PM

    • https caching is not recommended bro, I haven’t still found any 100% working method to bypass certificate issues.
      The only way is to IMPORT certificate to user browser.Importing is OK for a small network, like Cafe or Office, Where you have FULL/PARTIAL CONTROL over user PC, but its not suitable for large network or where you cannot convince ppl to trust the new cert.

      Comment by Syed Jahanzaib / Pinochio~:) — January 18, 2014 @ 5:24 PM

  20. on which distribution you make that its not worked under Debian the browser said the certificate is wrong and then sites not loaded successfully

    Comment by Hussein — November 7, 2013 @ 7:34 AM

  21. sir ………………how to configure squid proxy server………with ( http ) and ( https )

    Comment by Salman — November 14, 2013 @ 2:47 AM

  22. sir………how to configure both ( http/https ) sevices cached in squid proxy server in ubuntu
    ALLAH aap ko JAZA E KHAIR dey………..Ameen

    Comment by Salman — November 23, 2013 @ 1:56 AM

  23. syed … if this setting works well in a proxy server?

    Comment by boim — November 24, 2013 @ 4:01 AM

  24. Bhai …………compile squid with –enable-ssl option for 32bit ……….not available in Article.
    please ………step by step guide i m beginer. ALLAH aap ko Jaza e Khair de…….

    Comment by Salman — November 26, 2013 @ 12:03 PM

  25. How to make Squid 3 as Transparent Proxy SSL ?

    Comment by Aji Diyantoro — November 29, 2013 @ 8:40 AM

    • https caching is not recommended bro, I haven’t still found any 100% working method to bypass certificate issues.
      The only way is to IMPORT certificate to user browser.Importing is OK for a small network, like Cafe or Office, Where you have FULL/PARTIAL CONTROL over user PC, but its not suitable for large network or where you cannot convince ppl to trust the new cert.

      Comment by Syed Jahanzaib / Pinochio~:) — January 18, 2014 @ 5:23 PM

  26. Sir ………..squid proxy for http / squid for https keley seprate server bansakta hai?

    Comment by Salman — December 2, 2013 @ 7:45 PM

  27. 1386006187.572 11353 10.0.0.222 TCP_MISS/200 2207 CONNECT fbstatic-a.akamaihd.net:443 – HIER_DIRECT/77.67.96.232 –
    1386006190.682 14463 10.0.0.222 TCP_MISS/200 2207 CONNECT fbstatic-a.akamaihd.net:443 – HIER_DIRECT/77.67.96.232 –
    1386006194.199 21028 10.0.0.222 TCP_MISS/200 214 CONNECT fbcdn-sphotos-a-a.akamaihd.net:443 – HIER_DIRECT/46.33.70.43 –
    1386006194.199 21029 10.0.0.222 TCP_MISS/200 214 CONNECT fbcdn-photos-f-a.akamaihd.net:443 – HIER_DIRECT/81.52.207.192 –
    1386006194.208 21037 10.0.0.222 TCP_MISS/200 214 CONNECT fbcdn-sphotos-a-a.akamaihd.net:443 – HIER_DIRECT/46.33.70.43 –

    1386006259.113 1715 10.0.0.222 TCP_MISS/200 34826 GET http://l1.yimg.com/nn/fp/rsz/120113/images/smush/walker2_635x250_1385923107.jpg – HIER_DIRECT/66.196.65.174 image/jpeg
    1386006268.181 775 10.0.0.222 TCP_MISS/200 24364 GET http://l1.yimg.com/nn/fp/rsz/111813/images/smush/grey_hair_635x250_1384817243.jpg – HIER_DIRECT/66.196.65.174 image/jpeg

    keep getting this loogs :/ in 99% of the pages i visit
    the only hits
    1386006467.864 0 127.0.0.1 TCP_IMS_HIT/304 352 GET http://i1.ytimg.com/vi/My2FRPA3Gf8/mqdefault.jpg – HIER_NONE/- image/jpeg
    1386006467.866 0 127.0.0.1 TCP_IMS_HIT/304 352 GET http://i1.ytimg.com/vi/LrUvu1mlWco/mqdefault.jpg – HIER_NONE/- image/jpeg
    1386006467.867 0 127.0.0.1 TCP_IMS_HIT/304 352 GET http://i1.ytimg.com/vi/H7QhvIc8NrQ/mqdefault.jpg – HIER_NONE/- image/jpeg
    1386006467.869 0 127.0.0.1 TCP_IMS_HIT/304 352 GET http://i1.ytimg.com/vi/450p7goxZqg/mqdefault.jpg – HIER_NONE/- image/jpeg
    1386006467.871 0 127.0.0.1 TCP_IMS_HIT/304 352 GET http://i1.ytimg.com/vi/DeumyOzKqgI/mqdefault.jpg – HIER_NONE/- image/jpeg
    1386006467.872 0 127.0.0.1 TCP_IMS_HIT/304 439 GET http://i1.ytimg.com/vi/1-TTNdyIMAE/mqdefault.jpg – HIER_NONE/- image/jpeg

    anny idea what am i doing wrong

    Comment by asd — December 2, 2013 @ 10:49 PM

  28. Sir……….which version of squid ………http and https
    sir ………..we have a problem for https……sites cahe ;;;;;;plz sir upload full Article step by step about this problem
    ALLAH aap ko jaza e khair dey…….ameen

