0

I would like to make my internet site only working with https. I tried the following solution: Squid reverse proxy redirect / rewrite HTTP to HTTPS

acl PORT80 myport 80
acl MYSITE dstdomain foo.server.com
http_access deny PORT80 MYSITE
deny_info 301:https://foo.server.com%R MYSITE

In my case:

acl PORT80 myport 80
acl MYSITE dstdomain www.asrtos.com
http_access deny PORT80 MYSITE
deny_info 301:https://www.asrtos.com%R MYSITE

This does not work because the browser cans still access the port 80

What can I do? Thanks a lot for your help.

My squid.conf file is:

#
# Recommended minimum configuration:
#

debug_options ALL,1 33,2 28,9

acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 82.223.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines

acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl Safe_ports port 1025-65535  # unregistered ports

acl Safe_ports port 443 563 # https

acl CONNECT method CONNECT

#
# Recommended minimum Access Permission configuration:
#
# accept only SSL ports
http_access deny  !Safe_ports
http_access allow  Safe_ports

acl PORT80 myport 80
acl MYSITE dstdomain www.asrtos.com
http_access deny PORT80 MYSITE
deny_info 301:https://www.asrtos.com%R MYSITE

 http_access deny to_localhost

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
https_port 443 accel cert=/etc/ssl/certs/asrtos.com_ssl_certificate.cer key=/etc/ssl/certs/_.asrtos.com_private_key.key cafile=/etc/ssl/certs/_.asrtos.com_ssl_certificate_INTERMEDIATE.cer defaultsite=workflow01.asrtos.com

 cache_peer 82.223.66.210 parent 80 0 no-query originserver name=hp # If you use one single computer, write this instead:
 http_port 3128 accel defaultsite=workflow01.asrtos.com vhost       # Doc config reverse proxy sous linux

# And finally deny all other access to this proxy
 http_access deny all

# Uncomment the line below to enable disk caching - path format is /cygdrive/<full path to cache folder>, i.e.
#cache_dir aufs /cygdrive/d/squid/cache 3000 16 256

# Leave coredumps in the first cache dir
coredump_dir /var/cache/squid

max_filedescriptors 3200

The infrastructure should be the following:

https--[Reverse Proxy SQUID]--http--[Domino Server]< - - >(Domino data bases)

The http server is a part integrated to the Domino server. (A task of the domino server)

The Squid reverse proxy and the Domino servers are installed on the same Windows 2008 R2 machine. The internet application accesses to domino database thru the Domino server.

According to the user right the server domino sends a login form to identify the user. All the computation of the user rights is assumed automatically by the domino server.

In http mode (non-secure mode all works very well). I have to install a secure mode and all works well with an exception:

When the web client send this url : https://www.asrtos.com/database.nsf

The server sends a login form to check the user rights and then opens the following url: http://www.asrtos.com/database.nsf (the same url in non-secure mode).

If I modify manually the url: https://www.asrtos.com/database.nsf all works well. But it’s always possible to go back manually to a non-secure mode: http://...

I have no access to the HTTP task which is integrated to the Domino server.

So I don’t know how to make a redirect inside the Domino http server.

I hope it’s possible to find a solution inside the proxy.

2
  • why not making a redirect on the server that is hosting the site? – BANJOSA Feb 10 '20 at 12:12
  • Thanks a lot Gerald for your reply. I added more information about the structure of the server and application to explain why it’s difficult to integrate the redirect into http server. – Jerome Feb 11 '20 at 10:57
0

This configuration of Squid is OK :

minimum configuration:

debug_options ALL,0

acl localnet src 82.223.0.0/12 # RFC1918 possible internal network acl localhost src 127.0.0.1/255.255.255.255 acl Safe_ports port 443 # https

cache_peer myServer.myDomain parent 8088 0 no-query originserver name=myServer.myDomain Front-End-Https: On # If you use one single computer, write this instead: https_port 443 accel cert=/etc/ssl/certs/myDomain_ssl_certificate.cer key=/etc/ssl/certs/_.myDomain_private_key.key cafile=/etc/ssl/certs/_.myDomain_ssl_certificate_INTERMEDIATE.cer defaultsite=myServer.myDomain http_port 80 accel defaultsite=myServer.myDomain

http_access allow Safe_ports

acl PORT80 port 80 http_access deny PORT80 deny_info 301:https://%H%R PORT80

http_access deny all http_port 3128 transparent dns_nameservers 127.0.0.1

max_filedescriptors 3200

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.