3

I am trying to configure squid as transparent proxy , I followed below steps to configure

Downloaded squid3.5 from the website, As squid3.1 will not support for ssl bump

./configure --enable-linux-netfilter --enable-icap-client --enable-ssl --with-filedescriptors=65536 --with-large-files --prefix=/usr --localstatedir=/var --libexecdir=${prefix}/lib/squid --srcdir=. --datadir=${prefix}/share/squid --sysconfdir=/etc/squid
make
make install

ssl has been enabled for squid , I can check using

squid -v 
Squid Cache: Version 3.5.2
Service Name: squid
configure options:  '--enable-linux-netfilter' '--enable-icap-client' '--enable-ssl' '--with-filedescriptors=65536' '--with-large-files' '--prefix=/usr' '--localstatedir=/var' '--libexecdir=/lib/squid' '--srcdir=.' '--datadir=/share/squid' '--sysconfdir=/etc/squid' 'CPPFLAGS=-I../libltdl' --enable-ltdl-convenience

Every thing is good till now

I have created certificated in /etc/squid/cert/squid.pem

When i edit squid.conf to

http_port 3128
https_port 3130 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/cert/squid.pem

only http_port with 3128 is running

netstat -nap | grep 3128
tcp6       0      0 :::3128                 :::*                    LISTEN      2802/squid

but https_port 3130 is updating and even accepting certificates

#netstat -nap | grep 3130
#

I have tried to use http_port with ssl-bump

squid -z
2015/03/06 19:52:11| FATAL: Unknown http_port option 'ssl-bump'.
FATAL: Bungled /etc/squid/squid.conf 

I have made to changes to iptables for redirecting port 80 to 3128 and 443 to 3130

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 3130

Please let me know why am not able to add ssl-bump in https_port

Thanks

  • --enable-ssl-crtd is maybe missing in your configure list of options – Dom Mar 6 '15 at 15:12
  • Ohh !I will enable it BTW is there any way to enable after installation or do i have to start from ./configure – prabhu Mar 6 '15 at 15:31
  • It is not compiled in your software, so it will never be available. So start at configure, sorry ! – Dom Mar 6 '15 at 15:33
  • I will do that no prob ..Thanks for your suggestion ! – prabhu Mar 6 '15 at 15:39
  • You may also be missing --with-openssl from the ./configure flags. – Joseph Sible Aug 11 '18 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.