PROXY SQUID

squid-3.5.0.2-20141121-r13666.tar.gz
(beta version)

INTERCEPT MODE
SUPPORT WITH HTTP AND HTTPS

Oleh :

Muhammad Fahmy Hadziqy S.T

SMK BAKTI ILHAM RANCAEKEK

2014
not imposible caching even HTTPS
by muhammad fahmy hadziqy S.T

Syarat, sitem operasi sudah terinstall terlebih dahulu,

dalam tulisan saya kali ini sistem operasi yang digunakan
adalan debian 6.0, testing produksi RT/RW net pun
menggunakan ubuntu server LTS 14.04.1 sudah tidak ada
kendala.
Apa itu intercept mode
intercept
SupportforIPLayerinterceptionofoutgoingrequests
withoutbrowsersettings.

dikutip dari web resmi nya squid, jadi intercept mode

adalah mendukung IP-layer interception dalam permintaan
keluar baik itu http ataupun https tanpa mengatur browser,
dengan kata lain bisa di belokan paksa oleh router, paket
untuk tujuan/dst 80(http) dan 443(https) ke mesin/port Proxy,
di squid 2.x mungkin rekan-rekan sudah tidak asing lagi yang
nama nya transparent.

langsung saja, tp jgn lupa update dulu paket informasi

update dulu paket informasi nya

#apt-get update

not imposible caching even HTTPS

by muhammad fahmy hadziqy S.T

install file pendukung

# apt-get install devscripts -y && apt-get install buildessential -y && apt-get install openssl -y && apt-get install
libssl-dev -y && apt-get install fakeroot -y && apt-get install
libcppunit-dev -y && apt-get install libsasl2-dev -y && aptget install cdbs -y && apt-get install ccze -y && apt-get
install libfile-readbackwards-perl -y && apt-get install
libcap2 -y && apt-get install libcap-dev -y && apt-get install
libcap2-dev -y && apt-get install sysv-rc-conf -y

download file squid nya

#wget
http://www.squid-cache.org/Versions/v3/3.5/squid3.5.0.2-20141121-r13666.tar.gz
extract file yang telah di download
#tar -xzvf squid-3.5.0.2-20141121-r13666.tar.gz
masuk ke direktori hasil extract tadi
compile dengan opsi ini, boleh juga disesuaikan dengan
kebutuhan lain nya, di sini sudah mendukung opsi untuk
menggunakan helper external(pada bagian install file
pendukung pun sudah), yang gunanya nanti helper external
itu untuk merubah url dinamis menjadi statis, agar bisa tercache oleh Squid :D

not imposible caching even HTTPS

by muhammad fahmy hadziqy S.T

configure & compile

#./configure --prefix=/usr --bindir=/usr/bin \
--sbindir=/usr/sbin --libexecdir=/usr/lib/squid \
--sysconfdir=/etc/squid --localstatedir=/var \
--includedir=/usr/include --datadir=/usr/share/squid \
--infodir=/usr/share/info --mandir=/usr/share/man \
--srcdir=. --disable-dependency-tracking \
--disable-strict-error-checking --enable-storeio=ufs,aufs,diskd
\
--enable-removal-policies=lru,heap --disable-ipv6 \
--disable-wccp --disable-wccpv2 --enable-kill-parent-hack \
--enable-snmp --enable-cachemgr-hostname=proxy \
--enable-cache-digests --disable-select \
--enable-http-violations --enable-linux-netfilter \
--enable-follow-x-forwarded-for --disable-ident-lookups \
--disable-auth-basic --enable-x-accelerator-vary \
--enable-zph-qos --enable-ssl --enable-ssl-crtd --with-openssl
--without-gnutls --with-default-user=proxy --withlogdir=/var/log/squid \
--with-pidfile=/var/run/squid.pid --withswapdir=/var/spool/squid \
--with-aufs-threads=32 --with-dl --with-large-files --enableltdl-convenience \
not imposible caching even HTTPS
by muhammad fahmy hadziqy S.T

--with-filedescriptors=65536

membuat binary hasil compile tadi dan

memasangnya(install) ke dalam sistem operasi
# make && make install
agak lama tunggu saja sambil roko+kopi dulu, hehe
penampakan make

penampakan make install

not imposible caching even HTTPS

by muhammad fahmy hadziqy S.T

cek file service squid nya nongol ga?

#ls /etc/init.d/

wah ga ada, mas bro

woles tar PM saya saja untuk mencegah hal-hal yang tidak di
inginkan :D

bikin dulu cache direktori & hak akses & user+group

kepemilikan
#mkdir /cache1 && mkdir /cache2
#chmod 777 /cache1 && chmod 777/ cache2
#chown proxy:proxy /cache1 && chown proxy:proxy
/cache2
boleh di seuaikan dengan kebutuhan

not imposible caching even HTTPS

by muhammad fahmy hadziqy S.T

buat dulu sertijab eh salah sertifikat SSL tea :D

#cd /etc/squid
#mkdir ssl_cert

#opensslreqnewnewkeyrsa:1024days365nodesx509
keyoutmyCA.pemoutmyCA.pem

opensslx509inmyCA.pemoutformDERoutmyCA.der

sumber: http://wiki.squidcache.org/Features/DynamicSslCert

buat direktori yg nanti nya untuk bumping ssl dari server

oleh proxy
#mkdir /etc/squid/ssl_db

menyiapkan proxy ssl_crtd untuk caching sertifikat nya

/usr/lib/squid/ssl_crtdcs/etc/squid/ssl_db/certs

not imposible caching even HTTPS

by muhammad fahmy hadziqy S.T

sesudah nya jgn lupa memberikan hak akses tulis untuk

squid user, dalam hal ini di rubah menjadi owner nobody
saja cukup

chownRnobody/etc/squid/ssl_db

not imposible caching even HTTPS

by muhammad fahmy hadziqy S.T

==============================
tambahkan di file squid.conf
==============================
cache_dir /cache1 aufs 100 16 256
cache_dir /cache1 aufs 100 16 256

http_port 3128 intercept

https_port 3129 intercept ssl-bump generate-hostcertificates=on dynamic_cert_mem_cache_size=4MB
cert=/etc/squid/ssl_cert/myCA.pem

sslcrtd_program /usr/lib/squid/ssl_crtd -s
/etc/squid/ssl_db/certs/ -M 4MB
sslcrtd_children 32 startup=30 idle=1
ssl_unclean_shutdown on
sslproxy_version 1
always_direct allow all
##untuk yg ga mau di bumping pake sll_bump none acl
aja,contoh server bank jgn lupa buatin acl server bank nya
ssl_bump none localhost
ssl_bump server-first all
sslproxy_cert_error allow all
sslproxy_flags DONT_VERIFY_PEER
not imposible caching even HTTPS
by muhammad fahmy hadziqy S.T

==============================
pada bagian refresh pattern tambah kan ini agar dapat
meng cache gambar hasil pencarian pada google
==============================
refresh_pattern -i \.gstatic.com\/images?.* 525600 100%
525600 override-expire ignore-auth
==============================
permision direktori log file squid
==============================
# chmod 777 /var/log/squid -R
# chown proxy:proxy /var/log/squid -R

==============================
buat swap direk folder cachenya
==============================
# squid -z

not imposible caching even HTTPS

by muhammad fahmy hadziqy S.T

==============================
restarting service squid
==============================
# service squid restart
or
# /etc/init.d/squid restart

not imposible caching even HTTPS

by muhammad fahmy hadziqy S.T

checking no error
# squid -k parse

membelokan paket 80 & 443 ke port proxy, sebelum nya

NAT dulu ya
not imposible caching even HTTPS
by muhammad fahmy hadziqy S.T

/etc/sysctl.conf
ipv4 forward nya enable kan :D
itpables -t nat -A POSTROUTING -s ip-network-client -j
MASQUERADE
iptables -t nat -A PREROUTING -s ip-network-client -p tcp
--dport 80 -j REDIRECT --to-port port-http-proxy
iptables -t nat -A PREROUTING -s ip-network-client -p tcp
--dport 443 -j REDIRECT --to-port port--https-proxy

copy file sertifikat ber-extensi .der

import ke browser
google chrome

setting
advanced
HTTPS/SSL
trusted Root certification authorities
not imposible caching even HTTPS
by muhammad fahmy hadziqy S.T

import
pilih file myCA.der
ok
JOSS

Daftar pustaka

http://wiki.squid-cache.org/

not imposible caching even HTTPS

by muhammad fahmy hadziqy S.T

http://www.squid-cache.org/
http://www.squid-cache.org/Doc/config/http_port/
http://wiki.squid-cache.org/Features/DynamicSslCert

not imposible caching even HTTPS

by muhammad fahmy hadziqy S.T