Squid with HTTPS filtering without certificate spoofing, integration with Active Directory 2012R2 + WPAD

This manual was written in connection with the production need to monitor the traffic (http and https) of users, as well as the distribution of access on white and black lists. The articles were taken as a basis: this and this one , in which the peek-n-splice technology was used. In these articles, the configuration assumes the use of a host with squid as a gateway; after configuring the config, a full-fledged proxy server is obtained with the ability to distribute access rights to groups from Active Directory. Upon completion of the configuration, the question arose of transferring proxy server settings to users. In view of the fact that in the office often laptops take home - the whole idea is at a standstill. Initially, the option of issuing proxy server settings via DHCP was considered, but it is not the best, since offices in different subnets and different equipment, WPAD was the way out of this situation. In short, this technology can be said that client machines on Windows OS are looking for a host named wpad.example.ru (up to third level domains) to request a settings file for networking. Based on this principle, you need to raise the web server, which would just give the wpad.dat file. You can raise the web server on the host with the proxy server (as was done), and create a cname wpad on the proxy server in the DNS server . It is better to use a proxy server with the ability to collect and view statistics, since the choice is sufficient. In view of some conservative considerations, it was decided to choose SARG. It is easy to set up, fairly acceptable statistics for an office with up to 100 employees.

1.1 Simplified WPAD Workflow

- A client on Windows OS accesses a DNS server with a request to the host wpad.example.com , and the DNS server name corresponding entry indicates where to apply. Next, the client requests wpad.example.ru with a request for a settings file. Having received it, it begins to act accordingly to the instructions in it.

1.2 How good this technology is.

Pros:

- there is no need through GPO to register all clients with a proxy address
- Employee mobility (Internet access outside the office)
- To disable the use of this technology, it is enough to disable in the "Properties of the browser" - "Automatically receive settings"

Minuses:

- “Automatically receive settings” can be turned off by any user, so it’s better to leave this feature enabled and prevent it from being changed via GPO

1.3 Squid Peek-n-splice - how to it works

An employee is trying to access the site with https through a proxy. When an encrypted connection is established, a “greeting” occurs, which is transmitted in open form, the proxy server intercepts it, and based on the configuration, squid allows or denies the connection. Those. intercepted to look at the "greeting", allowed or dropped a connection.

1.4 Pros and cons of Peek-n-splice

Pros:

- This is not a MITM attack, and there will be no problems with bank clients
- Display of domain names in the statistics of sites requested by https

Minuses:

- Unfortunately, it’s impossible to fully view which particular webpage was opened as during a MITM attack.
- This configuration showed itself well only on CentOS (there were problems on Debian, after a while kernel-panic happened)

1.5 And so, now it is worth noting that it is given

- Host with Active Directory 2012R2 (user authorization method - Kerberos) 10.0.0.9
- Host with CentOS 7 (x64) (it's a web server for uploading wpad.dat, it's a proxy server) 10.0.0.10
- Test host with Windows OS to test operation 10.0.0.11

"Let's go" Gagarin Yu.A.

2 Configuring the operating system and installing Squid

The process of installing CentOS does not make sense to describe. So let's keep in mind that we have a freshly installed CentOS 7 x64. So, for Squid to work equally well with http and https traffic, you need the following:

2.1 Squid should be built with these parameters

Or you can download the archive with the collected squid and its dependencies.

2.2 Installing the necessary packages from the official repositories

It is worth noting that for the installation of squid need some dependencies. Unfortunately, CentOS has rather poor official repositories, so some packages need to be downloaded from unofficial ones. Installing the necessary packages from the repository:

# yum install -y libtool-ltdl perl-DBI perl-Digest-MD5 cyrus-sasl-gssapi krb5-workstation 

2.3 Manual installation of Squid and additional packages

 # rmp -Uvh squid-3.5.8-4.el7.centos.x86_64.rpm libecap-1.0.0-3.el7.centos.x86_64.rpm squid-helpers-3.5.8-4.el7.centos.x86_64.rpm perl-Crypt-OpenSSL-X509-1.803-4.el7.x86_64.rpm 

If something is wrong, something is missing in the terminal.

