1 %%\subsection{Intercepting proxy solutions and reverse proxies}
3 Within enterprise networks and corporations with increased levels of paranoia or at least some defined security requirements it is common, NOT to allow direct connections to the public internet.
5 For this reason proxy-solutions are installed, to intercept ans (hopefully also) scan the traffic for potential threats within the sessions.
7 As soon as one wants to establish an encrypted connection to a server, there are three choices:
10 \item Block the connection, because it cannot be scanned for threats
11 \item Bypass the threat-mitigation and pass the encrypted session to the client, which results in a situation where malicious content is transferred directly to the client without visibility for the security system.
12 \item Intercept (i.e. terminate) the session at the proxy, scan there and re-encrypt the session towards the client.
15 While the latest solution might be the most "up to date", it arises a new front in the context of this paper, because the most secure part of a client's connection could only be within the corporate network, if the proxy-server handles the connection to the destination server in an insecure manner.
17 Conclusio: Don't forget to check your proxy solutions ssl-capabilities. Also do so for your reverse-proxies!
22 As of squid-3.2.7 (01 Feb 2013) there is support for the OpenSSL NO\_Compression option within squid config (CRIME attack) and if you combine that in the config file, with an enforcement of the server cipher preferences (BEAST Attack) you are safe.
24 \paragraph*{squid.conf}\mbox{}\\
28 \begin{lstlisting}[breaklines]
29 options=NO_SSLv2,NO_TLSv1,NO_Compression,CIPHER_SERVER_PREFERENCE
30 cipher=ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH [...]
36 \begin{lstlisting}[breaklines]
37 options=NO_SSLv2,NO_TLSv1,NO_Compression,CIPHER_SERVER_PREFERENCE
38 cipher=EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EDH+CAMELLIA256:EECDH:EDH+aRSA:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!SEED:!AES128:!CAMELLIA128:!ECDSA:AES256-SHA
43 \paragraph*{squid.conf}\mbox{}\\
46 %% http://forum.pfsense.org/index.php?topic=63262.0
49 \begin{lstlisting}[breaklines]
50 NO_SSLv2 Disallow the use of SSLv2
51 NO_SSLv3 Disallow the use of SSLv3
52 NO_TLSv1 Disallow the use of TLSv1.0
53 NO_TLSv1_1 Disallow the use of TLSv1.1
54 NO_TLSv1_2 Disallow the use of TLSv1.2
56 Always create a new key when using temporary/ephemeral
60 \todo{Patch here? Definitely working for 3.2.6!}
61 For squid Versions before 3.2.7 use this patch against a vanilla source-tree:
63 \begin{lstlisting}[breaklines]
64 --- support.cc.ini 2013-01-09 02:41:51.000000000 +0100
65 +++ support.cc 2013-01-21 16:13:32.549383848 +0100
67 "NO_TLSv1_2", SSL_OP_NO_TLSv1_2
70 +#ifdef SSL_OP_NO_COMPRESSION
72 + "NO_Compression", SSL_OP_NO_COMPRESSION
82 \subsubsection{Bluecoat}
83 %% https://kb.bluecoat.com/index?page=content&id=KB5549
85 \item[Tested with Version:] SGOS 6.5.x
87 BlueCoat Proxy SG Appliances can be used as forward and reverse proxies. The reverse proxy feature is rather under-developed, and while it is possible and supported, there only seems to be limited use of this feature "in the wild" - nonetheless there are a few cipher suites to choose from, when enabling SSL features.
89 \item[Only allow TLS 1.0,1.1 and 1.2 protocols:] \mbox{}
91 \begin{lstlisting}[breaklines]
94 $(config ssl)edit ssl-device-profile default
95 $(config device-profile default)protocol tlsv1 tlsv1.1 tlsv1.2
99 \item[Select your accepted cipher-suites:] \mbox{}
101 \begin{lstlisting}[breaklines]
103 Enter configuration commands, one per line. End with CTRL-Z.
104 $(config)proxy-services
105 $(config proxy-services)edit ReverseProxyHighCipher
106 $(config ReverseProxyHighCipher)attribute cipher-suite
107 Cipher# Use Description Strength
108 ------- --- ----------------------- --------
109 1 yes AES128-SHA256 High
110 2 yes AES256-SHA256 High
111 3 yes AES128-SHA Medium
112 4 yes AES256-SHA High
113 5 yes DHE-RSA-AES128-SHA High
114 6 yes DHE-RSA-AES256-SHA High
116 13 yes EXP-RC2-CBC-MD5 Export
118 Select cipher numbers to use, separated by commas: 2,5,6
122 The same protocols are available for forward proxy settings and should be adjusted accordingly:
123 In your local policy file add the following section:
124 \begin{lstlisting}[breaklines]
126 DENY server.connection.negotiated_ssl_version=(SSLV2, SSLV3)
129 Disabling protocols and ciphers in a forward proxy environment could lead to unexpected results on certain (misconfigured?) webservers (i.e. ones accepting only SSLv2/3 protocol connections)
136 \subsubsection{Pound}
137 % See http://www.apsis.ch/pound
138 % See https://help.ubuntu.com/community/Pound
142 \begin{lstlisting}[breaklines]
143 # HTTP Listener, redirects to HTTPS
148 Redirect "https://some.site.tld
155 AddHeader "Front-End-Https: on"
156 Cert "/path/to/your/cert.pem"
157 ## See 'man ciphers'.
158 Ciphers " TLSv1.2:!SSLv3:!SSLv2:AES256:!aNULL:!eNULL:!NULL"