    Comment by Salman — December 3, 2013 @ 5:25 PM

  29. Sir ……………….We are waiting your full Article………..plz
    ALLAH aap ko jaza e khair dey…………Ameen

    Comment by Salman — December 20, 2013 @ 2:40 AM

    • https caching is not recommended bro, I haven’t still found any 100% working method to bypass certificate issues.
      The only way is to IMPORT certificate to user browser.Importing is OK for a small network, like Cafe or Office, Where you have FULL/PARTIAL CONTROL over user PC, but its not suitable for large network or where you cannot convince ppl to trust the new cert.

      Comment by Syed Jahanzaib / Pinochio~:) — January 18, 2014 @ 5:23 PM

  30. E: Could not get lock /var/lib/dpkg/lock – open (11: Resource temporarily unavailable)
    E: Unable to lock the administration directory (/var/lib/dpkg/), is another process using it?

    Comment by SHAHBAZ — December 25, 2013 @ 6:21 PM

  31. thanks but i have one problem with certificate not working, how i can fix it.

    the chorme browser say me connection failed, but http work good

    Comment by MCM — April 9, 2014 @ 2:24 AM

  32. libtool: compile: g++ -DHAVE_CONFIG_H -I../.. -I../../include -I../../src -I../../include -I../../libltdl -Wall -Wpointer-arith -Wwrite-strings -Wcomments -Werror -fhuge-objects -D_REENTRANT -m64 -g -O2 -MT IntRange.lo -MD -MP -MF .deps/IntRange.Tpo -c IntRange.cc -fPIC -DPIC -o .libs/IntRange.o
    g++: warning: switch ‘-fhuge-objects’ is no longer supported

