marvinwankersteen
commented
7 months ago Additional context
/usr/local/etc/squid/squid.conf# Setup regular listeners configuration http_port 192.168.0.1:3128 ssl-bump cert=/var/squid/ssl/ca.pem dynamic_cert_mem_cache_size=10MB generate-host-certificates=on
setup ssl re-cert
sslcrtd_program /usr/local/libexec/squid/security_file_certgen -s /var/squid/ssl_crtd -M 4MB sslcrtd_children 5
tls_outgoing_options options=NO_TLSv1 cipher=HIGH:MEDIUM:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
setup ssl bump acl's
acl bump_step1 at_step SslBump1 acl bump_step2 at_step SslBump2 acl bump_step3 at_step SslBump3 acl bump_nobumpsites ssl::server_name "/usr/local/etc/squid/nobumpsites.acl"
configure bump
ssl_bump peek bump_step1 all ssl_bump splice all ssl_bump peek bump_step2 all ssl_bump splice bump_step3 all ssl_bump bump
sslproxy_cert_error deny all
acl ftp proto FTP http_access allow ftp
Setup ftp proxy
Rules allowing access from your local networks.
Generated list of (internal) IP networks from where browsing
should be allowed. (Allow interface subnets).
Default allow for local-link and private networks
acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
ACL - Allow localhost for PURGE cache if enabled
ACL lists
ACL - Remote fetched Blacklist (remoteblacklist)
ACL - Block browser/user-agent - User defined (browser)
ACL - SSL ports, default are configured in config.xml
Configured SSL ports (if defaults are not listed, then they have been removed from the configuration!):
acl SSL_ports port 443 # https
Default Safe ports are now defined in config.xml
Configured Safe ports (if defaults are not listed, then they have been removed from the configuration!):
ACL - Safe_ports
acl Safe_ports port 443 # https acl CONNECT method CONNECT
ICAP SETTINGS
disable icap
icap_enable off
Pre-auth plugins
include /usr/local/etc/squid/pre-auth/*.conf
Authentication Settings
Configure Local User Authentication helper
auth_param basic program /usr/local/libexec/squid/basic_pam_auth -o auth_param basic realm proxy authentication auth_param basic credentialsttl 1 hours auth_param basic children 50
ACL - Local Authorized Users - local_auth
acl local_auth proxy_auth REQUIRED
Google Suite Filter
YouTube Filter
Deny requests to certain unsafe ports
http_access deny !Safe_ports
Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports
Only allow cachemgr access from localhost
http_access allow localhost manager http_access deny manager
We strongly recommend the following be uncommented to protect innocent
web applications running on the proxy server who think the only
one who can access services on "localhost" is a local user
http_access deny to_localhost
Auth plugins
include /usr/local/etc/squid/auth/*.conf
#
Access Permission configuration:
#
Deny request from unauthorized clients
http_access allow local_auth
#
ACL - localnet - default these include ranges from selected interfaces (Allow local subnets)
http_access allow localnet
ACL - localhost
http_access allow localhost
Deny all other access to this proxy
http_access deny all
Post-auth plugins
include /usr/local/etc/squid/post-auth/*.conf
Caching settings
cache_mem 256 MB
Leave coredumps in the first cache dir
coredump_dir /var/squid/cache
#
Add any of your own refresh_pattern entries above these.
