Squid https aufbrechen und ClamAV

clamav und anderes installieren

• apt install c-icap clamav clamdscan libicapapi-dev clamav-daemon

squid runterladen und übersetzen

• wget http://www.squid-cache.org/Versions/v4/squid-4.17.tar.gz
• tar -xvzf squid-4.17.tar.gz
• cd squid*
• ./configure --with-openssl --enable-ssl-crtd --enable-ltdl-convenience --enable-icap-client
• make
• make install

squid anpassen

• cd /usr/local/squid/etc
• openssl req -new -newkey rsa:2048 -sha256 -days 365 -nodes -x509 -extensions v3_ca -keyout myCA.pem -out myCA.pem
• /usr/local/squid/libexec/security_file_certgen -c -s /var/lib/ssl_db -M 4MB
• cat /usr/local/squid/etc/squid.conf

acl localnet src 0.0.0.1-0.255.255.255  # RFC 1122 "this" network (LAN)
acl localnet src 10.0.0.0/8             # RFC 1918 local private network (LAN)
acl localnet src 100.64.0.0/10          # RFC 6598 shared address space (CGN)
acl localnet src 169.254.0.0/16         # RFC 3927 link-local (directly plugged) machines
acl localnet src 172.16.0.0/12          # RFC 1918 local private network (LAN)
acl localnet src 192.168.0.0/16         # RFC 1918 local private network (LAN)
acl localnet src fc00::/7               # RFC 4193 local private network range
acl localnet src fe80::/10              # RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT

http_port 3128 ssl-bump  cert=/usr/local/squid/etc/myCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB

# For squid 4.x
sslcrtd_program /usr/local/squid/libexec/security_file_certgen -s /var/lib/ssl_db -M 4MB

acl step1 at_step SslBump1

ssl_bump peek step1
ssl_bump bump all

icap_enable on
icap_send_client_ip on
icap_send_client_username on
icap_client_username_encode off
icap_client_username_header X-Authenticated-User
icap_preview_enable on
icap_preview_size 1024

icap_service service_req reqmod_precache bypass=0 icap://127.0.0.1:1344/squidclamav
icap_service service_resp respmod_precache bypass=0 icap://127.0.0.1:1344/squidclamav

adaptation_access service_req allow all
adaptation_access service_resp allow all

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager

http_access allow localnet
http_access allow localhost
http_access deny all
coredump_dir /usr/local/squid/var/cache/squid
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

squid clamav runterladen und übersetzen

• wget https://github.com/darold/squidclamav/archive/v7.1.tar.gz
• tar -vxzf v7.1.tar.gz
• cd squidclamav-7.1/
• ./configure && make && make install

c-icap aktivieren

• cat /etc/default/c-icap.conf

START=yes

• cat /etc/c-icap/c-icap.conf

Service squidclamav squidclamav.so
Port 1344

diverse dienste starten

• systemctl restart clamav-freshclam.service
• systemctl restart clamav-daemon.service
• systemctl restart c-icap.service