Technet Cloud

http://dpetechnet.cloudapp.net/Home.aspx

IT Books Online

http://it-ebooks.info

 

Squid as a transparent proxy over ssl https

Setting up squid as a transparent proxy is fairly an easy job. If we Google for “how to set up squid as a transparent proxy” Google renders a lots of links for our reference. But it is commonly seen that when we are using transparent proxy we are unable to connect to https connection like Gmail and many more sites which https protocol for security concern. Sites which use http protocol can easily open.

Let’s understand first how squid proxy works in transparent mode. While setting up squid as a transparent proxy we can forward the entire request coming from port 80 to squid server’s port i.e. 3128 by default. When we talk about port 80 it means http protocol. What if we request for Gmail who uses https protocol and this protocol by default send request to port 443 of squid’s port, and we iptable firewall rules to forward traffic from port 80 to port 3128 and we forget about port 443 which is used by https protocol and squid is http proxy server. Now many folks may think it’s easy and forward all traffic coming from port 443 to squid port 3128.  No it won’t work.  Because https connection establishes a secure connection over the network and for that it uses certificate and public key private key pairs. And first of all I thanks God for RSA and DSA algorithm as it is not so easy to decrypt data which is encrypted by use of this algorithm. Squid proxy is a middle man who changes packets header and route traffic to internet world. So what we have to do is to create certificate and public key private key pair for internal network which can be used by squid client and squid server and later squid server can route your traffic to internet world. To yield faster results it is better to sign certificate from CA. self signed certificates are little bit slowing the connection. As in a transparent mode encryption and decryption done twice so it may yields result slow so I advised you to keep patience.

Steps are:

1. iptables  -t nat -A PREROUTING -i eth0  -p tcp --dport 80 -j REDIRECT --to-port 3128


2. iptables  -t nat -A PREROUTING  -i eth0 -p tcp --dport  443 -j REDIRECT --to-port 3130

Certificate and public key private key generation.

1. openssl genrsa -des3 -out server. Key 1024


2. openssl req -new –key -out server.csr


3. openssl req -new -key server. Key -out server.csr

Steps to remove passphrase

1. cp server. Key server. Key.old


2. openssl rsa -in server. Key.org -out server. Key

Create server certificate

Openssl x509 -req -days 365 -in  server.csr -sign.key -out server.crt

Now make some changes to squid.conf file

1. http_port 3128 transparent


2. https_port 3130 transparent cert=/”path to server.crt” key=/”path to server.key”.

Another easy way to create certificates and public key private key pair is using genkey utility. In order to use that you have crypto-utils package install on your machine.

Steps are:

1. #yum -y install crypto-utils


2. genkey -days 365 squidserver.hostname.com


3. Hit next.


4. Select number of bits for data encryption. Default is 1024. This command will generate random bits.


5. Generate the certificate.


6. I will suggest you to never used passphrase for key, because if u assigns passphrase to key then along with public key we need to share passphrase.


7. Certificate and key are stored at /etc/pki/tls/certs/ and /etc/pki/tls/private/


8. In squid.conf make necessary change like this

http_port 3128 transparent

https_port 3130 transparent cert=/etc/pki/tls/certs/squidserver.hostname.com.crt key=/etc/pki/tls/private/squidserver.hostname.com.key.

In order to run it in a proper way the desired way that we want we also need to configure BIND DNS for local intranet along with forwarders ON and in forwarder we need to define ISP IP Address. At Client side must define both gateway and DNS (In my Env it is Proxy server.)

How to Stop WordPress Asking for FTP details to Upgrade Plugins

1. First, we need to see what user Apache is running under. Type the following into a New file in any text editor. Save As whoami.php in the /var/www directory (or wherever you set Apache to serve files from):
   

   <?php echo(exec("whoami")); ?>

   
   


2. Open this file in a browser (for instance, localhost/whoami.php). It should reveal who the user is


3. This tells you that the web server is running under the user webuser.
   
   You can now give that user recursive ownership (all subfolders) of your WordPress installation using the command:
   
   chown -hR webuser:webuser /var/mydomain.com/public_html/wordpress/

What is Linux?

The above definition is probably not going to help you much if you don't know what an Operating system is, and what this UNIX thing is, so let's start at the first major point: What is an Operating system? I promise I won't make it boring!

1.1 What's An Operating System?

Imagine you have a brand new computer. Imagine that nobody had put a disk of any kind into it, ever. That would mean that there was no software installed on the system. If you switched the computer on; It would beep a few times and then tell you that it couldn't start an operating system. The most important software to a computer is one thing: -- the Operating System.

Without an Operating system, not even the world's strongest broadband can connect your computer to the 'net, you couldn't play music, you couldn't write letters. You couldn't do anything!

An operating system is the software that sits between you, the user, and the hardware inside the computer (all the chips etc). If you click the mouse over an icon on your screen, the operating system interprets that you want to load the program that you are clicking on. For all of this to happen, The Operating system (some times referred to as the OS or O/S) must know how to use a screen (to show you what's going on), to use a mouse (so you can move it around and click with it), to use your hard disk drive (to load up the data from it). It must also need to know pretty much everything else about the hardware installed inside your PC, ie: RAM, Floppy/CD drives, keyboards, joysticks, sound cards, printers, scanners, etc.

So when you start typing a letter, for example, you have already loaded up a word processing piece of software. This software is called application software and is running 'on top' of the Operating System, but nonetheless, all of the time whilst the word processor application is running, it talks constantly to the O/S for vital information.