    MD -MP -MF $depbase.Tpo -c -o store_dir.o store_dir.cc &&\
    mv -f $depbase.Tpo $depbase.Po
    g++: warning: switch ‘-fhuge-objects’ is no longer supported
    depbase=`echo store_key_md5.o | sed ‘s|[^/]*$|.deps/&|;s|\.o$||’`;\
    g++ -DHAVE_CONFIG_H -DDEFAULT_CONFIG_FILE=\”/etc/squid/squid.conf\” -DDEFAULT_SQUID_DATA_DIR=\”/usr/share/squid\” -DDEFAULT_SQUID_CONFIG_DIR=\”/etc/squid\” -I.. -I../include -I../src -I../include -I../libltdl -I../src -Wall -Wpointer-arith -Wwrite-strings -Wcomments -Werror -fhuge-objects -D_REENTRANT -m64 -g -O2 -MT store_key_md5.o -MD -MP -MF $depbase.Tpo -c -o store_key_md5.o store_key_md5.cc &&\
    mv -f $depbase.Tpo $depbase.Po
    g++: warning: switch ‘-fhuge-objects’ is no longer supported
    depbase=`echo store_log.o | sed ‘s|[^/]*$|.deps/&|;s|\.o$||’`;\
    g++ -DHAVE_CONFIG_H -DDEFAULT_CONFIG_FILE=\”/etc/squid/squid.conf\” -DDEFAULT_SQUID_DATA_DIR=\”/usr/share/squid\” -DDEFAULT_SQUID_CONFIG_DIR=\”/etc/squid\” -I.. -I../include -I../src -I../include -I../libltdl -I../src -Wall -Wpointer-arith -Wwrite-strings -Wcomments -Werror -fhuge-objects -D_REENTRANT -m64 -g -O2 -MT store_log.o -MD -MP -MF $depbase.Tpo -c -o store_log.o store_log.cc &&\
    mv -f $depbase.Tpo $depbase.Po
    g++: warning: switch ‘-fhuge-objects’ is no longer supported
    depbase=`echo store_rebuild.o | sed ‘s|[^/]*$|.deps/&|;s|\.o$||’`;\
    g++ -DHAVE_CONFIG_H -DDEFAULT_CONFIG_FILE=\”/etc/squid/squid.conf\” -DDEFAULT_SQUID_DATA_DIR=\”/usr/share/squid\” -DDEFAULT_SQUID_CONFIG_DIR=\”/etc/squid\” -I.. -I../include -I../src -I../include -I../libltdl -I../src -Wall -Wpointer-arith -Wwrite-strings -Wcomments -Werror -fhuge-objects -D_REENTRANT -m64 -g -O2 -MT store_rebuild.o -MD -MP -MF $depbase.Tpo -c -o store_rebuild.o store_rebuild.cc &&\
    mv -f $depbase.Tpo $depbase.Po
    g++: warning: switch ‘-fhuge-objects’ is no longer supported
    depbase=`echo store_swapin.o | sed ‘s|[^/]*$|.deps/&|;s|\.o$||’`;\
    g++ -DHAVE_CONFIG_H -DDEFAULT_CONFIG_FILE=\”/etc/squid/squid.conf\” -DDEFAULT_SQUID_DATA_DIR=\”/usr/share/squid\” -DDEFAULT_SQUID_CONFIG_DIR=\”/etc/squid\” -I.. -I../include -I../src -I../include -I../libltdl -I../src -Wall -Wpointer-arith -Wwrite-strings -Wcomments -Werror -fhuge-objects -D_REENTRANT -m64 -g -O2 -MT store_swapin.o -MD -MP -MF $depbase.Tpo -c -o store_swapin.o store_swapin.cc &&\
    mv -f $depbase.Tpo $depbase.Po
    g++: warning: switch ‘-fhuge-objects’ is no longer supported
    depbase=`echo store_swapmeta.o | sed ‘s|[^/]*$|.deps/&|;s|\.o$||’`;\
    g++ -DHAVE_CONFIG_H -DDEFAULT_CONFIG_FILE=\”/etc/squid/squid.conf\” -DDEFAULT_SQUID_DATA_DIR=\”/usr/share/squid\” -DDEFAULT_SQUID_CONFIG_DIR=\”/etc/squid\” -I.. -I../include -I../src -I../include -I../libltdl -I../src -Wall -Wpointer-arith -Wwrite-strings -Wcomments -Werror -fhuge-objects -D_REENTRANT -m64 -g -O2 -MT store_swapmeta.o -MD -MP -MF $depbase.Tpo -c -o store_swapmeta.o store_swapmeta.cc &&\
    mv -f $depbase.Tpo $depbase.Po
    g++: warning: switch ‘-fhuge-objects’ is no longer supported
    depbase=`echo store_swapout.o | sed ‘s|[^/]*$|.deps/&|;s|\.o$||’`;\
    g++ -DHAVE_CONFIG_H -DDEFAULT_CONFIG_FILE=\”/etc/squid/squid.conf\” -DDEFAULT_SQUID_DATA_DIR=\”/usr/share/squid\” -DDEFAULT_SQUID_CONFIG_DIR=\”/etc/squid\” -I.. -I../include -I../src -I../include -I../libltdl -I../src -Wall -Wpointer-arith -Wwrite-strings -Wcomments -Werror -fhuge-objects -D_REENTRANT -m64 -g -O2 -MT store_swapout.o -MD -MP -MF $depbase.Tpo -c -o store_swapout.o store_swapout.cc &&\
    mv -f $depbase.Tpo $depbase.Po
    g++: warning: switch ‘-fhuge-objects’ is no longer supported

    “is no longer supported” ؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟

    Comment by New Llife — April 20, 2014 @ 9:09 PM

  33. i have 4 lines and i need to make one squid for all of them
    it will be lik this
    squid has 4 lines in and 4 lines out
    every in line and out line has adifferent pool
    every out line to be routed from aspaciefic in line
    can it be done
    thanks

    Comment by ahmed — June 15, 2014 @ 9:46 PM

  34. We are the worlds leading publisher of Squid ‘Native ACL’ formatted blacklists, that allow for web filtering directly with Squid proxy. Of course we also offer alternative formats for the most widely used third party plugins, such as DansGuardian and Squidguard. And while our blacklists are subscription based, they are as a result of our efforts, of a much higher degree of quality than the free alternatives.

    We hope to serve you,


    Signed,

    Benjamin E. Nichols
    http://www.squidblacklist.org

    Comment by Squidblacklist (@Squidblacklist) — August 23, 2014 @ 1:54 PM

  35. O único que funcionou dentre vários tutorias. Obrigado.

    Comment by ijm07 — January 12, 2015 @ 12:53 AM

  36. it does not work for me.

    Comment by zero — August 19, 2015 @ 9:24 AM

  37. Assalaamu Alaikum
    Jahanzaib bhai plzz https cache squid 3.4 ki detail rakhain https cache ho hi nhi raha us ka kuch tareqa batain

    Comment by abdulsami — January 24, 2016 @ 11:04 AM


RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Create a free website or blog at WordPress.com.

%d bloggers like this: