Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #181925
| From | Darac Marjal <mailinglist@darac.org.uk> |
|---|---|
| Newsgroups | linux.debian.user |
| Subject | Re: https_port |
| Date | 2017-06-08 15:30 +0200 |
| Message-ID | <tQ5FE-4OD-13@gated-at.bofh.it> (permalink) |
| References | (1 earlier) <tPKhP-7Rr-5@gated-at.bofh.it> <tPKBf-7Z0-79@gated-at.bofh.it> <tPSfs-4Fa-121@gated-at.bofh.it> <tQ4JA-4eB-17@gated-at.bofh.it> <tQ52V-4l3-1@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
[Multipart message — attachments visible in raw view] - view raw
On Thu, Jun 08, 2017 at 08:41:14AM -0700, Adiel Plasencia Herrera wrote:
> How to generate the certificate and the key to make a very
> basic configuration of the https connection.
NTP doesn't use HTTPS. It uses its own port, it's own protocol and
implements standard cryptography in a manner more suited to the
protocol.
See https://www.eecis.udel.edu/~mills/ntp/html/autokey.html for more
details.
>
> As
> basic as possible.
> regards
>
>
>
>
>
>
> On 08/06/17 03:28, Adiel Plasencia Herrera wrote:
> > > Hello, > > They would help me with a
> configuration of my squid that I want to > implement. >
> > My proxy passes all traffic to a parent proxy and I want clients
> to > connect to my proxy via https. > > Can
> you help me how to implement the connection to my proxy via https?
> > > To better explain what I want attached 2 pictures. The
> image with > 1.jpg name shows my proxy configuration with type
> HTTp that connects > well to internet. > >
> What I want is for the connection to my proxy to be by the form of the
> > 2.jpg image that uses the HTTPS type. > > Or if
> it is possible then leave the 2 forms.
> What operating system are you using, and what applications are you
> wanting to use this proxy connection?
>
> The normal configuration is simply to add an https_port line with cert=
> parameter to your squid.conf. More details on that below.
>
>
> > > > This is my current configuration: >
> acl trabajadores src 10.5.7.3 10.5.7.5 > <snip>
> > > http_access allow trabajadores > http_access
> deny !Safe_ports > http_access deny CONNECT !SSL_ports
> You custom http_access rules ("allow trabajadores") should be down
> here
> after the basic security checks.
>
> > http_access deny all > > > http_port
> 3128
>
> Date: Thu, 8 Jun 2017 01:04:31 +1200
> From: Amos Jeffries <squid3@treenet.co.nz>
> To: squid-users@lists.squid-cache.org
> Subject: Re: [squid-users] https_port
> Message-ID: <764ecd5f-6f6c-0eb5-90b4-5591ab5e1920@treenet.co.nz
> >
> Content-Type: text/plain; charset=utf-8; format=flowed
> The above port is for receiving plain-text connections to the proxy.
> Most software supports this, with a few exceptions (usually Java apps).
>
>
> To accept TLS connections to the proxy (not HTTPS *over* the proxy),
> what you do is add an https_port line here. That https_port line needs a
> cert= parameter containing the proxy server certificate. You may need
> other TLS/SSL parameters to fine tune what the TLS does, but just start
> with getting that basic setup to work.
> <
> [1]http://www.squid-cache.org/Doc/config/https_port/>
>
> For example:
> https_port 3129 cert=/etc/squid/proxy.pem
>
> (the proxy.pem file here contains both the public server cert and
> private server key for that cert).
>
> Many GUI applications (most notably browsers) do not support this type
> of connection to a proxy (or not well if they do). Which is where the
> Q's about your OS and applications come in. You may need to setup
> environment variables or PAC files to get the applications to work.
>
>
> Note that this is *very* different situation to intercepting port 443
> traffic. Much more different than port 3128 vs. intercepted port 80.
> HTTPS traffic goes through these TLS proxy connections with
> double-layered encryption, so this setup does *not* magically make the
> proxy able to see inside HTTPS if that is what you are really after.
>
> Amos
>
>References
>
> Visible links
> 1. http://www.squid-cache.org/Doc/config/https_port/
--
For more information, please reread.
Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
NTP.conf pool vs server ray <ray@aarden.us> - 2017-06-07 15:20 +0200
Re: NTP.conf pool vs server Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-07 15:30 +0200
Re: NTP.conf pool vs server Gene Heskett <gheskett@shentel.net> - 2017-06-07 16:50 +0200
Re: NTP.conf pool vs server Gene Heskett <gheskett@shentel.net> - 2017-06-07 16:40 +0200
Re: NTP.conf pool vs server Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-07 17:00 +0200
Re: NTP.conf pool vs server Darac Marjal <mailinglist@darac.org.uk> - 2017-06-07 17:00 +0200
Re: NTP.conf pool vs server Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-07 17:10 +0200
Re: NTP.conf pool vs server Joshua Schaeffer <jschaeffer0922@gmail.com> - 2017-06-07 17:30 +0200
Re: NTP.conf pool vs server Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-07 17:50 +0200
Re: NTP.conf pool vs server Henrique de Moraes Holschuh <hmh@debian.org> - 2017-06-07 18:10 +0200
Re: NTP.conf pool vs server Darac Marjal <mailinglist@darac.org.uk> - 2017-06-07 17:20 +0200
Re: NTP.conf pool vs server Gene Heskett <gheskett@shentel.net> - 2017-06-08 01:10 +0200
Re: NTP.conf pool vs server Darac Marjal <mailinglist@darac.org.uk> - 2017-06-08 14:30 +0200
Re: https_port "Adiel Plasencia Herrera" <adielp@estereocentro.icrt.cu> - 2017-06-08 14:50 +0200
Re: https_port Darac Marjal <mailinglist@darac.org.uk> - 2017-06-08 15:30 +0200
Re: https_port Henrique de Moraes Holschuh <hmh@debian.org> - 2017-06-08 17:00 +0200
Re: https_port "Adiel Plasencia Herrera" <adielp@estereocentro.icrt.cu> - 2017-06-08 17:20 +0200
Re: https_port Darac Marjal <mailinglist@darac.org.uk> - 2017-06-08 17:30 +0200
Re: https_port Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-08 17:40 +0200
Re: https_port Darac Marjal <mailinglist@darac.org.uk> - 2017-06-08 17:50 +0200
Re: https_port "Adiel Plasencia Herrera" <adielp@estereocentro.icrt.cu> - 2017-06-08 18:00 +0200
Re: https_port Jim Ohlstein <jim@mailman-hosting.com> - 2017-06-08 19:10 +0200
Re: https_port Charlie Kravetz <cjk@teamcharliesangels.com> - 2017-06-09 16:40 +0200
Reply-to-all or reply-to-list again (was: https_port) Nicolas George <george@nsup.org> - 2017-06-09 16:50 +0200
Re: Reply-to-all or reply-to-list again (was: https_port) Fungi4All <fungilife@protonmail.com> - 2017-06-09 17:20 +0200
Re: Reply-to-all or reply-to-list again The Wanderer <wanderer@fastmail.fm> - 2017-06-09 17:20 +0200
Re: Reply-to-all or reply-to-list again Nicolas George <george@nsup.org> - 2017-06-09 18:00 +0200
Re: Reply-to-all or reply-to-list again The Wanderer <wanderer@fastmail.fm> - 2017-06-09 21:20 +0200
Re: Reply-to-all or reply-to-list again Joel Rees <joel.rees@gmail.com> - 2017-06-10 04:20 +0200
Re: Reply-to-all or reply-to-list again Fungi4All <fungilife@protonmail.com> - 2017-06-10 16:00 +0200
Re: Reply-to-all or reply-to-list again Joel Rees <joel.rees@gmail.com> - 2017-06-10 16:30 +0200
Re: Reply-to-all or reply-to-list again Fungi4All <fungilife@protonmail.com> - 2017-06-10 18:00 +0200
Re: Reply-to-all or reply-to-list again (was: https_port) Gene Heskett <gheskett@shentel.net> - 2017-06-09 17:30 +0200
Re: NTP.conf pool vs server Gene Heskett <gheskett@shentel.net> - 2017-06-08 16:10 +0200
Re: NTP.conf pool vs server John Hasler <jhasler@newsguy.com> - 2017-06-07 18:10 +0200
Re: NTP.conf pool vs server Brian <ad44@cityscape.co.uk> - 2017-06-07 18:30 +0200
Re: NTP.conf pool vs server David Wright <deblis@lionunicorn.co.uk> - 2017-06-11 18:00 +0200
Re: NTP.conf pool vs server Brian <ad44@cityscape.co.uk> - 2017-06-11 19:30 +0200
Re: NTP.conf pool vs server Teemu Likonen <tlikonen@iki.fi> - 2017-06-08 08:40 +0200
Re: NTP.conf pool vs server Curt <curty@free.fr> - 2017-06-08 09:20 +0200
Re: NTP.conf pool vs server Gene Heskett <gheskett@shentel.net> - 2017-06-08 15:40 +0200
Re: NTP.conf pool vs server Jim Ohlstein <jim@mailman-hosting.com> - 2017-06-07 18:40 +0200
Re: NTP.conf pool vs server Kushal Kumaran <kushal@locationd.net> - 2017-06-07 17:00 +0200
csiph-web