Merge https://github.com/BetterCrypto/Applied-Crypto-Hardening

[ach-master.git] / src / practical_settings / proxy_solutions.tex

diff --git a/src/practical_settings/proxy_solutions.tex b/src/practical_settings/proxy_solutions.tex
index 418cfed..0d2bf65 100644 (file)
--- a/src/practical_settings/proxy_solutions.tex
+++ b/src/practical_settings/proxy_solutions.tex
@@ -1,3 +1,5 @@
+%hack.
+\gdef\currentsectionname{Proxies}
 %%\subsection{Intercepting proxy solutions and reverse proxies}
 
 Within enterprise networks and corporations with increased levels of paranoia or at least some defined security requirements it is common \textbf{not} to allow direct connections to the public internet.
@@ -18,34 +20,17 @@ While the latest solution might be the most "up to date", it arises a new front
 Conclusion: Don't forget to check your proxy solutions SSL-capabilities. Also do so for your reverse proxies!
 
 %% ---------------------------------------------------------------------- 
-\subsection{squid}
+\subsection{Squid}
 As of squid-3.2.7 (01 Feb 2013) there is support for the OpenSSL NO\_Compression option within squid config (CRIME attack) and if you combine that in the config file, with an enforcement of the server cipher preferences (BEAST Attack) you are safe.
 
 
-\paragraph*{squid.conf}
 \todo{UNTESTED!}
-\begin{lstlisting}
-options=NO_SSLv2,NO_TLSv1,NO_Compression,CIPHER_SERVER_PREFERENCE 
-cipher=%*\cipherStringB*)
-\end{lstlisting}
-
-\paragraph*{squid.conf}
+\configfile{squid.conf}{1363-1363,1379-1379}{Cipher selection and SSL options in Squid}
 %% http://forum.pfsense.org/index.php?topic=63262.0
-\todo{UNTESTED!}
-\begin{lstlisting}
-               NO_SSLv2    Disallow the use of SSLv2
-               NO_SSLv3    Disallow the use of SSLv3
-               NO_TLSv1    Disallow the use of TLSv1.0
-               NO_TLSv1_1  Disallow the use of TLSv1.1
-               NO_TLSv1_2  Disallow the use of TLSv1.2
-               SINGLE_DH_USE
-                               Always create a new key when using temporary/ephemeral
-                               DH key exchanges
-\end{lstlisting}
-
+%\todo{UNTESTED!}
+% see squid.conf, repeating the options here does not help.
 \todo{Patch here? Definitely working for 3.2.6!}
 For squid Versions before 3.2.7 use this patch against a vanilla source-tree:
-
 \begin{lstlisting}
 --- support.cc.ini      2013-01-09 02:41:51.000000000 +0100
 +++ support.cc  2013-01-21 16:13:32.549383848 +0100
@@ -75,6 +60,7 @@ For squid Versions before 3.2.7 use this patch against a vanilla source-tree:
 BlueCoat Proxy SG Appliances can be used as forward and reverse proxies. The reverse proxy feature is rather under-developed, and while it is possible and supported, there only seems to be limited use of this feature "in the wild" - nonetheless there are a few cipher suites to choose from, when enabling SSL features.
 
 \paragraph*{Only allow TLS 1.0,1.1 and 1.2 protocols:}
+~
 \begin{lstlisting}
 $conf t
 $(config)ssl
@@ -84,6 +70,7 @@ $(config device-profile default)protocol tlsv1 tlsv1.1 tlsv1.2
 \end{lstlisting}
 
 \paragraph*{Select your accepted cipher-suites:}
+~
 \begin{lstlisting}
 $conf t
 Enter configuration commands, one per line.  End with CTRL-Z.
@@ -126,29 +113,4 @@ Disabling protocols and ciphers in a forward proxy environment could lead to une
 \end{itemize*}
 
 \subsubsection{Settings}
-\begin{lstlisting}
-# HTTP Listener, redirects to HTTPS
-ListenHTTP
-    Address 10.10.0.10
-    Port    80
-    Service
-        Redirect "https://some.site.tld
-    End
-End
-## HTTPS Listener
-ListenHTTPS
-    Address      10.10.0.10
-    Port         443
-    AddHeader    "Front-End-Https: on"
-    Cert         "/path/to/your/cert.pem"
-    ## See 'man ciphers'.
-    Ciphers      "TLSv1.2:TLSv1.1:!SSLv3:!SSLv2:%*\cipherStringB*)"
-    Service
-        BackEnd
-            Address 10.20.0.10
-            Port 80
-        End
-    End
-End
-\end{lstlisting}
-
+\configfile{pound.cfg}{31}{HTTPS Listener in Pound}