#
refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320
Squid Options
pinger_enable off logformat opnsense %>a %[ui %>eui %[un [%tl] "%rm %ru HTTP/%rv" %>Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh access_log stdio:/var/log/squid/access.log opnsense cache_store_log stdio:/var/log/squid/store.log
Disable via Header
via off
Suppress http version string (default=off)
httpd_suppress_version_string on
URI handling with Whitespaces (default=strip)
uri_whitespace strip
X-Forwarded header handling (default=on)
forwarded_for delete
Disable squid logfile rotate to use system defaults
logfile_rotate 0
Define visible email
cache_mgr info@domain.local
Set error directory language
error_directory /usr/local/etc/squid/errors/local
- `/usr/local/etc/squid/proxy_policies.conf`[policy_1f6355a8-58ff-4aa2-af37-e7d49c30c1d6] policy_type=custom description=Allow .heise.de content=.heise.de applies_on=u:root,u:activedirectoryuser source_net=192.168.0.0/24 action=allow
[policy_8d1b92d9-7222-4ad3-b1e3-2c2a18176d93] policy_type=custom description=Deny .com content=* applies_on=g:all_ad_users,u:root source_net=0.0.0.0/0 action=deny
[source]
blacklist=/usr/local/opnsense/data/proxy/blacklists.tar.gz
blacklist_download_uri=https://opnsense-update.deciso.com/
- `/usr/local/etc/squid/auth/10-opnproxy-ext.auth.conf`Ident based authentication, used to query by network, as long as we don't use IDENT, the "username" will match -
external_acl_type ext_opnproxy_helper_net ttl=30 negative_ttl=5 %ACL %IDENT %SRC %METHOD %URI /usr/local/opnsense/scripts/OPNProxy/squid_acl_helper.py --sslurlonly acl opnproxy_ext_acl_net external ext_opnproxy_helper_net http_access allow opnproxy_ext_acl_net
Login based authentication
external_acl_type ext_opnproxy_helper_usr ttl=30 negative_ttl=5 %ACL %LOGIN %SRC %METHOD %URI /usr/local/opnsense/scripts/OPNProxy/squid_acl_helper.py --sslurlonly acl opnproxy_ext_acl_usr external ext_opnproxy_helper_usr http_access allow opnproxy_ext_acl_usr
explicit disable default allow authenticated users clause
http_access deny local_auth all
**Environment**
- OPNsense 23.10.2-amd64
- Intel(R) Xeon(R) Gold 6444Y (4 cores, 4 threads)
- FreeBSD 13.2-RELEASE-p7
- OpenSSL 1.1.1w
- Licensed until 2025-01-20
- VMware Virtual Platform
- os-OPNProxy 1.0.3
- os-squid 1.0.d
- os-redis 1.1_2
- squid 6.6
- redis-server 7.2.3
**Conclusion**
The problem seems to be squid and/or the `%IDENT` variable.
I don't quite understand the meaning behind this variable, because according to the documentation you need an IDENT server for this, but as far as I know this is not available on the OPNsense and we don't have such a server running either.
I hope that someone can help us here, as we only bought the Business Edition for this plugin.
We have also tested all possible variants of the configuration, but none of this changes anything.
AdSchellevis
jaohbib
Monviech
Important notices Before you add a new report, we ask you kindly to acknowledge the following:
Describe the bug Hello,
we have purchased a subscription for the Business Edition so that we can use the
os-OPNProxyplugin to give Active Directory users/groups access to certain pages. Unfortunately, there are major difficulties with Squid when setting it up. After much debugging, here is a bug report in the hope that the problem can be solved.To Reproduce Steps to reproduce the behavior:
os-OPNProxy,os-squidandos-redisAuthentication methodto the previous added AD-ServerEnable SSL inspectionLog SNI information onlyhttp://192.168.0.1:3128Expected behavior Browser should ask for the (basic) authentication. After successfully authentication, the website should be allowed or denied.
Relevant log files Stop squid/proxy in the GUI. Then start squid in debugmode on CLI and try with
curlto open some websites. I will add some linebreaks in this code block after whichcurlis executed.curl -vI --proxy-header "Proxy-Authorization: Basic <BASE64>" --proxy "http://192.168.0.1:3128" https://www.heise.deTrying 192.168.0.1:3128...
Connected to 192.168.0.1 (192.168.0.1) port 3128
CONNECT tunnel: HTTP/1.1 negotiated
allocate connect buffer
Establish HTTP proxy tunnel to www.heise.de:443
Proxy CONNECT aborted
Closing connection curl: (56) Proxy CONNECT aborted
/var/log/system/latest.logIf we comment out line 2, 3 and 4 in
/usr/local/etc/squid/auth/10-opnproxy-ext.auth.conf, the connection is possible and no errors logged. Also works if we replace in line 2%IDENTwith%LOGIN.curlagain:In the
/var/log/system/latest.logyou can see that squid starts (two) subprocesses with the Python script/usr/local/opnsense/scripts/OPNProxy/squid_acl_helper.py.The first apparently with the first
external_acl_typeto the%IDENTvariable, which is probably set with-. The second call calls the secondexternal_acl_type, which probably has no content (NULL byte) in$IDENTand the child process of squid dies. The relevant code in Squid (src/acl/FilledChecklist.ccis:See
stderrfrom squid: