114 lines
4.0 KiB
SquidConf
114 lines
4.0 KiB
SquidConf
http_port 0.0.0.0:3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=10MB cert=/etc/squid/serverkey.pem capath=/usr/share/certs/ cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/etc/dh-parameters.2048 options=NO_SSLv2,NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE
|
|
|
|
icp_port 0
|
|
digest_generation off
|
|
dns_v4_first off
|
|
pid_filename /var/run/squid/squid.pid
|
|
cache_effective_user squid
|
|
cache_effective_group proxy
|
|
error_default_language en
|
|
icon_directory /usr/local/etc/squid/icons
|
|
visible_hostname odin
|
|
cache_mgr odin@infosec
|
|
access_log /var/squid/logs/access.log
|
|
cache_log /var/squid/logs/cache.log
|
|
cache_store_log none
|
|
netdb_filename /var/squid/logs/netdb.state
|
|
pinger_enable on
|
|
pinger_program /usr/local/libexec/squid/pinger
|
|
sslcrtd_program /usr/local/libexec/squid/ssl_crtd -s /var/squid/lib/ssl_db -M 4MB -b 2048
|
|
sslcrtd_children 5
|
|
sslproxy_capath /usr/local/share/certs/
|
|
sslproxy_options NO_SSLv2,NO_SSLv3,NO_TLSv1,SINGLE_DH_USE,SINGLE_ECDH_USE
|
|
sslproxy_cipher EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
|
|
sslproxy_cert_error allow all
|
|
sslproxy_cert_adapt setValidAfter all
|
|
sslproxy_cert_adapt setValidBefore all
|
|
|
|
logfile_rotate 10
|
|
debug_options rotate=10
|
|
shutdown_lifetime 3 seconds
|
|
# Allow local network(s) on interface(s)
|
|
acl localnet src 192.168.0.0/16 10.0.0.0/8 172.16.0.0/12
|
|
forwarded_for transparent
|
|
via off
|
|
httpd_suppress_version_string on
|
|
uri_whitespace encode
|
|
|
|
acl dynamic urlpath_regex cgi-bin \?
|
|
cache deny dynamic
|
|
|
|
cache_mem 4096 MB
|
|
maximum_object_size_in_memory 102400 KB
|
|
memory_replacement_policy heap GDSF
|
|
cache_replacement_policy heap LFUDA
|
|
minimum_object_size 0 KB
|
|
maximum_object_size 51200 MB
|
|
cache_dir aufs /var/squid/cache 150000 16 256
|
|
offline_mode off
|
|
cache_swap_low 90
|
|
cache_swap_high 95
|
|
cache allow all
|
|
# Add any of your own refresh_pattern entries above these.
|
|
refresh_pattern ^ftp: 1440 20% 10080
|
|
refresh_pattern ^ftp: 1440 20% 10080
|
|
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
|
|
refresh_pattern . 0 20% 4320
|
|
|
|
# Setup some default acls
|
|
# ACLs all, manager, localhost, and to_localhost are predefined.
|
|
acl allsrc src all
|
|
acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901 3128 3129 1025-65535
|
|
acl sslports port 443 563
|
|
|
|
acl purge method PURGE
|
|
acl connect method CONNECT
|
|
|
|
# Define protocols used for redirects
|
|
acl HTTP proto HTTP
|
|
acl HTTPS proto HTTPS
|
|
|
|
# SslBump Peek and Splice
|
|
# http://wiki.squid-cache.org/Features/SslPeekAndSplice
|
|
# http://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit
|
|
# Match against the current step during ssl_bump evaluation [fast]
|
|
# Never matches and should not be used outside the ssl_bump context.
|
|
#
|
|
# At each SslBump step, Squid evaluates ssl_bump directives to find
|
|
# the next bumping action (e.g., peek or splice). Valid SslBump step
|
|
# values and the corresponding ssl_bump evaluation moments are:
|
|
# SslBump1: After getting TCP-level and HTTP CONNECT info.
|
|
# SslBump2: After getting TLS Client Hello info.
|
|
# SslBump3: After getting TLS Server Hello info.
|
|
# These ACLs exist even when 'SSL/MITM Mode' is set to 'Custom' so that
|
|
# they can be used there for custom configuration.
|
|
acl step1 at_step SslBump1
|
|
acl step2 at_step SslBump2
|
|
acl step3 at_step SslBump3
|
|
http_access allow manager localhost
|
|
|
|
http_access deny manager
|
|
http_access allow purge localhost
|
|
http_access deny purge
|
|
http_access deny !safeports
|
|
http_access deny CONNECT !sslports
|
|
|
|
# Always allow localhost connections
|
|
http_access allow localhost
|
|
|
|
request_body_max_size 0 KB
|
|
delay_pools 1
|
|
delay_class 1 2
|
|
delay_parameters 1 -1/-1 -1/-1
|
|
delay_initial_bucket_level 100
|
|
delay_access 1 allow allsrc
|
|
|
|
|
|
ssl_bump peek step1
|
|
ssl_bump bump all
|
|
# Setup allowed ACLs
|
|
# Allow local network(s) on interface(s)
|
|
http_access allow localnet
|
|
# Default block all to be sure
|
|
http_access deny allsrc
|