На сервере стоит ubuntu 20.04, пытаюсь сделать себе прокси и чтобы https работал. Нашёл несколько статей, все они примерно одинакового содержания, как вот эта тема. В итоге у меня https через прокси не работает.
squid --version
Squid Cache: Version 4.13
Service Name: squid
Ubuntu linux
This binary uses OpenSSL 1.1.1f 31 Mar 2020. For legal restrictions on distribution see https://www.openssl.org/source/license.html
configure options: '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--disable-silent-rules' '--libdir=${prefix}/lib/x86_64-linux-gnu' '--runstatedir=/run' '--disable-maintainer-mode' '--disable-dependency-tracking' 'BUILDCXXFLAGS=-g -O2 -fdebug-prefix-map=/home/builder/ubuntu20/build/squid/squid-4.13=. -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now ' 'BUILDCXX=g++' '--with-build-environment=default' '--enable-build-info=Ubuntu linux' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--libexecdir=/usr/lib/squid' '--mandir=/usr/share/man' '--enable-inline' '--disable-arch-native' '--enable-async-io=8' '--enable-storeio=ufs,aufs,diskd,rock' '--enable-removal-policies=lru,heap' '--enable-delay-pools' '--enable-cache-digests' '--enable-icap-client' '--enable-ssl' '--enable-follow-x-forwarded-for' '--enable-auth-basic=DB,fake,getpwnam,LDAP,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB' '--enable-auth-digest=file,LDAP' '--enable-auth-negotiate=kerberos,wrapper' '--enable-auth-ntlm=fake,SMB_LM' '--enable-external-acl-helpers=file_userip,kerberos_ldap_group,LDAP_group,session,SQL_session,time_quota,unix_group,wbinfo_group' '--enable-security-cert-validators=fake' '--enable-storeid-rewrite-helpers=file' '--enable-url-rewrite-helpers=fake' '--enable-eui' '--enable-esi' '--enable-icmp' '--enable-zph-qos' '--enable-ecap' '--disable-translation' '--with-swapdir=/var/spool/squid' '--with-logdir=/var/log/squid' '--with-pidfile=/run/squid.pid' '--with-filedescriptors=65536' '--with-large-files' '--with-default-user=proxy' '--enable-linux-netfilter' '--with-systemd' '--with-openssl' '--enable-ssl-crtd' 'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2 -fdebug-prefix-map=/home/builder/ubuntu20/build/squid/squid-4.13=. -fstack-protector-strong -Wformat -Werror=format-security -Wall' 'LDFLAGS=-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now ' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2 -fdebug-prefix-map=/home/builder/ubuntu20/build/squid/squid-4.13=. -fstack-protector-strong -Wformat -Werror=format-security'
Конфиг:
auth_param basic program /usr/lib/squid3/basic_ncsa_auth /etc/squid/passwords
auth_param basic realm proxy
acl authenticated proxy_auth REQUIRED
acl all src all
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
#http_access allow localnet
http_access allow localhost
http_access allow authenticated
http_access allow all
# And finally deny all other access to this proxy
http_access deny all
http_port 3128 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/certs/squidca.pem
acl step1 at_step SslBump1
ssl_bump peek step1
ssl_bump bump all
sslproxy_cert_error allow all
sslproxy_flags DONT_VERIFY_PEER # Accept certificates that fail verification.
sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/spool/squid/ssl_db/ -M 4MB
Сертификат сгенерировал так:
cd /etc/squid/certs/
sudo openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 -keyout squidca.pem -out squidca.pem
sudo openssl x509 -outform der -in squidca.pem -out squidca.crt
Затем скопировал его в /etc/pki/ca-trust/source/anchors/squidca.crt у себя локально и выполнил sudo update-ca-trust, так же пробовал импортировать непосредственно в браузер (в authorities). Firefox, например, говорит:
Secure Connection Failed
An error occurred during a connection to duckduckgo.com. PR_CONNECT_RESET_ERROR
The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.
CURL вообще записает:
curl --proxy https://xxx.xxx.xxx.xxx:3128 -u 'user:password' https://google.com -vvv
* Trying xxx.xxx.xxx.xxx:3128...
* Connected to xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx) port 3128 (#0)
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
* CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
Логи запуска:
-- The job identifier is 458725.
