3

I need to inspect a part of the HTTPS traffic passing through my Linux (CentOS 6.5) router. In particular I need to know which destination web site host is being requested by the user. The user can be a guest browser / device over which I have no control (i.e. can't deploy certificates). I don't care about the contents / payload, I just need to log the destination URL into a log file :-)

It's open in terms of technology, I'm not limited and can therefore use iptables, squid, or any other filter that runs on Linux (preferably not a commercial one - some of those are licensed by device). Or even a combination of the above.

I am pretty sure this can be done because if I can install Fiddler on my windows machine and browse HTTPS web sites using Chrome without certificate warnings and see the "host" in Fiddler.

I have spent some time searching to see how this can be done, but so far have hit limitations with certificates needing to be installed on client browsers. That, and I could only find string matching for iptables but from what I understand that won't work with HTTPS packets as they are encrypted (I wrongly thought that the destination would not be encrypted ?)

Any help with this would be appreciated, hope I've covered the requirements in enough details.

  • 1
    Without the private key and cert, the only thing you can see with a packet analyzer is a the destination IP and domain, but not the full URL. – Daniel t. Jan 5 '16 at 4:29
1
  1. Capture and cache DNS queries made by your users. Then you can match that with the IPs of outgoing port 443 connections
  2. tshark. You should be able to get SNI out of it somehow
  3. Google "p0f ssl". You can get the user-agent with this.

Please post if you get somethin running, am also interested in such a thing

6

Thanks to SNI, you can easily get the server name that data is being requested from, but the entirety of the rest of the conversation (including the rest of the URL) is (as designed) encrypted and unavailable to you unless you control the TLS private key.

  • Great! How? :-) – Dominik Jan 5 '16 at 4:29
  • 1
    Dig into it, Dominik. I bet you can sort it out with a tiny bit of research. – EEAA Jan 5 '16 at 4:30
  • just looking for which technology is best to use... iptables? – Dominik Jan 5 '16 at 4:36
  • 1
    You can give that a try and then when it doesn't work, put some more brain power into sorting out how to inspect details of packets traversing your server. :) Look, I'm not trying to be obtuse here. I could easily spoon-feed you exactly what you need to do, but then you wouldn't learn how to think critically about this and do your own research (which is a big part of being a sysadmin). – EEAA Jan 5 '16 at 4:38
  • 1
    I've already given you hints, as has Daniel above. – EEAA Jan 5 '16 at 4:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.