From: Kadir DEMIR (kadir@kadirdemir.com)
Date: Tue 03 Oct 2006 - 10:41:36 GMT
Selamlar,
Sistemde iptables kurulu degil arkadaslar. Sadece Squid var ve Websense ile entegre olarak calisiyor. Websense de hersey monitor only.
Ama sorun su ki, http calisirken https calismiyor. Https sitelere giderken bu /var/log/squid/access.log a yansimiyor.
squid.conf icinde asagidaki gibi bir kisim var. Bununla ilgili olabilir mi dicem ama on ve off olarak denedim, sonuc degismedi.
#Default:
# none
# TAG: ssl_unclean_shutdown
# Some browsers (especially MSIE) bugs out on SSL shutdown
# messages.
#
#Default:
# ssl_unclean_shutdown off
# TAG: icp_port
# The port number where Squid sends and receives ICP queries to
# and from neighbor caches. Default is 3130. To disable use
# "0". May be overridden with -u on the command line.
Mozilla'nin verdigi hata;
The connection was reset
The connection to the server was reset while the page was loading.
* The site could be temporarily unavailable or too busy. Try again in a few
moments.
* If you are unable to load any pages, check your computer's network
connection.
* If your computer or network is protected by a firewall or proxy, make sure
that Firefox is permitted to access the Web.
MS Internet Explorer 6.0'in verdigi hata;
Please try the following:
Click the Refresh button, or try again later.
If you typed the page address in the Address bar, make sure that it is spelled correctly.
To check your connection settings, click the Tools menu, and then click Internet Options. On the Connections tab, click Settings. The settings should match those provided by your local area network (LAN) administrator or Internet service provider (ISP).
See if your Internet connection settings are being detected. You can set Microsoft Windows to examine your network and automatically discover network connection settings (if your network administrator has enabled this setting).
Click the Tools menu, and then click Internet Options.
On the Connections tab, click LAN Settings.
Select Automatically detect settings, and then click OK.
Some sites require 128-bit connection security. Click the Help menu and then click About Internet Explorer to determine what strength security you have installed.
If you are trying to reach a secure site, make sure your Security settings can support it. Click the Tools menu, and then click Internet Options. On the Advanced tab, scroll to the Security section and check settings for SSL 2.0, SSL 3.0, TLS 1.0, PCT 1.0.
Click the Back button to try another link.
----- Original Message -----
From: Huzeyfe Onal
To: linux-ag@liste.linux.org.tr
Sent: Tuesday, October 03, 2006 11:53 AM
Subject: Re: [Linux-ag] Squid ve Https sitelere erisim sorunu...
Merhaba,
boyle bir kural guvenliginizi sifira dusurecektir... Iceriden disariya tum erisimleri tanimlamaniza gerek yok Squid ile SSL trafigine izin verebilirsiniz.
On 10/3/06, Metin KARAKUŞ <alemmetin@gmail.com> wrote:
gerci transparent olmasada durum değişmez ama tek faydası elle ayar yapmamak işte ..
komut satırında aşagıdakini çalıştırın (yalnız internete çıkan ethernetiniz eth0 mı kontrol edin)
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sorununuz düzelmiş olmalı
----- Original Message -----
From: Kadir DEMIR
To: linux-ag@liste.linux.org.tr
Sent: Tuesday, October 03, 2006 11:39 AM
Subject: Re: [Linux-ag] Squid ve Https sitelere erisim sorunu...
Metin Bey merhaba,
Oncelikle hizli sekilde cevap verdiginiz icin cok tesekkur ederim. Squid transparent olarak calismiyor. Kullanicilarin browserlarinda proxy ipsi ve portu yazili durumda.
Iyi calismalar....
----- Original Message -----
From: Metin KARAKUŞ
To: linux-ag@liste.linux.org.tr
Sent: Tuesday, October 03, 2006 11:32 AM
Subject: Re: [Linux-ag] Squid ve Https sitelere erisim sorunu...
squid transparent olarakmı calısıyor
eğer cevap evet ise siz 80 porttan gelen istekleri 8080 yönlendirmişşinizdir muhtemelen o yuzden http://***** dediğinizde ulaşıyorsunuz
https=80 nolu portu kullanmaz o nedenle transparent olarak calısmaz
yapmanız gereken
açılışa bunları betik olarak hazırlayıp calıstırn
eth0 = internete çıkan ethernetiniz olsun
eth1= iç ağa bakan ethernetiniz oldugunu farz ederek alltakileri yazıyorum siz kendinize göre değiştirebilirsiniz
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
bu sayede sadece 80 değil tüm portları ic aga acmıs olursun
ardından
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.1.1:8080
bu sayedede http isteklerinizi squide yönlendirmiş olduk
artık sorunsuz kullanabiliyor olmalısınız
----- Original Message -----
From: Kadir DEMIR
To: linux-ag@liste.linux.org.tr
Sent: Tuesday, October 03, 2006 11:14 AM
Subject: [Linux-ag] Squid ve Https sitelere erisim sorunu...