Mar 29 08:05:51 ubuntu-server squid[1508803]: 2022/03/29 08:05:51| WARNING: (B) '::/0' is a subnetwork of (A) '::/0'
Mar 29 08:05:51 ubuntu-server squid[1508803]: 2022/03/29 08:05:51| WARNING: because of this '::/0' is ignored to keep splay tree searching predictable
Mar 29 08:05:51 ubuntu-server squid[1508803]: 2022/03/29 08:05:51| WARNING: You should probably remove '::/0' from the ACL named 'all'
Mar 29 08:05:51 ubuntu-server squid[1508803]: 2022/03/29 08:05:51| ERROR: Directive 'sslproxy_flags' is obsolete.
Mar 29 08:05:51 ubuntu-server squid[1508803]: 2022/03/29 08:05:51| Created PID file (/run/squid.pid)
Mar 29 08:05:51 ubuntu-server squid[1508803]: Squid Parent: will start 1 kids
Mar 29 08:05:51 ubuntu-server squid[1508803]: Squid Parent: (squid-1) process 1508819 started
Mar 29 08:05:51 ubuntu-server squid[1508819]: 2022/03/29 08:05:51 kid1| WARNING: (B) '::/0' is a subnetwork of (A) '::/0'
Mar 29 08:05:51 ubuntu-server squid[1508819]: 2022/03/29 08:05:51 kid1| WARNING: because of this '::/0' is ignored to keep splay tree searching predictable
Mar 29 08:05:51 ubuntu-server squid[1508819]: 2022/03/29 08:05:51 kid1| WARNING: You should probably remove '::/0' from the ACL named 'all'
Mar 29 08:05:51 ubuntu-server squid[1508819]: 2022/03/29 08:05:51 kid1| ERROR: Directive 'sslproxy_flags' is obsolete.
Mar 29 08:05:51 ubuntu-server squid[1508819]: 2022/03/29 08:05:51 kid1| Set Current Directory to /var/spool/squid
Mar 29 08:05:51 ubuntu-server squid[1508819]: 2022/03/29 08:05:51 kid1| Creating missing swap directories
Mar 29 08:05:51 ubuntu-server squid[1508819]: 2022/03/29 08:05:51 kid1| No cache_dir stores are configured.
Mar 29 08:05:51 ubuntu-server squid[1508803]: Squid Parent: squid-1 process 1508819 exited with status 0
Mar 29 08:05:51 ubuntu-server squid[1508803]: 2022/03/29 08:05:51| Removing PID file (/run/squid.pid)
Mar 29 08:05:51 ubuntu-server squid[1508821]: 2022/03/29 08:05:51| WARNING: (B) '::/0' is a subnetwork of (A) '::/0'
Mar 29 08:05:51 ubuntu-server squid[1508821]: WARNING: (B) '::/0' is a subnetwork of (A) '::/0'
Mar 29 08:05:51 ubuntu-server squid[1508821]: 2022/03/29 08:05:51| WARNING: because of this '::/0' is ignored to keep splay tree searching predictable
Mar 29 08:05:51 ubuntu-server squid[1508821]: WARNING: because of this '::/0' is ignored to keep splay tree searching predictable
Mar 29 08:05:51 ubuntu-server squid[1508821]: 2022/03/29 08:05:51| WARNING: You should probably remove '::/0' from the ACL named 'all'
Mar 29 08:05:51 ubuntu-server squid[1508821]: WARNING: You should probably remove '::/0' from the ACL named 'all'
Mar 29 08:05:51 ubuntu-server squid[1508821]: 2022/03/29 08:05:51| ERROR: Directive 'sslproxy_flags' is obsolete.
Mar 29 08:05:51 ubuntu-server squid[1508821]: ERROR: Directive 'sslproxy_flags' is obsolete.