2.4 Setting permissions for the swap directory

 # chown squid:squid /var/spool/squid 

2.5 configuration file /etc/squid/squid.conf

2.6 You must first bring the file / etc / hosts to such content.

 127.0.0.1 localohost 10.0.0.10 sq.example.ru sq 

2.7 Customize selinux

The / etc / selinux / config file should contain the value:

 SELINUX=enforcing 

Install the package to work with selinux:

 # yum install policycoreutils-python 

Add selinux rules

Allow connections to squid:

 # setsebool -P squid_connect_any on 

Allow kerberos:

 # setsebool -P allow_kerberos on 

We allow connections to the squid on port 3130:

 # semanage port -a -t squid_port_t -p tcp 3130 

After changing the selinux parameters, you must reboot the system to apply them.

 # reboot 

2.8 swap generation

 # squid -z 

2.9 Enabling the squid daemon, checking the configuration file

 # systemctl enable squid # squid -k parse 

Varningov and errorov should not be. If there is something - you need to check the settings.

2.10 Allowed traffic forwarding

 # echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf 

Apply the setting on the fly:

 # sysctl -p 

3 Integration with Active Directory Domain Controller 2012R2

Integration with the domain controller is necessary so that domain users can log in to the proxy server using the Kerberos protocol. The most reasonable solution is to leave only Kerberos due to the fact that this method is the safest, authorization occurs automatically. As for client machines that are outside the domain, there are no problems here, the username and password can be entered manually in the authorization pop-up window. Checked works.

3.1 Configuration file /etc/krb5.conf

The configuration file /etc/krb5.conf must be brought to the following form:

3.2 Creating DNS Records

Everyone knows that Active Directory is closely tied to DNS, and for authorization to work correctly, you need to create a node (A or AAA) with the indication of the host name and its ip-address (It turns out the sq.example.ru record with the ip-address 10.0.0.10 ).

3.3 Domain Integration Options

And so, there are two chairs option integration with the domain. The first option is using Windows ( ktpass ), the second option is using Linux ( Msktutil ). The Windows option is good because you can disable the password expiration for the squid user. The Linux version is good because you can enter into the domain through the creation of a computer account.

3.3.1 Integration by Windows

We create the user in AD, for example squid
Now generate krb5.keytab . At the command prompt on a domain controller with administrative rights, you must run this command:

 C:\Windows\system32> ktpass -princ HTTP/sq.example.ru@EXAMPLE.RU -mapuser squid@EXAMPLE.RU -crypto rc4-hmac-nt -pass Pa$$wd12 -ptype KRB5_NT_PRINCIPAL -out C:\ 

The krb5.keytab file itself (can be moved using WinSCP) to sq.example.ru in the / etc directory.

3.3.2 Linux integration

In the archive with the squid and dependencies msktutil is also attached, install it:

 # rpm -Uhv msktutil-0.5.1-2.el7.x86_64.rpm 

Now execute the following command:

 # msktutil -c -b "CN=COMPUTERS" -s HTTP/sq.example.ru -k /etc/krb5.keytab --computer-name sq-k --upn HTTP/sq.example.ru --server dc1.example.ru --verbose --enctypes 28 

If successful, the output of the command will be great; I see no point in copying here. Errors and varningov should not be. It is worth paying attention to - computer-name sq-k is not a typo. The hostname must be different.

In view of the need to update the password for the computer account, this can be done through cron.

  # crontab -e 

It is necessary to add a task to it:

 00 3 * * * msktutil --auto-update --verbose --computer-name sq-k 

3.4 Recommended rights to the krb5.keytab file

After moving krb5.keytab , it is recommended to lower access rights to the file

 # chown squid:squid /etc/krb5.keytab && chmod 644 /etc/krb5.keytab 

3.5 AD Access Groups

In ActiveDirectory in OU Users, you need to create three groups according to which Internet access will be distributed: Internet-full, Internet-medium , Internet-low .

3.6 Authorization check

Verification of authorization in Active Directory using the /etc/krb5.keytab file

 # kinit -V -k -t /etc/krb5.keytab HTTP/sq.example.ru@EXAMPLE.RU 

The output of the command should be something like this:

 Using default cache: /tmp/krb5cc_0 Using principal: HTTP/sq.example.ru@EXAMPLE.RU Using keytab: /etc/krb5.keytab Authenticated to Kerberos v5 

And the klist should display the following:


The Squid configuration is almost complete, now we reboot the host to apply the settings. After the reboot for the test, you can manually register the proxy in the sq.example.ru settings by specifying port 3130 .

