Squid https aufbrechen und ClamAV: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
Zeile 12: | Zeile 12: | ||
*openssl req -new -newkey rsa:2048 -sha256 -days 365 -nodes -x509 -extensions v3_ca -keyout myCA.pem -out myCA.pem | *openssl req -new -newkey rsa:2048 -sha256 -days 365 -nodes -x509 -extensions v3_ca -keyout myCA.pem -out myCA.pem | ||
*/usr/local/squid/libexec/security_file_certgen -c -s /var/lib/ssl_db -M 4MB | */usr/local/squid/libexec/security_file_certgen -c -s /var/lib/ssl_db -M 4MB | ||
+ | *cat /usr/local/squid/etc/squid.conf | ||
+ | <pre> | ||
+ | acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN) | ||
+ | acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN) | ||
+ | acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN) | ||
+ | acl localnet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines | ||
+ | acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN) | ||
+ | acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN) | ||
+ | acl localnet src fc00::/7 # RFC 4193 local private network range | ||
+ | acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines | ||
+ | |||
+ | acl SSL_ports port 443 | ||
+ | acl Safe_ports port 80 # http | ||
+ | acl Safe_ports port 21 # ftp | ||
+ | acl Safe_ports port 443 # https | ||
+ | acl Safe_ports port 70 # gopher | ||
+ | acl Safe_ports port 210 # wais | ||
+ | acl Safe_ports port 1025-65535 # unregistered ports | ||
+ | acl Safe_ports port 280 # http-mgmt | ||
+ | acl Safe_ports port 488 # gss-http | ||
+ | acl Safe_ports port 591 # filemaker | ||
+ | acl Safe_ports port 777 # multiling http | ||
+ | acl CONNECT method CONNECT | ||
+ | |||
+ | http_port 3128 ssl-bump cert=/usr/local/squid/etc/myCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB | ||
+ | |||
+ | # For squid 4.x | ||
+ | sslcrtd_program /usr/local/squid/libexec/security_file_certgen -s /var/lib/ssl_db -M 4MB | ||
+ | |||
+ | acl step1 at_step SslBump1 | ||
+ | |||
+ | ssl_bump peek step1 | ||
+ | ssl_bump bump all | ||
+ | |||
+ | icap_enable on | ||
+ | icap_send_client_ip on | ||
+ | icap_send_client_username on | ||
+ | icap_client_username_encode off | ||
+ | icap_client_username_header X-Authenticated-User | ||
+ | icap_preview_enable on | ||
+ | icap_preview_size 1024 | ||
+ | |||
+ | icap_service service_req reqmod_precache bypass=0 icap://127.0.0.1:1344/squidclamav | ||
+ | icap_service service_resp respmod_precache bypass=0 icap://127.0.0.1:1344/squidclamav | ||
+ | |||
+ | adaptation_access service_req allow all | ||
+ | adaptation_access service_resp allow all | ||
+ | |||
+ | http_access deny !Safe_ports | ||
+ | http_access deny CONNECT !SSL_ports | ||
+ | http_access allow localhost manager | ||
+ | http_access deny manager | ||
+ | |||
+ | http_access allow localnet | ||
+ | http_access allow localhost | ||
+ | http_access deny all | ||
+ | coredump_dir /usr/local/squid/var/cache/squid | ||
+ | refresh_pattern ^ftp: 1440 20% 10080 | ||
+ | refresh_pattern ^gopher: 1440 0% 1440 | ||
+ | refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 | ||
+ | refresh_pattern . 0 20% 4320 | ||
+ | </pre> | ||
+ | |||
=squid clamav runterladen und übersetzen= | =squid clamav runterladen und übersetzen= | ||
*wget https://github.com/darold/squidclamav/archive/v7.1.tar.gz | *wget https://github.com/darold/squidclamav/archive/v7.1.tar.gz |
Version vom 13. Juli 2020, 12:25 Uhr
clamav und anderes installieren
- apt install c-icap clamav clamdscan libicapapi-dev clamav-daemon
squid runterladen und übersetzen
- wget http://www.squid-cache.org/Versions/v4/squid-4.10-20200419-r2ae88f12c.tar.gz
- tar -xvzf squid-4.10-20200419-r2ae88f12c.tar.gz
- cd squid*
- ./configure --with-openssl --enable-ssl-crtd --enable-ltdl-convenience --enable-icap-client
- make
- make install
squid anpassen
- cd /usr/local/squid/etc
- openssl req -new -newkey rsa:2048 -sha256 -days 365 -nodes -x509 -extensions v3_ca -keyout myCA.pem -out myCA.pem
- /usr/local/squid/libexec/security_file_certgen -c -s /var/lib/ssl_db -M 4MB
- cat /usr/local/squid/etc/squid.conf
acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN) acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN) acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN) acl localnet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN) acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN) acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_port 3128 ssl-bump cert=/usr/local/squid/etc/myCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB # For squid 4.x sslcrtd_program /usr/local/squid/libexec/security_file_certgen -s /var/lib/ssl_db -M 4MB acl step1 at_step SslBump1 ssl_bump peek step1 ssl_bump bump all icap_enable on icap_send_client_ip on icap_send_client_username on icap_client_username_encode off icap_client_username_header X-Authenticated-User icap_preview_enable on icap_preview_size 1024 icap_service service_req reqmod_precache bypass=0 icap://127.0.0.1:1344/squidclamav icap_service service_resp respmod_precache bypass=0 icap://127.0.0.1:1344/squidclamav adaptation_access service_req allow all adaptation_access service_resp allow all http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager http_access allow localnet http_access allow localhost http_access deny all coredump_dir /usr/local/squid/var/cache/squid refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320
squid clamav runterladen und übersetzen
- wget https://github.com/darold/squidclamav/archive/v7.1.tar.gz
- tar -vxzf v7.1.tar.gz
- cd squidclamav-7.1/
- ./configure && make && make install