Mar 29 08:05:51 ubuntu-server squid[1508821]: Created PID file (/run/squid.pid)
Mar 29 08:05:51 ubuntu-server squid[1508821]: Squid Parent: will start 1 kids
Mar 29 08:05:51 ubuntu-server squid[1508821]: Squid Parent: (squid-1) process 1508823 started
Mar 29 08:05:51 ubuntu-server (squid-1)[1508823]: WARNING: (B) '::/0' is a subnetwork of (A) '::/0'
Mar 29 08:05:51 ubuntu-server (squid-1)[1508823]: WARNING: because of this '::/0' is ignored to keep splay tree searching predictable
Mar 29 08:05:51 ubuntu-server (squid-1)[1508823]: WARNING: You should probably remove '::/0' from the ACL named 'all'
Mar 29 08:05:51 ubuntu-server (squid-1)[1508823]: ERROR: Directive 'sslproxy_flags' is obsolete.
Mar 29 08:05:51 ubuntu-server squid[1508823]: Set Current Directory to /var/spool/squid
Mar 29 08:05:51 ubuntu-server squid[1508823]: Starting Squid Cache version 4.13 for x86_64-pc-linux-gnu...
Mar 29 08:05:51 ubuntu-server squid[1508823]: Service Name: squid
Mar 29 08:05:51 ubuntu-server squid[1508823]: Process ID 1508823
Mar 29 08:05:51 ubuntu-server squid[1508823]: Process Roles: worker
Mar 29 08:05:51 ubuntu-server squid[1508823]: With 1024 file descriptors available
Mar 29 08:05:51 ubuntu-server squid[1508823]: Initializing IP Cache...
Mar 29 08:05:51 ubuntu-server squid[1508823]: DNS Socket created at [::], FD 5
Mar 29 08:05:51 ubuntu-server squid[1508823]: DNS Socket created at 0.0.0.0, FD 10
Mar 29 08:05:51 ubuntu-server squid[1508823]: Adding nameserver 127.0.0.53 from /etc/resolv.conf
Mar 29 08:05:51 ubuntu-server squid[1508823]: helperOpenServers: Starting 5/32 'security_file_certgen' processes
Mar 29 08:05:51 ubuntu-server squid[1508823]: helperOpenServers: Starting 0/20 'basic_ncsa_auth' processes
Mar 29 08:05:51 ubuntu-server squid[1508823]: helperOpenServers: No 'basic_ncsa_auth' processes needed.
Mar 29 08:05:51 ubuntu-server squid[1508823]: Logfile: opening log daemon:/var/log/squid/access.log
Mar 29 08:05:51 ubuntu-server squid[1508823]: Logfile Daemon: opening log /var/log/squid/access.log
Mar 29 08:05:51 ubuntu-server squid[1508823]: Local cache digest enabled; rebuild/rewrite every 3600/3600 sec
Mar 29 08:05:51 ubuntu-server squid[1508823]: Store logging disabled
Mar 29 08:05:51 ubuntu-server squid[1508823]: Swap maxSize 0 + 262144 KB, estimated 20164 objects
Mar 29 08:05:51 ubuntu-server squid[1508823]: Target number of buckets: 1008
Mar 29 08:05:51 ubuntu-server squid[1508823]: Using 8192 Store buckets
Mar 29 08:05:51 ubuntu-server squid[1508823]: Max Mem size: 262144 KB
Mar 29 08:05:51 ubuntu-server squid[1508823]: Max Swap size: 0 KB
Mar 29 08:05:51 ubuntu-server squid[1508823]: Using Least Load store dir selection
Mar 29 08:05:51 ubuntu-server squid[1508823]: Set Current Directory to /var/spool/squid
Mar 29 08:05:51 ubuntu-server squid[1508823]: Finished loading MIME types and icons.
Mar 29 08:05:51 ubuntu-server squid[1508823]: HTCP Disabled.
Mar 29 08:05:51 ubuntu-server squid[1508823]: Pinger socket opened on FD 26
Mar 29 08:05:51 ubuntu-server squid[1508823]: Squid plugin modules loaded: 0
Mar 29 08:05:51 ubuntu-server squid[1508823]: Adaptation support is off.
Mar 29 08:05:51 ubuntu-server squid[1508823]: Accepting NAT intercepted SSL bumped HTTP Socket connections at local=[::]:3128 remote=[::] FD 23 flags=41
Mar 29 08:05:51 ubuntu-server systemd[1]: Started Squid Web Proxy Server.
-- Subject: A start job for unit squid.service has finished successfully
Ещё иногда в логах появляется вот это:
ERROR: listen( FD 24, [::] [ job2], 256): (98) Address already in use
