0

We have a Ubuntu server between our network & the firewall for URL filtering. Of course SSL connections are a problem. I am looking into ways of doing some basic filtering. I have even thought of using sslstrip & squid, but this doesn't seem like a very good solution. Does anyone have a suggestion of how I might be able to do this. I searched a lot of Google, but didn't really get any good answers... perhaps that is because there are none?

Thanks!

Improve this question

3 Answers 3

Reset to default
2

At the current time I don't think you can do this with squid. The potential is there:

We believe it is technically possible to implement dynamic certificate generation for transparent connections. Doing so requires turning Squid transaction handling steps upside down, so that the secure connection with the server is established before the secure connection with the client. The implementation will be difficult, but it will allow Squid to get the server name from the server certificate and use that to generate a fake server certificate to give to the client. Quality patches or sponsorships welcomed.

Source: see limitations section of http://wiki.squid-cache.org/Features/DynamicSslCert

I know of at least one commercial solution that does this. There may be more.

Improve this answer
4
  • Thanks for the reply. We already have a server. I was hoping to find a software solution. Even if we can't use squid, I would be happy to implement something else.
    – BrNathan
    Dec 11, 2010 at 19:56
  • Open Source only or could it be commercial?
    – sdanelson
    Dec 11, 2010 at 20:23
  • With our budget it would have to be open source.
    – BrNathan
    Dec 12, 2010 at 10:35
  • I am not aware of any open source implementations that actually do a MITM. Someone else might know of one. ClearOS indicates that it can filter https just not in transparent mode. I am not sure on the implementation details.
    – sdanelson
    Dec 12, 2010 at 23:28
1

Well you cannot do this. SSL is made to prevent any kind of manipulation/modification.

You can block entire hosts, but you cannot see the url the user sees.

Improve this answer
3
  • I am fairly familiar with SSL & there are ways around this. Cymphonix does has its method, zScaler has another. Like I mentioned in my question, I have even contemplated using sslstrip. I was hoping to get a more practical open source solution.
    – BrNathan
    Dec 11, 2010 at 14:00
  • 2
    yes you can. It is called a MITM attack. In the case of an managed network it is perfectly acceptable. Many web-filtering appliances allow you to do this. In order for it to be transparent it requires the clients to trust a CA cert that is used on the proxy to generate SSL certs on the fly. Since the clients trust the CA cert issuing the certs there are no certificate errors. If the CA cert is not trusted then you will get cert errors in the client.
    – sdanelson
    Dec 11, 2010 at 18:05
  • That is no problem since I can issues the certs to all the clients on our network. What type of software do you suggest that will be stable on a 300+ computer network?
    – BrNathan
    Dec 11, 2010 at 19:21
0

The question is a bit old but still relevant to answer.

What is "basic SSL filtering" to you? Do you want to filter HTTPS (SSL-wrapped HTTP) or filter everything on port 443 ?

ufdbGuard is a URL filter for Squid that besides the straightforward URL based filtering also probes port 443 to find out what type of traffic is going through Squid. ufdbGuard recognises SSL+HTTP, SSH, various tunnels/VPNs, various major chat applications and unrecognised protocols is marked as "unknown protocol". ufdbGuard can block each type, and can enforce the use of valid SSL certificates and the use of a FQDN.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .