0

Trying to get squidguard to block https sites.

Setup. ( This is the basic config http://thejimmahknows.com/proxy-wccp-cisco-asa-squid-3-4/)

Server running centos 7. squid + squidguard installed.

Squid running as transparent. Talking to our ASA via wccpv2.

What is working: Blocking of http sites by name. IE disney.com HTTPS proxying seems to be working. Getting access log entries of

1447775591.689 408846 192.168.203.110 TCP_MISS/200 63828 CONNECT 104.16.92.254:443 - HIER_DIRECT/104.16.92.254 -

What isn't working.

Filtering of https sites.

I get no errors, just nothing happens. I can get to the site just fine. I'm not sure if it's a problem with my squid or squidguard.

3 Answers 3

1

The log indicates your HTTPS connection gets passed to SquidGuard as IP address and not domain name; this is expected behavior as browser always connects by IP in transparent deployments. Please use the latest Squid that is capable of passing SNI info to the external filters and find out how to adjust squid guard to use this info.

If you need to look into SSL content - setup SSL bump as for example in http://docs.diladele.com/administrator_guide_4_3/https_filtering/index.html; then let the ICAP web filter (qlproxy) block the next request from the browser (the domain name will be taken from Host request header).

0

Answer is: Don't use squidguard. It's old and unsupported.

After speaking to some people on the squid mailing list peek and splice is where it's at.

Also using squid's built in acl's will work find and no need for sg.

Only caveat, you must be running the newest version of squid. Updated packages for squid and centos can be found here.

http://wiki.squid-cache.org/KnowledgeBase/CentOS

-1

Sorry but your question it's not so clear for me , but if I understand right you use squid in transparent then you'll never could filter and intercept https! Take the deal! I hope it helps

2
  • If the question is not clear to you, you should use the comment function and ask for clarification first, and not try to provide a possible answer in half a sentence.
    – vic
    Nov 18, 2015 at 8:45
  • You're right I wrote in a wrong place , I was in a rush yesterday. Nov 18, 2015 at 9:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .