[squid-users] Peek'n Splice (ssl_bump) and authentication Somewhat OT: Content Filter with https

[Sergio Belkin]

Hey Sergio,
There are couple approaches to content filtering in the Linux world and in
other spaces.
Squid is open source and gives a lot but there are other ideas and ways to
perform content filtering.
Squid was designed for caching and does things in a specific way while
other solution might give a feature that would work "without interception".
On http it is doable to perform filtering in a very efficient way that is
similar to Squid's PEEK and SPLICE but there is a need in some level of
Interception in one step or another to perform the actual "block" operation.
I do not know about Open Source products that offers everything and it is
very simple to understand why.
What I know about are
- Squid + external tools(such as SquidGuard, ufdbguard, others)
- Ntop layer 7 filtering
- Custom DPI iptables modules
- NFQUEUE based IPS\IDS which can act as a url filtering engine
Consider that if you require only filtering and not caching then you can
get very high performance from many applications.
The fact that Squid was designed for Caching doesn't mean that you need to
use it.
Also there are couple cases which caching will hold your line and users
speed.
The best case scenario would be to not Intercept the traffic into squid
while in many cases it is not possible.
Eliezer
----
Eliezer Croitoru <http://ngtech.co.il/lmgtfy/>
Linux System Administrator
Mobile: [phone]
rg <http://www.lpi.org>

Thanks Eliezer, good summary. I've changed the subject to reflect better
the issue. As far I undestand from documention one can bump https only by
interception.
But what about if one Windows user login against an Active Directory, will
the authenticacion work to use the proxy?

I mean, what I'd want is:

- Only users of an Active Directory can use the proxy
- Block certains urls

Is that possible with squid+ufwdbguard?

Or should I use other tools/ways just like you mentioned?

Thanks in advance!

[Marcus Kool]

Thanks Eliezer, good summary. I've changed the subject to reflect better the issue. As far I undestand from documention one can bump https only by interception.

No. ssl-bump works very well with regular proxy mode, i.e. the browsers configure the address and port of the proxy or use PAC.

But what about if one Windows user login against an Active Directory, will the authenticacion work to use the proxy?
- Only users of an Active Directory can use the proxy

In regular proxy mode, authentication and peek+splice works fine.
Note that peek+splice does not require Squid CA certificates on the clients.

- Block certains urls
Is that possible with squid+ufwdbguard?

ufdbGuard works always, independent if Squid uses interception or not.
The issue is the messages that a browser displays for the end user (see earlier email).

Marcus

[Sergio Belkin]

Post by Marcus Kool

Post by Sergio Belkin
Thanks Eliezer, good summary. I've changed the subject to reflect better
the issue. As far I undestand from documention one can bump https only by
interception.

No. ssl-bump works very well with regular proxy mode, i.e. the browsers
configure the address and port of the proxy or use PAC.
But what about if one Windows user login against an Active Directory, will

Post by Sergio Belkin
the authenticacion work to use the proxy?
- Only users of an Active Directory can use the proxy

In regular proxy mode, authentication and peek+splice works fine.
Note that peek+splice does not require Squid CA certificates on the clients.

With peek+splce I block urls without CA certificates on the clients?
Remember I mean urls, not only domains!

Post by Marcus Kool
- Block certains urls

Post by Sergio Belkin
Is that possible with squid+ufwdbguard?

ufdbGuard works always, independent if Squid uses interception or not.
The issue is the messages that a browser displays for the end user (see earlier email).
Marcus
_______________________________________________
squid-users mailing list
http://lists.squid-cache.org/listinfo/squid-users

[Amos Jeffries]

Post by Sergio Belkin

Post by Marcus Kool

Post by Sergio Belkin
Thanks Eliezer, good summary. I've changed the subject to reflect better
the issue. As far I undestand from documention one can bump https only by
interception.

No. ssl-bump works very well with regular proxy mode, i.e. the browsers
configure the address and port of the proxy or use PAC.
But what about if one Windows user login against an Active Directory, will

Post by Sergio Belkin
the authenticacion work to use the proxy?
- Only users of an Active Directory can use the proxy

In regular proxy mode, authentication and peek+splice works fine.
Note that peek+splice does not require Squid CA certificates on the clients.

With peek+splce I block urls without CA certificates on the clients?
Remember I mean urls, not only domains!

The *URL* is buried inside the encryption.

The server hostname (aka 'domain' to some) is available in the
plain-text metadata.

Peek+Splice only uses the metadata. No decryption.

So ... *URL* is never available when splice'ing traffic regardless of
what you do to the clients.


Amos

[Marcus Kool]

Thanks Eliezer, good summary. I've changed the subject to reflect better the issue. As far I undestand from documention one can bump https only by interception.
No. ssl-bump works very well with regular proxy mode, i.e. the browsers configure the address and port of the proxy or use PAC.
But what about if one Windows user login against an Active Directory, will the authenticacion work to use the proxy?
- Only users of an Active Directory can use the proxy
In regular proxy mode, authentication and peek+splice works fine.
Note that peek+splice does not require Squid CA certificates on the clients.
With peek+splce I block urls without CA certificates on the clients? Remember I mean urls, not only domains!

No. To block HTTPS URLs one needs ssl_bump with peek+bump mode for all blocked URLs (see my message of June 8).
With peek+bump ufdbGuard can block anything you like and produce understandable messages to the end user.

Marcus

- Block certains urls
Is that possible with squid+ufwdbguard?
ufdbGuard works always, independent if Squid uses interception or not.
The issue is the messages that a browser displays for the end user (see earlier email).
Marcus

[Eliezer Croitoru]

Hey Sergio,



It depends on couple aspects of the setup.

The basic rule is that in the case you require authentication you are required to use a configured proxy and without Interception.

For SSL BUMP to work you need the clients to either access the proxy directly or to Intercept their connections.(Interception is not a must..)

If your setup doesn't have terminal servers for multiple clients then you can use an IP to USER authentication using a variety of options such as:

- Web Authentication portal

- DHCP level Authentication

- Radius based Authentication

- Couple others..

(all the above are based on IP level restrictions)



HTTPS and HTTP filtering are a bit different but if you have a basic "catch all" rule it would be much simpler to move on from there with the logic and implementation.

Specifically for HTTPS connections if you have a list of sites that you don't need to bump and you will be using a directly configured proxy(non intercept) then you would be able to minimize the noise that comes with fake certificates generation.


My suggestion in general is to first declare squid as a "first" trial and testing stage for a solution.

For some places Squid's breaking web-sockets are an overhead that cannot be tolerated while in other places it is acceptable as a security breach blocker.

If the place is not huge(200+ users) then I would start with a simple forward proxy with SSL BUMP but in a splice first(since peek and splice might not be needed due to the clients stating their target Domain Name) and later add the bump step.

It will help you to try and see how the proxy takes the load(with filtering but without caching).
Then move on to the next step of authentication, maybe Kerberos or if "transparent" authentication is required but if not then a simple LDAP based one.

If SquidGuard functionality is good for you then use it.

If not then ufdbguard or any other solution that is in your mind.

I tend to not publish my work too much here but if you want to take a peek and see how it works for you then:
http://new.ngtech.co.il/squidblocker_en.html



I also think that others work such as:

- http://www.quintolabs.com/ Diladele

- https://www.clearos.com/

- https://www.censornet.com/

is worth mentioning due to their high quality.( I have tested some of them myself)



About ufdbguard, it's not doing authentication but only url filtering as far as I know.

Squid's way of handling authentication is one and it's not on the same "channel" as filtering but an ICAP service can do that too.



Hope It Helps,

Eliezer



----

<http://ngtech.co.il/lmgtfy/> Eliezer Croitoru
Linux System Administrator
Mobile: [phone]
Email: ***@ngtech.co.il





From: Sergio Belkin [mailto:***@gmail.com]
Sent: Thursday, June 9, 2016 1:53 AM
To: Eliezer Croitoru
Cc: Squid Users
Subject: Re: Peek'n Splice (ssl_bump) and authentication [squid-users] Somewhat OT: Content Filter with https



2016-06-08 19:09 GMT-03:00 Eliezer Croitoru <***@ngtech.co.il <mailto:***@ngtech.co.il> >:

Hey Sergio,



There are couple approaches to content filtering in the Linux world and in other spaces.

Squid is open source and gives a lot but there are other ideas and ways to perform content filtering.

Squid was designed for caching and does things in a specific way while other solution might give a feature that would work "without interception".

On http it is doable to perform filtering in a very efficient way that is similar to Squid's PEEK and SPLICE but there is a need in some level of Interception in one step or another to perform the actual "block" operation.

I do not know about Open Source products that offers everything and it is very simple to understand why.

What I know about are

- Squid + external tools(such as SquidGuard, ufdbguard, others)

- Ntop layer 7 filtering

- Custom DPI iptables modules

- NFQUEUE based IPS\IDS which can act as a url filtering engine



Consider that if you require only filtering and not caching then you can get very high performance from many applications.

The fact that Squid was designed for Caching doesn't mean that you need to use it.
Also there are couple cases which caching will hold your line and users speed.



The best case scenario would be to not Intercept the traffic into squid while in many cases it is not possible.



Eliezer



----

<http://ngtech.co.il/lmgtfy/> Eliezer Croitoru
Linux System Administrator
Mobile: [phone]
Email: ***@ngtech.co.il <mailto:***@ngtech.co.il>







rg <http://www.lpi.org>



Thanks Eliezer, good summary. I've changed the subject to reflect better the issue. As far I undestand from documention one can bump https only by interception.

But what about if one Windows user login against an Active Directory, will the authenticacion work to use the proxy?

I mean, what I'd want is:

- Only users of an Active Directory can use the proxy

- Block certains urls

Is that possible with squid+ufwdbguard?

Or should I use other tools/ways just like you mentioned?

Thanks in advance!