initial commit
This commit is contained in:
Shane Peters
113
extra/squid.conf
Normal file
113
extra/squid.conf
Normal file
@@ -0,0 +1,113 @@
|
||||
http_port 0.0.0.0:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/etc/squid/serverkey.pem capath=/usr/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv2,NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE
|
||||
|
||||
icp_port 0
|
||||
digest_generation off
|
||||
dns_v4_first off
|
||||
pid_filename /var/run/squid/squid.pid
|
||||
cache_effective_user squid
|
||||
cache_effective_group proxy
|
||||
error_default_language en
|
||||
icon_directory /usr/local/etc/squid/icons
|
||||
visible_hostname odin
|
||||
cache_mgr odin@infosec
|
||||
access_log /var/squid/logs/access.log
|
||||
cache_log /var/squid/logs/cache.log
|
||||
cache_store_log none
|
||||
netdb_filename /var/squid/logs/netdb.state
|
||||
pinger_enable on
|
||||
pinger_program /usr/local/libexec/squid/pinger
|
||||
sslcrtd_program /usr/local/libexec/squid/ssl_crtd -s /var/squid/lib/ssl_db -M 4MB -b 2048
|
||||
sslcrtd_children 5
|
||||
sslproxy_capath /usr/local/share/certs/
|
||||
sslproxy_options NO_SSLv2,NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE
|
||||
sslproxy_cipher EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
|
||||
sslproxy_cert_error allow all
|
||||
sslproxy_cert_adapt setValidAfter all
|
||||
sslproxy_cert_adapt setValidBefore all
|
||||
|
||||
logfile_rotate 10
|
||||
debug_options rotate=10
|
||||
shutdown_lifetime 3 seconds
|
||||
# Allow local network(s) on interface(s)
|
||||
acl localnet src 192.168.0.0/16 10.0.0.0/8 172.16.0.0/12
|
||||
forwarded_for transparent
|
||||
via off
|
||||
httpd_suppress_version_string on
|
||||
uri_whitespace encode
|
||||
|
||||
acl dynamic urlpath_regex cgi-bin \?
|
||||
cache deny dynamic
|
||||
|
||||
cache_mem 4096 MB
|
||||
maximum_object_size_in_memory 102400 KB
|
||||
memory_replacement_policy heap GDSF
|
||||
cache_replacement_policy heap LFUDA
|
||||
minimum_object_size 0 KB
|
||||
maximum_object_size 51200 MB
|
||||
cache_dir aufs /var/squid/cache 150000 16 256
|
||||
offline_mode off
|
||||
cache_swap_low 90
|
||||
cache_swap_high 95
|
||||
cache allow all
|
||||
# Add any of your own refresh_pattern entries above these.
|
||||
refresh_pattern ^ftp: 1440 20% 10080
|
||||
refresh_pattern ^ftp: 1440 20% 10080
|
||||
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
|
||||
refresh_pattern . 0 20% 4320
|
||||
|
||||
# Setup some default acls
|
||||
# ACLs all, manager, localhost, and to_localhost are predefined.
|
||||
acl allsrc src all
|
||||
acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 3128 3129 1025-65535
|
||||
acl sslports port 443 563
|
||||
|
||||
acl purge method PURGE
|
||||
acl connect method CONNECT
|
||||
|
||||
# Define protocols used for redirects
|
||||
acl HTTP proto HTTP
|
||||
acl HTTPS proto HTTPS
|
||||
|
||||
# SslBump Peek and Splice
|
||||
# http://wiki.squid-cache.org/Features/SslPeekAndSplice
|
||||
# http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit
|
||||
# Match against the current step during ssl_bump evaluation [fast]
|
||||
# Never matches and should not be used outside the ssl_bump context.
|
||||
#
|
||||
# At each SslBump step, Squid evaluates ssl_bump directives to find
|
||||
# the next bumping action (e.g., peek or splice). Valid SslBump step
|
||||
# values and the corresponding ssl_bump evaluation moments are:
|
||||
# SslBump1: After getting TCP-level and HTTP CONNECT info.
|
||||
# SslBump2: After getting TLS Client Hello info.
|
||||
# SslBump3: After getting TLS Server Hello info.
|
||||
# These ACLs exist even when 'SSL/MITM Mode' is set to 'Custom' so that
|
||||
# they can be used there for custom configuration.
|
||||
acl step1 at_step SslBump1
|
||||
acl step2 at_step SslBump2
|
||||
acl step3 at_step SslBump3
|
||||
http_access allow manager localhost
|
||||
|
||||
http_access deny manager
|
||||
http_access allow purge localhost
|
||||
http_access deny purge
|
||||
http_access deny !safeports
|
||||
http_access deny CONNECT !sslports
|
||||
|
||||
# Always allow localhost connections
|
||||
http_access allow localhost
|
||||
|
||||
request_body_max_size 0 KB
|
||||
delay_pools 1
|
||||
delay_class 1 2
|
||||
delay_parameters 1 -1/-1 -1/-1
|
||||
delay_initial_bucket_level 100
|
||||
delay_access 1 allow allsrc
|
||||
|
||||
|
||||
ssl_bump peek step1
|
||||
ssl_bump bump all
|
||||
# Setup allowed ACLs
|
||||
# Allow local network(s) on interface(s)
|
||||
http_access allow localnet
|
||||
# Default block all to be sure
|
||||
http_access deny allsrc
|
||||
Reference in New Issue
Block a user