Dotaz: Problem s transparentnym Squidom pri https

[peta]

Ahoj velmi ma zaujima preco nejde nastavit proxy server ako transparentny pre HTTPS? Na oficialnych strankach som citala, ze to nejde a, ze by to bola bezpecnostna chyba keby to slo. Co je na tom pravda? Viete mi vysvetlit preco to nejde? Dakujem pekne.

---

---

Odpovědi

[MMMMMMMMM]

Protoze by utocnik pres https mohl tunelovat provoz, ktery se neda identifikovat.

"Web filtering proxies are not able to peer inside secure sockets HTTP transactions, assuming the chain-of-trust of SSL/TLS has not been tampered with. As a result, users wanting to bypass web filtering will typically search the internet for an open and anonymous HTTPS transparent proxy. They will then program their browser to proxy all requests through the web filter to this anonymous proxy. Those requests will be encrypted with https. The web filter cannot distinguish these transactions from, say, a legitimate access to a financial website. Thus, content filters are only effective against unsophisticated users.

As mentioned above, the SSL/TLS chain-of-trust does rely on trusted root certificate authorities; in a workplace setting where the client is managed by the organization, trust might be granted to a root certificate whose private key is known to the proxy. Concretely, a root certificate generated by the proxy is installed into the browser CA list by IT staff. In such scenarios, proxy analysis of the contents of a SSL/TLS transaction becomes possible. The proxy is effectively operating a man-in-the-middle attack, allowed by the client's trust of a root certificate the proxy owns."

NN

[Zdenek]

Novejsi squid to umi. Viz SslBump. Jen je nutne si uvedomit, dusledky ktere z toho, hlavne pro klienty, plynou

[peta]

A mozes mi povedat co to pre klientov znamena?

[peta]

...lebo nie je mi jasne aky je rozdiel medzi tym, ze nastavim v prehliadaci ip a port a pripojim sa na https a medzi tym, ze sa pripojim na transparentny proxy na https. Nevidim v tom rozdiel. Dakujem

[Jendа]

V podstatě to funguje takto:

V tomto kroku si vyrobíme vlastní certifikát (self-signed) a budeme poslouchat na portech 80 a 443 a logovat veškeré požadavky, které přes nás půjdou. Dále při pokusu o komunikaci s HTTP serverem s HTTPS stáhneme jeho certifikát, našemu klientovi podstrčíme svůj certifikát a požadavky od klienta vždycky naším soukromým klíčem rozšifrujeme, poznamenáme si je do logu, zašifrujeme "pravým" certifikátem a odešleme.

Efekt je ten, že klientovi se zobrazí varování, že certifikát je self-signed. Třeba ve Firefoxu vypadá takhle.