IT Books Online

http://it-ebooks.info

 

Squid as a transparent proxy over ssl https

Setting up squid as a transparent proxy is fairly an easy job. If we Google for “how to set up squid as a transparent proxy” Google renders a lots of links for our reference. But it is commonly seen that when we are using transparent proxy we are unable to connect to https connection like Gmail and many more sites which https protocol for security concern. Sites which use http protocol can easily open.

Let’s understand first how squid proxy works in transparent mode. While setting up squid as a transparent proxy we can forward the entire request coming from port 80 to squid server’s port i.e. 3128 by default. When we talk about port 80 it means http protocol. What if we request for Gmail who uses https protocol and this protocol by default send request to port 443 of squid’s port, and we iptable firewall rules to forward traffic from port 80 to port 3128 and we forget about port 443 which is used by https protocol and squid is http proxy server. Now many folks may think it’s easy and forward all traffic coming from port 443 to squid port 3128.  No it won’t work.  Because https connection establishes a secure connection over the network and for that it uses certificate and public key private key pairs. And first of all I thanks God for RSA and DSA algorithm as it is not so easy to decrypt data which is encrypted by use of this algorithm. Squid proxy is a middle man who changes packets header and route traffic to internet world. So what we have to do is to create certificate and public key private key pair for internal network which can be used by squid client and squid server and later squid server can route your traffic to internet world. To yield faster results it is better to sign certificate from CA. self signed certificates are little bit slowing the connection. As in a transparent mode encryption and decryption done twice so it may yields result slow so I advised you to keep patience.

Steps are:

1. iptables  -t nat -A PREROUTING -i eth0  -p tcp --dport 80 -j REDIRECT --to-port 3128


2. iptables  -t nat -A PREROUTING  -i eth0 -p tcp --dport  443 -j REDIRECT --to-port 3130

Certificate and public key private key generation.

1. openssl genrsa -des3 -out server. Key 1024


2. openssl req -new –key -out server.csr


3. openssl req -new -key server. Key -out server.csr

Steps to remove passphrase

1. cp server. Key server. Key.old


2. openssl rsa -in server. Key.org -out server. Key

Create server certificate

Openssl x509 -req -days 365 -in  server.csr -sign.key -out server.crt

Now make some changes to squid.conf file

1. http_port 3128 transparent


2. https_port 3130 transparent cert=/”path to server.crt” key=/”path to server.key”.

Another easy way to create certificates and public key private key pair is using genkey utility. In order to use that you have crypto-utils package install on your machine.

Steps are:

1. #yum -y install crypto-utils


2. genkey -days 365 squidserver.hostname.com


3. Hit next.


4. Select number of bits for data encryption. Default is 1024. This command will generate random bits.


5. Generate the certificate.


6. I will suggest you to never used passphrase for key, because if u assigns passphrase to key then along with public key we need to share passphrase.


7. Certificate and key are stored at /etc/pki/tls/certs/ and /etc/pki/tls/private/


8. In squid.conf make necessary change like this

http_port 3128 transparent

https_port 3130 transparent cert=/etc/pki/tls/certs/squidserver.hostname.com.crt key=/etc/pki/tls/private/squidserver.hostname.com.key.

In order to run it in a proper way the desired way that we want we also need to configure BIND DNS for local intranet along with forwarders ON and in forwarder we need to define ISP IP Address. At Client side must define both gateway and DNS (In my Env it is Proxy server.)

How to Stop WordPress Asking for FTP details to Upgrade Plugins

1. First, we need to see what user Apache is running under. Type the following into a New file in any text editor. Save As whoami.php in the /var/www directory (or wherever you set Apache to serve files from):
   

   <?php echo(exec("whoami")); ?>

   
   


2. Open this file in a browser (for instance, localhost/whoami.php). It should reveal who the user is


3. This tells you that the web server is running under the user webuser.
   
   You can now give that user recursive ownership (all subfolders) of your WordPress installation using the command:
   
   chown -hR webuser:webuser /var/mydomain.com/public_html/wordpress/

ESX Server - A general system error occurred: The file is too big for the filesystem

So there I was, trying to create an uber sized partition on my RAID 10 array within my vmfs3 partition.

The problem? A general system error occurred: The file is too big for the filesystem
This was the error I received when attempting to create a 600GB Virtual Disk on VMWare ESX Server 3.5.

This was a problem. I learned the reason why though. Since I partitioned the storage volumes during installation the installer used block size 1 which only allows Virtual Disks of 256GB.

The solution? Reformat the volume with larger block sizes.

Block size Max Virtual Disk size
1 256 GB
2 512 GB
4 1024 GB
8 2048 GB

Now I had to figure out how to do this without destroying my data.

My server has a 73GB Mirrored boot drive and 900GB of RAID 10. Fortunatly I had enough free space on the boot drive to transfer the data from the RAID 10 temporarily.

Logging into the console of the host I:
cd /vmfs/volumes/vh-01:storage1
Having previously taken note of the volume label and the device name of the volume I wished to modify, in my case vh-01:storage1 and vmhba1:1:0:1, I move the existing data out of Storage1 and into Storage2.
Use the Storage Browser to move your VMs
Next I ran the command to reformat Storage2
vmkfstools --createfs vmfs3 --blocksize 4M -S vh-01:storage1 vmhba1:1:0:1

I chose a 4MB blocksize because this volume will never exceed 1024MB.

Then I just moved the data back to Storage1.