Arkadaslar merhaba,
Fedora 4.0 uzerine squid-2.5.STABLE9-7 kurdum. Http sitelerine giderken https sitelere gidemiyorum. Internette biraz arastirdigimda Internet Explorer ile ilgili bir bug'dan soz edildigini duydum ve mozilla firefox indirdim. Sonuc ayni her iki browserdan da https sayfalarina erisemiyorum. Bu sorunu nasil asabilirim?
Ekte sistem detaylari ve squid.conf'un icerigi mevcut. Daha once konu ile ugrasip sonuc alabilen arkadaslardan yardimlarini rica ediyorum
Iyi calismalar...
Linux version 2.6.11-1.1369_FC4 (bhcompile@decompose.build.redhat.com ) (gcc version 4.0.0 20050525 (Red Hat 4.0.0-9)) #1 Thu Jun 2 22:55:56 EDT 2005
Fedora Core release 4 (Stentz)
squid-2.5.STABLE9-7
#Default:
http_port 8080
#Default:
cache_dir ufs /var/spool/squid 1024 16 256
#Recommended minimum configuration:
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
#acl identusers ident REQUIRED
acl denge src 192.168.26.0/24 10.39.40.0/24
# TAG: http_access
# Allowing or Denying access based on defined access lists
#
# Access to the HTTP port:
# http_access allow|deny [!]aclname ...
#
# NOTE on default values:
#
# If there are no "access" lines present, the default is to deny
# the request.
#
# If none of the "access" lines cause a match, the default is the
# opposite of the last line in the list. If the last line was
# deny, the default is allow. Conversely, if the last line
# is allow, the default will be deny. For these reasons, it is a
# good idea to have an "deny all" or "allow all" entry at the end
# of your access lists to avoid potential confusion.
#
#Default:
# http_access allow all
#
#Recommended minimum configuration:
#
# Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
# Deny requests to unknown ports
http_access deny !Safe_ports
# Deny CONNECT to other than SSL ports
http_access deny CONNECT !SSL_ports
#
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
# Example rule allowing access from your local networks. Adapt
# to list your (internal) IP networks from where browsing should
# be allowed
#acl our_networks src 192.168.1.0/24 192.168.2.0/24
#http_access allow our_networks
# And finally deny all other access to this proxy
http_access allow localhost
# acl denge src 192.168.26.0/24 10.39.40.0/24
http_access allow denge
http_access deny all
Kadir DEMIR
Network & Security Engineer
Gsm: +90 544 4575595
Mail:kadir@kadirdemir.com
----------------------------------------------------------------------------
_______________________________________________
Linux-ag mailing list
Linux-ag@liste.linux.org.tr
http://liste.linux.org.tr/mailman/listinfo/linux-ag
----------------------------------------------------------------------------
_______________________________________________
Linux-ag mailing list
Linux-ag@liste.linux.org.tr
http://liste.linux.org.tr/mailman/listinfo/linux-ag
----------------------------------------------------------------------------
_______________________________________________
Linux-ag mailing list
Linux-ag@liste.linux.org.tr
http://liste.linux.org.tr/mailman/listinfo/linux-ag
_______________________________________________
Linux-ag mailing list
Linux-ag@liste.linux.org.tr
http://liste.linux.org.tr/mailman/listinfo/linux-ag
--
Huzeyfe ÖNAL
+90 505 5260064
---
Ag Guvenligi Listesine uye oldunuz mu?
http://www.huzeyfe.net/netsec.html
------------------------------------------------------------------------------
_______________________________________________
Linux-ag mailing list
Linux-ag@liste.linux.org.tr
http://liste.linux.org.tr/mailman/listinfo/linux-ag
_______________________________________________
Linux-ag mailing list
Linux-ag@liste.linux.org.tr
http://liste.linux.org.tr/mailman/listinfo/linux-ag