Squid https aufbrechen und ClamAV
Zur Navigation springen
Zur Suche springen
clamav und anderes installieren
- apt install c-icap clamav clamdscan libicapapi-dev clamav-daemon
squid runterladen und übersetzen
- wget http://www.squid-cache.org/Versions/v4/squid-4.17.tar.gz
- tar -xvzf squid-4.17.tar.gz
- cd squid*
- ./configure --with-openssl --enable-ssl-crtd --enable-ltdl-convenience --enable-icap-client
- make
- make install
squid anpassen
- cd /usr/local/squid/etc
- openssl req -new -newkey rsa:2048 -sha256 -days 365 -nodes -x509 -extensions v3_ca -keyout myCA.pem -out myCA.pem
- /usr/local/squid/libexec/security_file_certgen -c -s /var/lib/ssl_db -M 4MB
- cat /usr/local/squid/etc/squid.conf
acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN) acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN) acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN) acl localnet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN) acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN) acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_port 3128 ssl-bump cert=/usr/local/squid/etc/myCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB # For squid 4.x sslcrtd_program /usr/local/squid/libexec/security_file_certgen -s /var/lib/ssl_db -M 4MB acl step1 at_step SslBump1 ssl_bump peek step1 ssl_bump bump all icap_enable on icap_send_client_ip on icap_send_client_username on icap_client_username_encode off icap_client_username_header X-Authenticated-User icap_preview_enable on icap_preview_size 1024 icap_service service_req reqmod_precache bypass=0 icap://127.0.0.1:1344/squidclamav icap_service service_resp respmod_precache bypass=0 icap://127.0.0.1:1344/squidclamav adaptation_access service_req allow all adaptation_access service_resp allow all http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager http_access allow localnet http_access allow localhost http_access deny all coredump_dir /usr/local/squid/var/cache/squid refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320
squid clamav runterladen und übersetzen
- wget https://github.com/darold/squidclamav/archive/v7.1.tar.gz
- tar -vxzf v7.1.tar.gz
- cd squidclamav-7.1/
- ./configure && make && make install
c-icap aktivieren
- cat /etc/default/c-icap.conf
START=yes
- cat /etc/c-icap/c-icap.conf
Service squidclamav squidclamav.so Port 1344
diverse dienste starten
- systemctl restart clamav-freshclam.service
- systemctl restart clamav-daemon.service
- systemctl restart c-icap.service