Okay, we've pretty much established that an O/S is vital, but what else does an O/S do: Probably the most basic and yet essential tasks of an operating system is the job of managing our files and data. A basic O/S should be able to do the following with files and directories:

• Create them


• Move them to other directories


• Rename them


• Copy them


• Delete/remove them


• Send and receive files to/from other devices such as Printers/Scanners


• ...and a bit more.

Now you have the idea of what an Operating system is, let's find out about a specific type of operating system called UNIX...

1.2 What is UNIX? (And a little bit of history)


The operating system UNIX began life in 1969, in Bell Labs, a division of the American Telephone firm, AT&T. There are now many different types of UNIX, making it one of the longest running commercial operating systems available, way longer than Microsoft Windows or Apple MacOS.

• Unix History Timeline

Linux is just one type of UNIX which is most famously known for being a free (as in free speech) derivative of UNIX. Most of UNIX's different flavours are still being updated and are still in use all over the world today. Here are just some popular manufacturers and brands of UNIX, that you may or may not have heard of before:


Sun Microsystems: Solaris


Hewlett Packard: HP/UX

Berkley University: NetBSD and FreeBSD

With the exception of FreeBSD, there was (and still is) a pretty grand fee to own one of the above versions of UNIX. Mainly large commercial organisations and universities have traditionally used these UNIX variants, however Linux appears to be replacing traditional UNIX on a lot of corporate systems due to it's proven track record, it's growing reputation as a contender to UNIX, and it's low price tag, which can often be free.
UNIX is good because it is a true multi-tasking, multi-user operating system. This means that it can do more than one thing at a time and it can provide all it's services to lots of users at the same time. Modern day workplaces rely on servers to provide a central resource of information and connectivity to users.

So, Unix is pretty clever, huh?

Well, yes. It is, but Unix was also traditionally a pretty boring system that involved learning lots of commands.
Why don't we all use UNIX today if it's so good?


In 1981, a small company based in Seattle called Microsoft released an operating system, which through chance (Digital Research were supposed to get the contract), were taken on by IBM to go on their new home/small office based computer: the IBM PC (or Personal Computer). This system was also not graphical. It required commands, in a similar format to UNIX or CP/M, but they were a little easier to use, at the cost of being simpler and less powerful. The main pitfall of MS-DOS - (Microsoft's PC Operating System) was, that it had no multi-user, multi-tasking or networking support as standard. By the early 1990's, this was really starting to wear on PC users. UNIX still had far more power than most operating systems of the time, it was just way too expensive, and legal issues between UNIX vendors licensing UNIX was causing headaches and therefore did not have much exposure outside of large organisations, educational establishments and government offices.



During the 80's, a firm called Apple had released another computer, which was seperate from the PC, and did not run any PC software, because it relied on it's own O/S, named MacOS. This time, Apple had decided to make an operating system that was graphical, and later, incorporated colour, pictures, icons and even sounds! Instead of typing everything into the keyboard as commands, the same actions could be made as clicks and movements with a mouse. A device that the PC had, but rarely used.
In a similar sense, and time, the UNIX world, still very different to the market of the PC and the Mac, had a graphical front-end to it's command-line console, it was called X, or 'The X Window System'.

In 1990, Microsoft eventually released Windows 3.0 (versions 1 and 2 did not sell well) Windows at the time was a 16-bit, single-tasking, single user, graphical interface built on-top of MS-DOS. but UNIX still prevailed: it was multi-user, multi-tasking and it worked on 32 or 64-bit platforms.It took until 1995, with the advent of Microsoft Windows 95 for Windows to finally go 32 bit, multi tasking, and capable of being multi-user (although not best suited. Windows NT came along shortly after, to do that job).

1.3 How does Linux differ from UNIX?

During the time from 1991 to 1995, many computing or engineering students were accustomed to the power of UNIX and X, at university. In Uni, most students had wonderful new things like E-Mail, The Internet and more. At home, they would have to make do with their 16 bit computers, waiting for all these powers to come to their homes one day.

Enter: Linus Torvalds

Linus was, in 1991, a student in Finland studying Computer programming at The University of Helsinki. Linus used UNIX at University on a daily basis. He got bored of his 386 PC running MS-DOS, and decided to start his own kernel, which is the name for the code at the heart of every operating system that talks to the hardware directly. He wanted to distribute the software freely, because it was a hobby, not a commercial product, and also to see what others thought of it. He finished the first Linux kernel in late 1991. Not only had he made a 32 bit kernel, in which programs could be run he made it do quite a lot to make it look and feel like Unix, but he didn't have any software to run on it.

 

• Read Linus' very first post to the Internet in 1991, about the creation of what would become Linux

Luckily, an ex-student in the USA, by the name of Richard Stallman had created a team of programmers devoted to free software, he called this the Free Software Foundation, who believed in making software free to distribute, and free to obtain the source code along with it so that others could make improvements to the software through the Internet. The GNU GPL (General Public License) that the Free Software Foundation made, also stated that the authors of the software could charge for the software, as long as they are willing for it to be freely distributed. By creating community-based software, that has open standards and is subject to peer review, the quality of the software would be good. The opportunities for profit would come from different avenues such as support and consultancies.
Stallman had been busy making a whole suite of software, for example: an editor called emacs, which is very popular today, and the bash (Bourne Again Shell), a command line interface based upon the original Bourne Shell, that comes with the BSD variant of UNIX. The FSF's software was entirely based upon the UNIX software suite, and essentially improved on it. In 1991, the only thing that the FSF were missing to make it a fully fledged operating system was The Kernel.

Linus altered the code to work on his platform so that the FSF's code would work with his new kernel, that he ended up calling Linux.