4 WPAD

4.1 Installing and configuring the apache2 web server

Installing a web server:

 # yum install -y httpd 

After installation we include in autoload:

 # systemctl enable httpd 

Run:

 # systemctl start httpd 

If you try to open the domain name sq.example.ru in your browser, the test page apache2 should open.

Next, you need to create a / var / www / html / wpad.dat file with the following content:

4.2 Description of the wpad.dat file

By default, the file in the /var/www/html/wpad.dat directory is given to everyone without any additional apache2 settings, and this is just necessary for correct interaction with client machines on Windows OS.

Lines

 if (isInNet( host, "192.168.0.0", "255.255.255.0") || isInNet( host, "10.0.0.0", "255.255.255.0") || 

Indicate that calls to the hosts on the 192.168.0.0/24, 10.0.0.0/24 and 127.0.0.0/8 subnets (the latter is necessary for the correct operation of the services when accessing localhost) are transmitted directly, and also the connection to the domain hosts .example .ru:

Lines:

 if (dnsDomainIs( host, "*.inet-example.ru" )) { return "DIRECT"; } 

Indicate that when accessing domain names .inet-example.ru occurs directly

If the requested resource does not fall under the above conditions, the following is true:

 return "PROXY sq.exmaple.ru:3130"; 

4.3 Create CNAME

On the Active Directory DNS server you need to create a cname wpad (FQDN wpad.example.com) on sq.example.com.

For verification, you need to open wpad / wpad.dat in the browser and the wpad.dat file should automatically download. Thus, all hosts download the file, and based on the content act. It is recommended to re-log or reboot all computers in the domain on Windows to download the file.

5 Statistics

5.1 Installing SARG from Source

If gcc has not been installed before, now is the time:

 # yum install -y gcc gd gd-devel make wget # wget http://liquidtelecom.dl.sourceforge.net/project/sarg/sarg/sarg-2.3.10/sarg-2.3.10.tar.gz # tar -xvzf sarg-2.3.10.tar.gz # cd sarg-2.3.10 # ./configure # make 

In the file po / Makefile.in.in, the gettext version is specified as 0.18, so that there was no error during make install, you need to change to 0.19:

 # make install 

5.2 Configuring SARG

The standard configuration file /usr/local/etc/sarg.conf is better to save:

 # mv /usr/local/etc/sarg.conf /usr/local/etc/sarg.conf.default 

Now create the sarg.conf file with the following content:

 access_log /var/log/squid/access.log output_dir /var/www/html/squid-reports date_format e overwrite_report yes language UTF-8 

5.3 Report generation schedule using cron

 # crontab -e 

Add a line:

 55 23 * * * /usr/local/bin/sarg -xd day-0 

This line indicates that reports will be generated every day and for the current day at 23:55

5.4 Web server configuration

The previously installed web server can also be assigned the task of displaying reports, with a request to enter a login and password for authorization. Create the file /etc/httpd/conf.d/sarg.conf with the following contents:

5.5 Authorization on a site with statistics

Generate login and password file for authorization

 # htpasswd -c /etc/httpd/conf/.htpasswd administrator 

Restart apache2 :

 # systemctl restart httpd 

When you try to open sq.example.ru/reports, you will be prompted to enter your login and password. In case of successful authorization, you can view the statistics.

6 Group Policy

Everything here is ambiguous and may depend on some features. In the current task, it was a reasonable decision to exclude the possibility of installing a proxy server for the user, or disabling the “Automatic detection of parameters”.

6.1 GPO Editing

To prohibit the input of a proxy server or change the settings for automatic detection of parameters, you can use Group Policy. We create and associate a group policy with an OU, for example, office .

Editing Group Policy:

User → Policies → Administrative Templates → Windows Components → Internet Explorer

In this directory, find the parameters and translate into "Enabled" status:

"Prohibit changing proxy settings"
"Disable automatic parameter changes"

In conclusion, I can say this, this configuration has been working successfully since the spring of 2016, and has proven itself well. All questions will be happy to answer.

UPD # 1: 12.11.16
1 The extra lines of ports 3128 and 3129 were removed from the squid config.
2 included selinux and added rules.
3 The certificate generation was removed from the manual (it works without it)
4 Minor fixes
UPD # 2: 11/20/16
1 Extra lines have been removed from krb5.conf config
2 Added method of integration with AD through Msktutil
3 Forwarding added
4 Updated archive with squid and dependencies.