Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been assigned to research out and spec replacing our old and decrepit http content filtering system. There are several open source filtering packages available but I've not come across one that does SSL inspection.

The new system will scale to many branches of different sizes, from say 10 users to a few hundred, so purchasing an appliance for each branch isn't desirable.

When we're further along, we will do custom programming as we have a few unique needs in other aspects of filtering, so if the suggestion takes a bit of customization, it won't be a problem.

share|improve this question

4 Answers 4

up vote 1 down vote accepted

Dug Song's dsniff package has a mitm tool that should be able to do this. The code, while old, is in C and available from his site and the license is attribution-only.

share|improve this answer
    
Looks like it does what I want. –  user21464 Oct 1 '09 at 21:52

What do you mean by content filtering? If its anything that inspects the traffic while its in transit you're going to run into SSL errors-since one of the things SSL is specifically for is to stop people from peering at your traffic while in transit.

share|improve this answer
    
Not necessarily true. There are commercial products from BlueCoat and ClearTunnel that inspect HTTPS egress. They are an intentional man-in-the-middle attack. One SSL is from client to proxy, the proxy inspects, and a second SSL transaction goes from the proxy to the server. –  pboin Sep 29 '09 at 0:47
    
By content filtering I mean blocking viruses, malware, and preventing people from visiting unsavory websites while at work. And yes, it's basically a man-in-the-middle attack on your own network. Typically you add your own SSL cert to the client computer to prevent such errors. –  user21464 Sep 29 '09 at 0:49

short answer: Man in the middle ... that is the problem SSL was designed to solve.

longer answer: Some companies actually do accomplish this, but they force each browser and certificate store to trust their own certificate authority (CA), and the MITM can snoop on everything, quite dishonestly (albeit in accordance with your NDA).

share|improve this answer
1  
That's basically what I'm looking for, an open source project that can accomplish this. We're upfront about this sort of thing to our employees to, so while people might not like it, we're quite open about it. –  user21464 Sep 29 '09 at 1:40

I've not used it, but take a look at http://www.delegate.org/delegate/mitm/ - this in conjunction with dansguardian may provide HTTPS filtering.

share|improve this answer
    
+1 Looks like this would work as well, but I could only accept one answer. –  user21464 Oct 1 '09 at 21:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.