1

The root of the problem: I need to block access to https://somewebsite.com/folder/index.php; but allow access to the rest of the site. I thought the best way to accomplish it would be through a proxy like squid.

How can I accomplish my goal? Keep in mind I'm running squid 2.7 on a Windows 7 box and all the clients are also windows machines that I have full access to.

This is my first experience with squid, so any help is appreciated.

2 Answers 2

1

" Keep in mind I'm running squid 2.7 on a Windows 7 box and all the clients are also windows machines that I have full access to."

Yes you can,

here are the steps: => Install on the clients a certificate authority that you own ( for internet explorer you just have to install it at the system level in windows, for firefox and chrome you have to install it in every browser ) => At this point you can already use SslBump feature in squid to do what you want.

Alternatively you can also use an apache server with mod_proxy, IMHO it is easier to configure for doing what you want.

The key is to be able to generate a valid certificate for the target domain. So either you you own the domain and you can generate a perfectly valid certificate (via rapidssl or other ) and install it where you want, or if you can not have a "standard" certificate for the domain you need to have you own authority installed in the client software, and you just have to generate certificates with your own CA.

Then you just have to direct the traffic to a server ssl-enabled with your certificate - apache, squid, .. anything - and you can treat the traffic as plain http.

Update: squid 2.7 does not support SslBump. If you have to stick with squid 2.7 you have to configure an https_port as an accelerator and configure your client to use the different port for ssl connections to the https site you want to filter. For example alter their dns settings and put in place a proxy configuration telling them to not use the proxy for this site.

3
  • Did you not the point that SSLBump requires squid 3.1?
    – Zoredache
    May 22, 2012 at 20:02
  • right I did not notice this was squid 2.7. He can still do the trick with an apache installation for example using mod_rewrite, or stick with squid 2.7 and configure his client to use a different port on his squid proxy for ssl connections to this particular server.
    – Olivier S
    May 23, 2012 at 5:28
  • Thank you so much, I knew there was a way to get it done. May 23, 2012 at 12:04
0

Sorry, but you can't really do that with squid, or any other traditional proxy. What you are asking would require that you perform a man-in-the-middle attack against the clients.

When a browser is configured to use Squid as proxy, all you will see for SSL connections is that the browser is making HTTP CONNECT requests to a particular domain/IP. You will not be able to see the URL being requested, or any of the payload.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .