1

Why squid do not filter download type: .doc when the url beggin with https://

only filter *.doc when beggin with http://

My files is cat /etc/squid/archivos

.doc$ #

My acl and RULES is simple

acl mired src 172.17.0.0/24 acl archivos urlpath_regex "/etc/squid/archivos"

http_access allow mired !archivos http_access deny all

2

The thing is HTTPS traffic is encrypted by definition. Thus the traffic only goes tunelled through Squid, and you cannot have an idea of what URLs are visited. Squid only knows what sites are being visited on such case.

So, it is not possible to log or block out visited URLs in those cases.

The only way to do it is enabling HTTPS interception, which is not easy to setup without dedicated security solutions, and which can be deemed an illegal action in several settings/countries.

For an introduction to the theme, see Intercepting HTTPS Traffic Using the Squid Proxy Service in pfSense

By default Squid proxy servers cannot monitor encrypted HTTPS traffic. Squid simply establishes a TCP connection to the destination server and responds to the client with an HTTP 200 response to indicate the connection was established.

Once this encrypted tunnel has been established Squid passes the packets between the client and the server but has no longer has any visibility to the traffic since it is protected by SSL encryption.

Over the last few years many popular web sites including Google, Youtube, Reddit and Facebook have started enabling HTTPS encryption by default. This means that without configuring HTTPS interception Squid proxies have limited filtering, monitoring and logging capabilities.

Fortunately Squid supports man in the middle SSL filtering which will allow you to more effectively monitor the traffic passing through the proxy server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.