Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a Ubuntu server between our network & the firewall for URL filtering. Of course SSL connections are a problem. I am looking into ways of doing some basic filtering. I have even thought of using sslstrip & squid, but this doesn't seem like a very good solution. Does anyone have a suggestion of how I might be able to do this. I searched a lot of Google, but didn't really get any good answers... perhaps that is because there are none?

Thanks!

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

At the current time I don't think you can do this with squid. The potential is there:

We believe it is technically possible to implement dynamic certificate generation for transparent connections. Doing so requires turning Squid transaction handling steps upside down, so that the secure connection with the server is established before the secure connection with the client. The implementation will be difficult, but it will allow Squid to get the server name from the server certificate and use that to generate a fake server certificate to give to the client. Quality patches or sponsorships welcomed.

Source: see limitations section of http://wiki.squid-cache.org/Features/DynamicSslCert

I know of at least one commercial solution that does this. There may be more.

share|improve this answer
    
Thanks for the reply. We already have a server. I was hoping to find a software solution. Even if we can't use squid, I would be happy to implement something else. –  BrNathan Dec 11 '10 at 19:56
    
Open Source only or could it be commercial? –  sdanelson Dec 11 '10 at 20:23
    
With our budget it would have to be open source. –  BrNathan Dec 12 '10 at 10:35
    
I am not aware of any open source implementations that actually do a MITM. Someone else might know of one. ClearOS indicates that it can filter https just not in transparent mode. I am not sure on the implementation details. –  sdanelson Dec 12 '10 at 23:28
add comment

Well you cannot do this. SSL is made to prevent any kind of manipulation/modification.

You can block entire hosts, but you cannot see the url the user sees.

share|improve this answer
    
I am fairly familiar with SSL & there are ways around this. Cymphonix does has its method, zScaler has another. Like I mentioned in my question, I have even contemplated using sslstrip. I was hoping to get a more practical open source solution. –  BrNathan Dec 11 '10 at 14:00
2  
yes you can. It is called a MITM attack. In the case of an managed network it is perfectly acceptable. Many web-filtering appliances allow you to do this. In order for it to be transparent it requires the clients to trust a CA cert that is used on the proxy to generate SSL certs on the fly. Since the clients trust the CA cert issuing the certs there are no certificate errors. If the CA cert is not trusted then you will get cert errors in the client. –  sdanelson Dec 11 '10 at 18:05
    
That is no problem since I can issues the certs to all the clients on our network. What type of software do you suggest that will be stable on a 300+ computer network? –  BrNathan Dec 11 '10 at 19:21
    
@sdanelson huhh, I did not know that this is possible. Thanks (+1) for the insight! (It is still very nasty.) –  cstamas Dec 14 '10 at 13:53
    
you're welcome. –  sdanelson Dec 15 '10 at 2:37
add comment

The question is a bit old but still relevant to answer.

What is "basic SSL filtering" to you? Do you want to filter HTTPS (SSL-wrapped HTTP) or filter everything on port 443 ?

ufdbGuard is a URL filter for Squid that besides the straightforward URL based filtering also probes port 443 to find out what type of traffic is going through Squid. ufdbGuard recognises SSL+HTTP, SSH, various tunnels/VPNs, various major chat applications and unrecognised protocols is marked as "unknown protocol". ufdbGuard can block each type, and can enforce the use of valid SSL certificates and the use of a FQDN.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.