Installation

Vous devez installer le paquet squid-openssl.

sudo apt update && sudo apt install squid-openssl

Quelques configurations :

# Dossier et taille du cache (5 Go)
cache_dir ufs /var/spool/squid 5120 16 256

# Durée de vie maximale des objets en cache (90 jours)
maximum_object_size 500 MB

# Activation du port HTTPS
https_port 3129 cert=/etc/squid/ssl/cert.pem key=/etc/squid/ssl/key.pem

# Politique d'interception HTTPS
ssl_bump bump all
acl step1 at_step SslBump1
ssl_bump peek step1
ssl_bump bump all

  Politique de sauvegarde des données :
Vous devez l'ajuster par rapport à votre environnement.

refresh_pattern ^ftp:		151200	50%	907200
refresh_pattern ^gopher:	10080	0%	10080
refresh_pattern -i \.(png|jpe?g|gif|webp|svg|ico|pdf|mp4|webm|ogg|mp3|wav|flac|woff2?|eot|ttf|otf|json|xml|txt)\? 43200 100% 43200 ignore-no-store override-expire
refresh_pattern -i \.(js|css)\? 43200 0% 43200
refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
refresh_pattern -i eclipse\.org/.*\.(jar|zip|tar|gz|deb) 129600 100% 129600 override-expire override-lastmod ignore-reload ignore-no-store
refresh_pattern -i deb\.debian\.org/.*\.deb             129600 100% 129600 override-expire override-lastmod ignore-reload ignore-no-store
refresh_pattern -i archive\.ubuntu\.com/.*\.deb          129600 100% 129600 override-expire override-lastmod ignore-reload ignore-no-store
refresh_pattern .		1440	20%	10080

Générer un certificat SSL (auto-signé)

sudo openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout /etc/squid/ssl/key.pem -out /etc/squid/ssl/cert.pem -subj "/CN=Squid-Proxy"

N'hezitez pas à verifier toutes les configurations en places :

grep -v '^#' /etc/squid/squid.conf | grep -v '^$'

Resultat :

acl localnet src 0.0.0.1-0.255.255.255	# RFC 1122 "this" network (LAN)
acl localnet src 10.0.0.0/8		# RFC 1918 local private network (LAN)
acl localnet src 100.64.0.0/10		# RFC 6598 shared address space (CGN)
acl localnet src 169.254.0.0/16 	# RFC 3927 link-local (directly plugged) machines
acl localnet src 172.16.0.0/12		# RFC 1918 local private network (LAN)
acl localnet src 192.168.0.0/16		# RFC 1918 local private network (LAN)
acl localnet src fc00::/7       	# RFC 4193 local private network range
acl localnet src fe80::/10      	# RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
acl Safe_ports port 80		# http
acl Safe_ports port 21		# ftp
acl Safe_ports port 443		# https
acl Safe_ports port 70		# gopher
acl Safe_ports port 210		# wais
acl Safe_ports port 1025-65535	# unregistered ports
acl Safe_ports port 280		# http-mgmt
acl Safe_ports port 488		# gss-http
acl Safe_ports port 591		# filemaker
acl Safe_ports port 777		# multiling http
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
include /etc/squid/conf.d/*.conf
http_access allow localhost
http_access deny all
http_port 3128
https_port 3129 cert=/etc/squid/ssl/cert.pem key=/etc/squid/ssl/key.pem
ssl_bump bump all
acl step1 at_step SslBump1
ssl_bump peek step1
ssl_bump bump all
maximum_object_size 500 MB
cache_dir ufs /var/spool/squid 5120 16 256
coredump_dir /var/spool/squid
refresh_pattern ^ftp:		151200	50%	907200
refresh_pattern ^gopher:	10080	0%	10080
refresh_pattern -i \.(png|jpe?g|gif|webp|svg|ico|pdf|mp4|webm|ogg|mp3|wav|flac|woff2?|eot|ttf|otf|json|xml|txt)\? 43200 100% 43200 ignore-no-store override-expire
refresh_pattern -i \.(js|css)\? 43200 0% 43200
refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
refresh_pattern -i eclipse\.org/.*\.(jar|zip|tar|gz|deb) 129600 100% 129600 override-expire override-lastmod ignore-reload ignore-no-store
refresh_pattern -i deb\.debian\.org/.*\.deb             129600 100% 129600 override-expire override-lastmod ignore-reload ignore-no-store
refresh_pattern -i archive\.ubuntu\.com/.*\.deb          129600 100% 129600 override-expire override-lastmod ignore-reload ignore-no-store
refresh_pattern .		1440	20%	10080

Demarer squid 

sudo systemctl stop squid
sudo rm -rf /var/spool/squid/*
sudo squid -z
sudo systemctl start squid
sudo systemctl enable squid

 

Vérifier le fichier de configuration 

Exécuter cette commande et recherchez principalement les lignes avec "ERROR". Pour les avestissements rassurez vous que c'est ce que vous souhaitez.

sudo squid -k parse

sudo squid -k reconfigure

Voir les informations d'entete pour un site avec curl:

curl -kx http://localhost:3128 http://habeuk.kksa/fr -I